AEPD (Spain) - PS/00161/2021

AEPD (Spain) - PS/00161/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 17(1) GDPR Article 21 LSSI
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	25.08.2021
Published:	25.08.2021
Fine:	15,000 €
Parties:	'D. A.A.A' AD735 Data Media Advertising S.L.
National Case Number/Name:	PS/00161/2021
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	aepd.es (in ES)
Initial Contributor:	n/a

The Spanish DPA fined a marketing company €15,000 for sending automated advertising emails without consent, even after a complainant exercised their right to erasure.

English Summary

Facts

A data subject received a number of advertising emails that stated his personal data was part of an 'automated file' on a database managed by AD735 Data Media Advertising. He sent an email to the company requesting the deletion of his personal data from all such databases and cancel any further commercial communications.

Following this first email, the data subject kept receiving automated advertising emails and sent four reminders of his request, three of which were ignored. Thus, he complained to the AEPD.

Holding

The AEPD found two infringements.

First, it held the company infringed Article 17(1) GDPR for failing to comply with the right to erasure exercised by the claimant and imposed a €10,000 fine.

Second, it held the company infringed Article 21 the LSSI (Law of Information Society Services and Electronic Commerce) for sending commercial communications recipients did not consent to and imposed a €5,000 fine.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                 1/8








     Procedure No.: PS / 00161/2021

                RESOLUTION OF SANCTIONING PROCEDURE


In the sanctioning procedure PS / 00161/2020, instructed by the Spanish Agency for
Data Protection before the entity, AD735 DATA MEDIA ADVERTISING S.L., with
CIF .: B87781795, (hereinafter, “the claimed party”), by virtue of the complaint filed
given by D. A.A.A., (hereinafter, “the complaining party”), and based on the following

following:
                                   BACKGROUND

FIRST: On 11/20/20, you have an entry in this Agency, written by
the claimant, in which it indicated, among others, the following:


“I began to receive spam from companies where they told me:" inform you
We know that your personal data is part of an automated file of which it is
responsible AD735 DATA MEDIA ADVERTISING. I requested the discharge on October 15,
2020 and I insisted on October 27 and 29 and November 4 and 13. On the 15th and 29th of
October I received a reply from "baja@ad735.es" saying "In attention to

your request to delete your personal data, we confirm that we have-
We proceeded to delete from the PREMIUM SALES personal data file all the
data of its ownership that appear in it, the deletion will be effective within a period
maximum of 7 days. "Today (11/20) I complained again with the same automated response.
tized ”.


The claim letter is accompanied by the following documentation:

1º.- Copy of the email sent, dated 10/15/20, from the address of
Claimant's email to the email address, low @ digital-
pub.online, where it is requested that you proceed to cancel your personal data and

all commercial communications.

2º.- Copy of email sent on 10/15/20, from the address
baja@ad735.es, to the claimant's email address indicating that their
request has been attended and that, within a maximum period of 7 days, they will proceed to delete

of all your personal data from the "Premiun Sales" file.

3º.- Copy of three emails received on 10/27/20, from companies belonging to
clients to the insurance, telecommunications and energy sectors, with messages published
Citizens, where you can read, at the bottom of them, the following message:

“(…) We inform you that your personal data is part of an automated file
for which AD735 DATA MEDIA ADVERTISING S.L is responsible (…) ”.

SECOND: On 01/26/21 and 02/08/21, two requirements are addressed
informative to the claimed entity, in accordance with the provisions of article
65.4 of Organic Law 3/2018, of December 5, on the protection of personal data

and guarantee of digital rights, ("LOPDGDD").




C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/8








According to the certificate of the Electronic Notifications and Electronic Address Service, the
request sent to the claimed entity, on 01/26/21 through the
NOTIFIC @ notifications, was rejected at destination, on 02/06/21.


According to a certificate from the State Postal and Telegraph Society, the request to send
to the claimed entity, on 02/08/21, through the SICER service, it was admitted
do en destination by D. B.B.B. *** NIF. 1.

THIRD: On 04/14/21, by the Director of the Spanish Agency for

Data Protection an agreement is issued for the admission of processing of the complaint presented.
given by the claimant, in accordance with article 65 of the LPDGDD, as there is no
received any response, on the part of the claimed entity, to the requirements of
information sent from this Agency.


FOURTH: On 04/19/21, the Director of the Spanish Agency for the Protection of
Data agreed to initiate a sanctioning procedure against the claimed entity, by virtue of
the powers established by:

    - Infringement of article 17.1 of the RGPD, punishable in accordance with

        provided in art. 58.2 of the aforementioned RGPD, for breach of the right to
        suppression exercised by the claimant, imposing an initial penalty of 10,000
        euros (ten thousand euros).


    - Infringement of article 21 of the LSSI, regarding the sending of communications co-
        without the express consent of the recipient, imposing a penalty
        initial payment of 5,000 euros (five thousand euros).


FIFTH: Notified the initiation of the file on 04/30/21, to date, there is no record
that any response has been given to the initiation of the file, within the period
granted for it.

Of the actions carried out in this procedure, of the information and documents

documentation presented by the parties, the following have been accredited:

                                 PROVEN FACTS

1.- As indicated in the claim letter, the claimant received emails not

desired from companies where you were indicated that your personal data is part of
of an automated file whose responsible was AD735 DATA MEDIAADVERTISING.

The claim letter is accompanied by the following documentation:


a.- Copy of the email sent, dated 10/15/20, from the email address
Claimant's email address to the email address, low @ digitalpu-
b.online, where it is requested that you proceed to cancel your personal data and all
you give commercial communications.

b.- Copy of email sent on 10/15/20, from the address

baja@ad735.es, to the claimant's email address indicating that their

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/8








request has been attended and that, within a maximum period of 7 days, they will proceed to delete
of all your personal data from the "Premiun Sales" file.


c.- Copy of three emails received on 10/27/20, from companies belonging to
clients to the insurance, telecommunications and energy sectors, with messages published
Citizens, where you can read, at the bottom of them, the following message:
“(…) We inform you that your personal data is part of an automated file
for which AD735 DATA MEDIA ADVERTISING S.L is responsible (…) ”.


2.- On the part of this Agency, two informative requests were addressed to the
claimed entity, which were, rejected the first and not answered the
second, there is evidence of its receipt by: D. B.B.B. *** NIF. 1.
3.- Initiated the present sanctioning procedure, and notified the defendant, on the date
Today, there is no evidence that any response has been given to the initiation of the file,

within the period granted for it.

                            FOUNDATIONS OF LAW

                                     I- Competition.


    - Regarding the processing of personal data:

It is competent to initiate and resolve this Penalty Procedure, the Director of
the Spanish Data Protection Agency, by virtue of the powers that art 58.2
of Regulation (EU) 2016/679, of the European Parliament and of the Council, of 04/27/16,

Relating to the Protection of Natural Persons with regard to the Treatment of
Personal Data and the Free Circulation of this Data (RGPD) recognizes each Au-
Control and, as established in arts. 47, 64.2 and 68.1 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and Guarantee of
Digital Rights (LOPDGDD).


Sections 1) and 2), of article 58 of the RGPD, list, respectively, the
investigative and corrective powers that the supervisory authority may provide to the
effect, mentioning in point 1.d), that of: “notify the person in charge or commission of the
treatment of alleged infringements of this Regulation ”and in 2.i), that of:
“Impose an administrative fine in accordance with article 83, in addition to or instead of the

measures mentioned in this section, according to the circumstances of each
case.".

    - Regarding the sending of advertising emails without consent

        Of the interested:

It is competent to initiate and resolve this Penalty Procedure, the Director of
the Spanish Agency for Data Protection, in accordance with the provisions of the
art. 43.1, second paragraph, of Law 34/2002, of July 11, on Services of the
Information Society and Electronic Commerce (LSSI), is competent to initiate

and resolve this Penalty Procedure, the Director of the Spanish Agency for
Data Protection.

II- On the breach of the right of opposition exercised by the claimant:

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/8









According to the information and documentation presented in the claim, on 10/15/20, the
claimant sent an email to the claimed entity requesting that the

proceed to cancel your personal data and that they will stop sending you communications
commercial.

That same day, the claimed entity replies to the claimant indicating that his request
You have been attended and that, within a maximum period of 7 days, they will proceed to delete all
two your personal data from the file "Premiun Sales".


However, on 10/27/20, 12 days later, the claimant receives communication again.
commercial purposes of several companies belonging to the insurance, tele-
communications and energy, with advertising messages, where you can read, on the
bottom of the same, the following message: “(…) we inform you that your personal data

sonals are part of an automated file for which AD735 DATA is responsible
MEDIA ADVERTISING S.L (…) ”.

In this sense, article 12 of the RGPD, establish that:

1.- The person responsible for the treatment will take the appropriate measures to facilitate the

all information indicated in articles 13 and 14, as well as any communication
cation pursuant to articles 15 to 22 and 34 relating to the treatment, in a specific way
transparent, intelligible and easily accessible, with clear and simple language, in particular
cular any information specifically directed at a child. The information will be fa-
cited in writing or by other means, including, if applicable, by electronic means.

When requested by the interested party, the information may be provided verbally always
that the identity of the interested party is proven by other means.

2.The person in charge of the treatment will facilitate the interested party the exercise of their rights in
pursuant to articles 15 to 22. In the cases referred to in article 11, paragraph 2,

The person in charge will not refuse to act at the request of the interested party in order to exercise their
rights under Articles 15 to 22, unless you can show that you are not in
conditions of identifying the interested party.

3.The data controller will provide the interested party with information regarding their ac-
proceedings on the basis of an application pursuant to Articles 15 to 22, and, in any-

whichever case, within a period of one month from the receipt of the request. Said term
it may be extended for another two months if necessary, taking into account the complexity
age and number of requests. The person in charge will inform the interested party of any
of said extensions within a period of one month from receipt of the request, indicating
Finding the reasons for the procrastination. When the interested party submits the request by means

electronic means, the information will be provided by electronic means whenever possible, to
Unless the interested party requests that it be provided otherwise.

For its part, article 17.1 of the same RGPD, regarding the "Right to erasure
("The right to be forgotten") ”, establishes that:


1.The interested party shall have the right to obtain without undue delay from the person responsible for the
deletion of personal data concerning him, which will be obliged to
do to delete without undue delay the personal data when any of the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/8








following circumstances: a) the personal data is no longer necessary in relation to
for the purposes for which they were collected or otherwise processed; 4.5.2016 L 119/43
Official Journal of the European Union EN b) the interested party withdraws the consent that

the treatment is based in accordance with article 6, paragraph 1, letter a), or article
Article 9, paragraph 2, letter a), and this is not based on another legal basis; c) the interest
sado objects to the processing pursuant to Article 21 (1) and does not prevail
other legitimate reasons for the treatment, or the interested party opposes the treatment
in accordance with Article 21 (2); d) the personal data have been treated illicitly
tamente; e) personal data must be deleted in order to comply with an obligation

legal provision established in the law of the Union or of the Member States that
apply to the person responsible for the treatment; f) the personal data have been obtained in
relation with the offer of services of the information society mentioned in the
Article 8, paragraph 1.


The facts presented suppose the violation of article 17.1 of the RGPD, in relation to
with Article 12 of the aforementioned Regulation, since it has been proven that the
entity did not act diligently, having sent new emails
advertising to the claimant after having exercised this, the right of deletion.

For its part, article 72.1.k) of the LOPDGDD, considers very serious, for the purposes of

prescription, “The impediment or the obstruction or the repeated non-attention of the
exercise of the rights established in articles 15 to 22 of the Regulation ”.

This offense may be punished with a fine of a maximum of € 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the

total annual global business volume of the previous financial year, opting for the
of a higher amount, in accordance with article 83.5.b) of the RGPD.

In accordance with the indicated precepts, and without prejudice to what results from the
instruction of the procedure, in order to fix the amount of the sanction to be imposed in

In this case, it is considered that the sanction to be imposed should be adjusted according to
with the following aggravating criteria established in article 83.2 of the RGPD:

    - The facts that are the subject of the claim are a consequence of the clear lack of
        due diligence on the part of the claimed entity, (section b).


The balance of the circumstances contemplated in article 83.2 of the RGPD, with
Regarding the offense committed, by violating the provisions of article 17.1 of the
RGPD, in relation to article 12 of the RGPD, allows setting a penalty of 10,000
euros, (ten thousand euros).


III.- On the sending of advertising emails without the consent of the
interested,

In this sense, article 21 of the LSSI provides the following:


"1. The sending of advertising or promotional communications by co-
electronic mail or other equivalent electronic means of communication that previously
have not been requested or expressly authorized by the recipients of the
themselves.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/8









2. The provisions of the preceding section shall not apply when there is a relationship
prior contractual provision, provided that the provider has obtained lawfully the

contact details of the recipient and will use them to send communications with
related to products or services of your own company that are similar
those who were initially contracted with the client.

In any case, the provider must offer the recipient the possibility of opposing the
processing of your data for promotional purposes through a simple procedure

and free of charge, both at the time of data collection and in each of the
commercial communications to direct you.

When the communications have been sent by email, said me-
The diode must necessarily consist of the inclusion of an email address

address or other valid electronic address where this right can be exercised, remain-
It is prohibited to send communications that do not include said address. "

Therefore, based on the evidence available at this time,
and without prejudice to the results of the investigation, the facts presented could lead to
ner the violation of article 21 of the LSSI, by the claimed entity, when entering

send advertising emails without the consent of the affected party.

The aforementioned offense is classified as minor in art. 38.4.d) of said norm
ma, which qualifies as such, “Sending commercial communications by email
sole or other equivalent electronic means of communication when in said shipments

the requirements established in article 21 are not met and does not constitute an infringement
serious".

In accordance with the provisions of article 39.1.c) of the LSSI, minor offenses may
be sanctioned with a fine of up to € 30,000, establishing the criteria for its

regulation in article 40 of the same rule.

After the evidence obtained, it is considered that in this case it acts as an aggravation
tea:

    - The existence of intentionality (section a), since, the claimed entity in-

        saw commercial advertising on the claimant's phone, through emails
        advertising only, without the consent of the interested party.


In accordance with these criteria, it is considered appropriate to impose a sanction on the defendant
5,000 euros (two thousand euros), for the violation of article 21 of the LSSI

                                              IV
The balance of the circumstances contemplated in the present case, with respect to the
infractions committed by the claimed entity allows setting a total sanction of

15,000 euros, (fifteen thousand euros): 10,000 euros for violation of article 17.1 of the
RGPD and 5,000 euros for violation of article 21 of the LSSI.

In accordance with the foregoing, by the Director of the Spanish Agency for Pro-
Data protection,

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/8








                                       RESOLVES

FIRST: IMPOSE the entity AD735 DATA MEDIAADVERTISING S.L., with CIF .:

B87781795, for the violation of the article Violation of the article of article 17.1 of the
RGPD, a penalty of 10,000 euros (ten thousand euros), regarding the breach of the
right of deletion exercised by the claimant and for the violation of article 21 of the
LSSI, 5,000 euros (five thousand euros), regarding the sending of commercial communications
them without the express consent of the recipient.


SECOND: NOTIFY this resolution to the entity AD735 DATA MEDIA
ADVERTISING S.L

THIRD: Warn the sanctioned person that the sanction imposed must be effective
once this resolution is enforceable, in accordance with the provisions of the

Article 98.1.b) of Law 39/2015, of October 1, on the Administrative Procedure Co-
of the Public Administrations, within the voluntary payment period indicated by the
Article 68 of the General Collection Regulations, approved by Royal Decree
939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17-
bre, by entering the restricted account No. ES00 0000 0000 0000 0000 0000,
opened in the name of the Spanish Data Protection Agency at Banco CAIXA-

BANK, S.A. or otherwise, it will be collected in the executive period.

Received the notification and once executive, if the date of execution is found
between the 1st and the 15th of each month, both inclusive, the deadline for making the vo-
luntario will be until the 20th day of the following or immediately subsequent business month, and if

between the 16th and the last day of each month, both inclusive, the payment term
it will be until the 5th of the second following or immediately subsequent business month.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which puts an end to administrative proceedings (article 48.6 of the LO-
PDGDD), and in accordance with the provisions of articles 112 and 123 of the Law
39/2015, of October 1, of the Common Administrative Procedure of the Administrations
tions, the interested parties may, optionally, file an appeal for repo-
sition before the Director of the Spanish Agency for Data Protection within the period of

one month from the day following notification of this resolution or directly
contentious administrative appeal before the Contentious-Administrative Chamber
of the National High Court, in accordance with the provisions of article 25 and the section
do 5 of the fourth additional provision of Law 29/1998, of July 13, regulating
the Contentious-Administrative Jurisdiction, within a period of two months from the

day following notification of this act, as provided in article 46.1 of the
valid legal text.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of Law 39/2015,
of October 1, of the Common Administrative Procedure of the Public Administrations

official, the final resolution may be provisionally suspended through administrative channels if the
interested party expresses his intention to file contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Agency for Data Protection, presenting it through

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/8









of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
web /], or through any of the other records provided for in art. 16.4 of the ci-

Tada Law 39/2015, of October 1. You must also forward to the Agency the documentation
tion that proves the effective filing of the contentious-administrative appeal. Yes
the Agency was not aware of the filing of the contentious-administrative appeal

nistrative within a period of two months from the day following the notification of the
This resolution would terminate the precautionary suspension.

Mar Spain Martí

Director of the Spanish Agency for Data Protection.




















































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es