AEPD (Spain) - PS/00101/2020

AEPD - PS/00101/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6 GDPR Article 7 GDPR Article 17 GDPR Article 21(1) and 22(1) of the Spanish Law on Information Society Services (LSSI)
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	24.08.2020
Fine:	n/a
Parties:	CATMEDIA GLOBAL, S.L.
National Case Number/Name:	PS/00101/2020
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD decision (in ES)
Initial Contributor:	Miguel Garrido de Vega

24 July 2020 - The Spanish Data Protection Agency (AEPD) decided to impose a warning on Catmedia Global, S.L. for the infringement of its duties as per Article 21(1) and 22(1) of the Spanish Law on Information Society Services (LSSI) —this is the Spanish law regulating electronic communications for marketing purposes, connected to Article 6, 7 and 17 of the GDPR.

English Summary

Facts

The decision is the consequence of a complaint submitted by a Spanish citizen stating that he/she had been receiving unsolicited marketing emails from the defendant, and that he/she had tried to unsubscribe from such service by using the link on the emails, but without any results.

Dispute

The defendant did not answer to any AEPD investigation requests, so the AEPD started the corresponding sanction procedure.

Holding

Thus, the AEPD understood that the defendant has infringed its marketing communication duties as per Article 21(1) and 22(1) LSSI, according to which, (i) electronic marketing communications cannot be sent to anyone unless there is express consent of the recipient or a contract relationship with him/her and the marketing communications are similar to the products/services offered in the contract, and (ii) there is an obligation for the digital services provider to offer a simple and free process to unsubscribe from such communications. Consequently, after considering some mitigating circumstances [(i) the absence of damages to the claimant, and (ii) the absence of advantages obtained by the defendant with such conduct], the AEPD decided to impose a warning to the defendant. Additionally, the AEPD requires the defendant to correct the situation in the period of one (1) month since this resolution.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

 Procedure No.: PS / 00101/2020938-300320RESOLUTION OF PENALTY PROCEDUREOf the procedure instructed by the Spanish Agency for Data Protection andbased on the following:BACKGROUNDFIRST: D. AAA (hereinafter, the claimant) dated October 1, 2019filed a claim with the Spanish Agency for Data Protection. Theclaim is directed against CATMEDIA GLOBAL, SL with NIF B55053482 (inhereinafter, the claimed), by sending newsletters and emails notspoiled. The claimant shows that for some time he has receiveddaily emails from the address *** EMAIL.1 in your accountemail: *** EMAIL.2 , you have tried to unsubscribe from the link that appearsin the email that directs you to the website: *** URL.1 but without the unsubscribeeffect.A copy of the messages received is attached to the claim.SECOND: In view of the facts set forth in the claim and the documentscontributed by the claimant, the General Sub-Directorate for Data Inspection proceededto carry out actions for its clarification, under the powers ofinvestigation granted to the control authorities in article 57.1 of the Regulation(EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD).Thus, on March 11, 2020, a letter is addressed to the claimant admitting hisclaim pending.It is recorded that on November 6 and 18, 2019, the complaint was forwarded to theclaimed in the proceedings with reference E / 10620/2019, through theelectronic and mail notifications. Both notifications being returned. Thefirst of them, because the delivery period has expired and the second becauseunknown.THIRD: On June 4, 2020, having not received any type ofinformation to the request made in the framework of the previous actions ofinvestigation by the defendant, the Director of the Spanish Agency forData Protection agreed to initiate sanction proceedings against CATMEDIAGLOBAL, SL with NIF B55053482, in accordance with the provisions of articles 63 and 64of Law 39/2015, of October 1, of the Common Administrative Procedure of thePublic Administrations (hereinafter, LPACAP), for the alleged violation ofarticle 21.1 of the LSSI, typified as mild in article 38.4.d) of said norm.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 2
2/5FOURTH: The Support service of the Electronic Notifications Service andEnabled Electronic Address certifies the date of making the shipment available on 4June 2020 and the date of automatic rejection on the 15th of the same month and year.FIFTH: Formally notified the initiation agreement, the one claimed at the time of theThis resolution has not submitted a brief of allegations, so it isapplication of the provisions of article 64 of Law 39/2015, of October 1,Common Administrative Procedure of Public Administrations, which in itssection f) establishes that in case of not making claims within the foreseen periodon the content of the initiation agreement, it may be considered a proposal ofresolution when it contains a precise pronouncement about liabilityimputed, so a Resolution is issued.In view of everything that has been done by the Spanish Protection AgencyData in this procedure are considered the following:PROVEN FACTSFIRST: The claimant submitted a claim brief on October 1, 2015 inthe AEPD stating that after receiving bulletins and emails without consent,of the claimed from the address *** EMAIL.1 in your email account:*** EMAIL.2 , you have tried to unsubscribe from the link that appears in the email itselfthat directs you to the website: *** URL.1 but without the cancellation taking effect.SECOND: The claimant has provided a copy of the messages received.THIRD: The respondent has not responded to the information request madeby the AEPD, nor has it submitted a brief alleging the initiation agreement.FUNDAMENTALS OF LAWIIn accordance with the provisions of art. 43.1, second paragraph, of the Law34/2002, of July 11, on Services of the Information Society and CommerceElectronic (LSSI), is competent to initiate and resolve this ProcedureSanctioner, the Director of the Spanish Agency for Data Protection.IIIn the present case, the claimant denounces that he has received emails notspoiled, who has tried to unsubscribe from the link that appears on themail, but without it having effect.IIIC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 3
3/5The exposed facts suppose the commission, on the part of the demanded entity, of aviolation of article 21.1 of the LSSI, which provides the following: “1. Thesending advertising or promotional communications by email or otherequivalent electronic means of communication that previously would not have beenrequested or expressly authorized by the recipients of the same. 2. Whatprovided in the previous section will not apply when there is a relationshipprior contractual, provided that the provider had lawfully obtained the dataof the recipient and use them to send communicationscommercials referring to products or services of your own company that aresimilar to those that were initially contracted with the client.In any case, the provider must offer the recipient the possibility of objecting to thetreatment of your data for promotional purposes through a simple procedureand free, both at the time of data collection and in each of thecommercial communications addressed to you.When the communications have been sent by email, saidmeans must necessarily consist of the inclusion of an email addressemail or other valid email address where this right can be exercised,the sending of communications that do not include said address is prohibited. ”Furthermore, article 22.1 of the LSSI establishes that: “1. The recipient mayrevoke at any time the consent given to the receipt ofcommercial communications with the simple notification of its will to the sender. TOTo this end, service providers must enable simple procedures andfree so that the recipients can revoke the consent that they hadborrow. When the communications have been sent by email,This means must necessarily consist of the inclusion of an address ofemail or other valid email address where this can be exercisedright, being prohibited the sending of communications that do not include saiddirection. They must also provide information accessible by electronic means.about these procedures ”.IVThe aforementioned offense is classified as mild in art. 38.4.d) of saidstandard, which qualifies as such, “The sending of commercial communications by mailelectronic or other equivalent electronic means of communication when in saidshipments do not meet the requirements established in article 21 and do not constituteSerious offense".Meanwhile, in art. 39 bis of the LSSI, allows to moderate the sanctions applying thescale relative to the one immediately preceding in gravity to the one in whichintegrates the one considered in the case in question, in the cases listed in saidprecept and art. 40 of said norm, allows to graduate the amount of the sanctionattending to the criteria listed in said precept.In accordance with the foregoing, a decrease in the guilt of thedenounced taking into account that the circumstances concur significantlyC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 4
4/5there is no harm to the recipient in the messages and lack of proof ofbenefits obtained by the claimed, in the commission of the offense.VOf the foregoing and in accordance with the provisions of article 39 bis, 2 of theLSSI, the entity claimed is required to take appropriate measuresto prevent the sending of communications from being violated againcommercials that had not been expressly requested or without giving anycourse that allows art. 21 of the LSSI.The respondent is warned that the measures indicated in the previous paragraphThey must be adopted by the entity and communicated to the AEPD, otherwisecould incur a very serious infraction typified in article 72.1.m) of the LawOrganic 3/2018, of December 5, Protection of Personal Data and Guarantee ofDigital Rights (LOPDGDD), in relation to article 58.2 of the RGPD.Therefore, in accordance with the applicable legislation and the criteria ofgraduation of sanctions whose existence has been proven, the Director of theSpanish Data Protection Agency RESOLVES:FIRST: IMPOSE CATMEDIA GLOBAL, SL, with NIF B55053482, for aviolation of Article 21.1 of the LSSI, typified in Article 38.4.d) of the LSSI, awarning penalty.SECOND: REQUIRE CATMEDIA GLOBAL, SL, with NIF B55053482, fromin accordance with the provisions of article 39 bis 2 of the LSSI so that withinONE MONTH from the notification of this resolution:2.1. COMPLIES with the provisions of article 21.1 of the LSSI, for whichthe entity denounced to implement necessary measures to preventthe offense committed occurs again.2.2. REPORT to the Spanish Agency for Data Protection of complianceof what is required, providing the documents or other means of proof in thethat its compliance is revealed.THIRD: NOTIFY this resolution to CATMEDIA GLOBAL, SLC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 5
5/5In accordance with the provisions of article 50 of the LOPDGDD, theThis Resolution will be made public once the interested parties have been notified.Against this resolution, which ends the administrative procedure pursuant to art.48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the Law39/2015, of the LPACAP, the interested parties may file, optionally, an appealof replacement before the Director of the Spanish Agency for Data Protection in theone month from the day after notification of this resolution, ordirectly administrative contentious appeal before the Contentious Chamber-administrative of the National Court, in accordance with the provisions of article 25 andin section 5 of the fourth additional provision of Law 29/1998, of July 13,regulatory of the Contentious-Administrative Jurisdiction, within a period of two months tocount from the day after notification of this act, as provided in theArticle 46.1 of the aforementioned legal text.
Mar España Martí
Director of the Spanish Agency for Data Protection