AEPD (Spain) - PS/00341/2019

AEPD - PS/00341/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 21 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	n/a
Published:	19. 2.2020
Fine:	None
Parties:	Anoymous Vs. The Socialist Party of Catalonia (PSC-PSOE)
National Case Number/Name:	PS/00341/2019
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in es)
Initial Contributor:	n/a

The AEPD found that the Socialist Party of Catalonia (PSC-PSOE) violated Article 21 GDPR due to unsolicited political propaganda sent after the data subject exercised his right to object.

English Summary

Facts

A citizen sent a letter to the Spanish Statistical Institute in order to object to the processing of his personal data for political propaganda purposes. His request has been forwarded to the political parties. However, few months after his deletion request, he received in his mail box two voting envelops containing political propaganda belonging to the Socialist Political Party related to the municipal election. Therefore, the citizen filed a complaint with the AEPD against the Socialist Party of Catalonia.

Following the complaint, the AEPD agreed to carried out investigations against the Socialist Party, which was the data controller. After having received the explanation of the Spanish Statistical Institute, the authority initiated proceedings for the alleged infringement of Article 5(1)(d) GDPR against the political party aforementioned.

The Political party acknowledged the facts claimed by the complainant and notified to the AEPD it will take responsibility for its actions.

Dispute

The issue was whether the sending of political propaganda was lawful.

Holding

The AEPD ruled that the complainant exercised his right to object and that the Socialist Party ignored it without having demonstrated any other compelling legitimate grounds for the processing which override the data subjects’ rights and interests. The APED ruled that the right to object was expressly recognised under Article 21 GDPR and under the Spanish data protection act. The authority pointed out that the Socialist Political Party received the appropriate orders so that no political propaganda should have to be sent. Then, the AEDP focused on the data controller’s duty of diligence, especially when carrying out advertisement operations. It has been concluded the violation of the right to object and notified the sanction to the interested parties.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the **Spanish** original. Please refer to the **Spanish** original for more details.

Procedure Nº: PS/00341/2019938-051119Sanctioning procedure resolution of the procedure instructed by the Spanish Data Protection Agency and based on the following
FACTS
FIRST: Mr. A.A.A. (*hereinafter, the claimant) on 27 May 2019 filed a complaint with the Spanish Data Protection Agency.   The complaint is directed against the political party Partido Socialista de Cataluña (PSC-PSOE) with CIF G08564379 (hereinafter, the claimant). The reasons on which the claim is based are "I attach a document certifying the exclusion of data in copies of the electoral census for delivery to political parties (date 06/03/2019).On 17/05/2019 an envelope with a miniature name and address, with the letterhead of the PSC party, appeared in my letterbox and inside there were two voting envelopes corresponding to the municipal elections of 2019, two ballots corresponding to the candidacy of the PSC party of the town of Vandellòs and l'Hospitalet del'Infant and a bulletin called "La Veu" published by the municipal socialist group co-responding to the month of May.I don't know which base they have used to obtain my data and send me electoral propaganda; if it is not the one of the electoral census, maybe there has been some kind of violation of the regulations" (page nº 1). (doc. 3 and 4).

SECOND: In view of the facts denounced in the complaint and the documents provided by the claimant, the General Sub-directorate of Data Inspection agreed to carry out preliminary investigative actions to clarify the facts in question, by virtue of the investigative powers granted to the control authorities in article 57.1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter referred to as the GDPR), and in accordance with the provisions of Title VII, Chapter I, Section 2, of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter referred to as the LOPDGDD), it has been ascertained that the data controller is the party complained of as a result of the investigative actions carried out.

THIRD: On 29/05/19 the claim was transferred to the National Statistical Institute (INE) so that it could make the appropriate explanations, in view of the exercise of the right of opposition mentioned.

FOURTH: On 18/06/19, this Agency received a letter from the National Statistics Institute (INE) stating the following: "From what has been stated, it can be concluded that, since Mr. A.A.A.'s request was presented on 6 March 2019, it would be excluded from the copies of the electoral census given to the representatives of the candidates to send them electoral propaganda.In this sense, in the specific case of the Partit dels Socialistes de Catalunya (PSCPSOE), the OCE informs that on 2 April 2019 the mandatory copy of the Electoral Census had been delivered to its representative, Mr. B.B.B, for the purposes provided for in the LOREG (doc.1). Together with said copy, a note is provided which contains, among other information, an express warning regarding those voters who have expressed their opposition to their inclusion in the copies of the Electoral Census, which are provided to the representatives of the candidates to send out electoral propaganda by post".

FIFTH: On 24 October 2019, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the respondent, for the alleged infringement of Article 5.1.d) of the RGPD, typified in Article 83.5 of the RGPD.

SIXTH: On October 28, 19, written allegations were received from the entity denounced, stating the following: "Since there are no new facts or changes in the legal classification of the persons concerned, all the points made by this party during the investigation phase and contained in the file are maintained. Therefore, it acknowledges the facts described and assumes responsibility for them.  Therefore, it accepts this notification as a proposal for resolution as long as at the end of the procedure the sanction is maintained in the APPENDIX as it is considered adequate, fair and proportional. That the organization is carrying out a series of measures aimed at adapting the actions and procedures of the same and in relation to the facts of reference to the prescriptions of the regulation in the field of data protection (review of protocols, training of employees and affiliates, etc...) in order to achieve the highest standards of compliance and avoid situations like this to happen again. In view of the above, the Data Protection Agency considers the statements contained in this document to be accurate, as the Partit dels Socialistes de Catalunya (PSC-PSOE) has taken on board the description of the facts and their legal classification, which is reiterated and maintained in all of the above for its part in the investigation phase and which accepts the possible sanction of a warning such as the one provided for in the proposal for a resolution, reserving the possibility of appealing against it if, during the investigation phase, the facts are changed or new ones appear, the legal classification of the facts is modified or another sanction is proposed that is more severe than the warning"
In view of the above, the following are considered to be proven facts by the Spanish Data Protection Agency in these proceedings,
PROVEN FACTS
First. On 27/05/19 this Agency received a complaint through which the complainant submitted the following "facts":"An envelope with my name and address, on PSC party letterhead, appeared in my letterbox and inside it were two voting envelopes corresponding to the 2019 municipal elections, two ballot papers belonging to the PSC party in the town of Vandellòs and l'Hospitalet de l'Infant and a ballot paper called "La Veu" published by the municipal socialist group for the month of May" (page 1).
Second. The Socialist Party of Catalonia (PSC-PSOE) has been identified as the main party responsible for the political formation with CIF G08564379.
Third. It is proved that the complainant exercised his right of opposition to the reception of electoral propaganda, with date of presentation 06/03/2019 22:51:10(Peninsular time)-Doc. nº 1--.
Fourth. It is proved the reception of electoral propaganda in the domicile of the complainant, being this aspect proved by the accused (doc. 2-3), since the representatives of the formation used a previous electoral list;
Fifth. The denounced entity PSC (PSOE) acknowledges the "error" in the following terms: "the error, they claimed in their defence that, that procedure was the result, in first instance of the good faith, of the ignorance and the lack of attention to the training in data protection ma-teria offered by the organization (...)".
Sixth. The organisation denounced in writing on 05/07/19, adopted the following measure: "To point out that the organisation is currently immersed in a process of implementation of "Criminal Compliance", an important part of which is related to data protection, so that everything referring to this matter is being specifically dealt with so that the organisation as a whole, as well as each and every one of its members, professionals and affiliates, acquire a high degree of awareness, training and knowledge".
LEGAL FOUNDATIONS 
I
By virtue of the powers that article 58.2 of the RGPD recognises to each control authority, and in accordance with the provisions of articles 47 and 48 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and resolve this procedure

II
In the present case, the complaint dated 27/05/19 is examined for me-dio from which the Complainant transfers the following 'facts':
"An envelope with my name and address, on PSC letterhead, appeared in my letterbox and inside it were two voting envelopes for the 2019 municipal elections, two ballot papers belonging to the PSC party of the town of Vandellòs and l'Hospitalet de l'Infant and a ballot paper called "La Veu" published by the municipal socialist group for the month of May" (page 1).Therefore, the facts are specified in the reception of electoral propaganda despite having exercised the right of opposition to receive any kind of electoral mailing.
In support of his claim, he provides a document proving the exercise of the right before the INE (Doc. nº 1) with presentation date 06/03/201922:51:10 (Peninsular time).
Likewise, it accredits the reception of electoral propaganda, with the sending of the so-bre the formation object of complaint to the management of the same (Doc. nº 2-3).
The legal tool that allows the citizens to request the right of exclusion that we are dealing with is the recent Organic Law 3/2018, of 5 December, on Protection of Personal Data and guarantee of the digital rights (hereinafter LOPDPGDD), which introduced in its third final disposition two modifications to the Organic Law 5/1985, of 19 June, of the General Electoral System (hereinafter LOREG).Paragraph 5 of this article 58 bis guarantees that "the addressee will be provided with a simple and free method of exercising the right of opposition to this sending of electoral pro-pamanda".
The article 39.3 LOREG (LO 5/1985, of 19 June, of the General Electoral Regime) states the following:
"Within the previous period, any person may make a complaint to the Provincial Delegation of the Electoral Census Office regarding their registration data, although only those referring to the rectification of errors in personal data, to changes of address within the same district or to the non-inclusion of the complainant in any section of the district census, despite having the right to do so, may be taken into account. Requests from voters who oppose their inclusion in the copies of the electoral census provided to the representatives of the candidates for sending pro-election mailings shall also be dealt with. Those that reflect a change of residence from one district to another, made after the closing date of the census for each election, shall not be taken into account for the election called, and they must exercise their right in the section corresponding to their previous address".
The RGPD (as well as the LOPDGDD) expressly recognises the right of the data subject to object - at any time - for reasons related to his/her particular situation, to personal data concerning him/her being processed on the basis of the provisions of Article 6, paragraph 1, letters e) or f) of the RGPD, including the drawing up of profiles on the basis of said provisions.
The right to object and the rights related to automated individual decisions, including profiling, shall be exercised in accordance with Articles 21 and 22 of Regulation (EU) 2016/679 respectively.
Article 21 GPSD REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 provides 
"The data subject shall have the right to object at any time, on grounds relating to his particular situation, to the processing of personal data relating to him on the basis of Article 6(1)(e) or (f), including profiling on the basis of those provisions. The right of objection allows the data subject, in the cases provided for in the RGPD, to object to the processing of his/her personal data. And the data controller will have to stop processing them. Thus, in accordance with Article 21 of the Regulation, the data controller will be obliged to stop processing the personal data of the data subject, unless he or she has compelling legitimate reasons for the processing that take precedence over the data subject's interests, rights and freedoms, or for the formulation, exercise or defence of claims.Notwithstanding the foregoing, in the specific case of the exercise of the right to oppose the processing of data for the sending of election propaganda, such right shall be exercised in accordance with the provisions of the regulations governing electoral processes and shall have the effects provided for therein. The data controller shall cease to process the personal data, unless he can demonstrate compelling legitimate reasons for the processing that prevail over the interests, rights and freedoms of the data subject, or for the formulation, exercise or defence of claims.
The Agreement 2/2019, of 23 January 2019, of the Central Electoral Board establishes the following on this opposition
<1º) With the purpose of facilitating the processing of requests from voters who oppose their inclusion in the copies of the electoral census that the Electoral Census Office must deliver to the representatives of the candidates to send out electoral propaganda, said requests may be made prior to the calling of an electoral process, in Municipal Councils, Consulates and Provincial Delegations of the Electoral Census. Likewise, they may be made at the electronic headquarters of the National Statistics Institute, once the Electoral Census Office has enabled said procedure.2) The referred requests for exclusion shall be permanent until the elector manifests the contrary.3) The Electoral Census Office shall inform voters of the exclusion requested.4) This exclusion should be compatible with the representatives of the ministries having the complete list of voters for the purposes of voting and counting, with the data essential for identifying the voter.>>
2) The referred requests for exclusion shall be permanent until the elector manifests the contrary.
3) The Electoral Census Office shall inform voters of the exclusion requested.
4) This exclusion should be compatible with the representatives of the ministries having the complete list of voters for the purposes of voting and counting, with the data essential for identifying the voter.>>

The call for the General Elections of 28 April 2019 was made on 5 March, so the deadline for the submission of claims was set from 11 to 18 March 2019.
In the present case, the claimant exercised their right to oppose in due time and form before the Electoral Census Office Register, with the date of official presentation being 06/03/2019 22:51:10 (Peninsular time).
The entity denounced - PSOE - states that the appropriate orders were given so that no electoral propaganda was sent, in cases of lack of a home address, specifically in the following terms: "As you will see, some voters do not have an address since they took advantage of the right given to them by law not to receive electoral propaganda. UNDER NO CIRCUMSTANCES CAN THEY RECEIVE ANY COMMUNICATION FROM THE PARTY. 
I do not know if it has been sufficiently clear "In spite of this, the infraction has been stated, when receiving the denounced electoral propa-ganda (electoral mailing) from the political formation at their home, carrying out a "treatment" of their data out of the cases allowed by the regulations in force
 IV
The Supreme Court (judgements of 16 and 22 April 1991) considers that it follows from the element of guilt "that the action or omission, described as an administratively punishable offence, must in any event be attributable to the author, through wilful misconduct, negligence or inexcusable ignorance."The National Court, in its Sentence of 29 June 2001, in the matter of protection of personal data, has declared that "simple negligence or failure to comply with the duties that the Law imposes on the persons responsible for files or the processing of data to be extremely diligent is sufficient

The Supreme Court (Judgments of 5 July 1998 and 2 March 1999) has understood that there is imprudence whenever a legal duty of care is disregarded, that is, when the offending party does not behave with the required diligence. The degree of negligence will be determined by the circumstances of each case, such as the special value of the protected legal asset or the professional competence required of the offender.
 In this sense, the above-mentioned Judgment of 5 June 1998 requires professionals in the sector to have "a duty to be particularly aware of the applicable rules".

Applying the above doctrine, the National Court requires entities operating in the data market to exercise special diligence when using or processing such data or transferring them to third parties. And this is because the protection of data is a fundamental right (Sentence of the Constitutional Court 292/2000), the holders of these data must be especially diligent and careful when operating with them and must always opt for the interpretation most favourable to the protection of the legal assets protected by the law. 

In this sense, among others, the Audiencia Nacional's rulings of February 14 and September 20, 2002 and April 13 and May 18, 2005). The guilt as reproach of the active subject of the injury of the legally protected property is evident when the subject voluntarily carries out the typical conduct intentionally aimed at obtaining the anti-legal result, which is sought and desired. And there is no negligence, nor is there a guilty and punishable infraction, "when the necessary diligence has been put into the fulfillment of the obligations required in the matter of LOPDGDD".
V
In accordance with the allegations and evidence provided in these proceedings, it is considered that the complainant has not complied with the right to oppose in due time and form, which was exercised by the complainant, who received electoral propaganda, despite having expressly opposed it.
The known facts constitute an infringement, attributable to the complainant, for violation of Article 21 RGPD, by not effectively attending to the exercise of the mentioned right. On the other hand, the LOPDGDD, in its Article 72.1.k), qualifies as a very serious infringement, for the purposes of prescription, "The impediment or obstruction or the repeated lack of attention to the exercise of the rights established in Articles 15 to 22 of Regulation (EU) 2016/679."The documentation in the file shows that the defendant violated Article 21 of the RGPD, since despite the fact that the claimant exercised his right to oppose, in time and form, so that he would not be sent postal election advertising, he received it at his home. A copy of the envelope sent by the PSC-PSOE to his postal address, and of the electoral propaganda received, is included in the file. On the other hand, the person claimed lacked legitimacy for the processing of the claimant's personal data for the sending of electoral propaganda, having opposed the re-reception of said propaganda in the Electoral Office of the INE. 
Article 83.5 of the RGPD states: 'Infringements of the following provisions shall be punishable, in accordance with paragraph 2, by administrative fines of up to EUR 20 000 000 or, in the case of a company, of an amount equivalent to no more than 4 % of the total annual turnover for the preceding financial year, whichever is greater: (b) the rights of data subjects under Articles 12 to 22 (...)
VI
In determining the appropriate administrative sanction to be imposed, we should read certain recitals of the RGPD, among others, recital 148, which indicates the following: 'In order to strengthen the enforcement of the rules of this Regulation, any infringement thereof should be subject to sanctions, including administrative fines, in addition to or instead of appropriate measures imposed by the control authority under this Regulation. In the case of a minor infringement, or if the fine likely to be imposed would constitute a disproportionate burden on a natural person, a warning may be imposed instead of a penalty in the form of a fine. 
However, particular attention should be paid to the nature, seriousness and duration of the infringement, its intentional nature, the measures taken to mitigate the damage suffered, the degree of liability or any previous relevant infringement, the manner in which the supervisory authority became aware of the infringement, compliance with measures ordered against the person responsible or entrusted, adherence to codes of conduct and any other aggravating or mitigating circumstances. The imposition of sanctions, including administrative fines, must be subject to sufficient procedural guarantees in accordance with the general principles of the Law of the Union and the Charter, including the right to effective judicial protection and to a process with all guarantees.>> In the case of complaint we must take into consideration that, until very recently, political parties were entitled to send election propaganda to all voters during the election campaign. There was no rule to oppose to such sending.
This authorization has been limited by the modification of the LOREG included in the LO-PDGDD. Therefore, the political parties have had a very short period of time to adapt to this limitation and there have been few claims for it.
Therefore, in accordance with the applicable legislation and having assessed the criteria for the downgrading of the sanctions whose existence has been accredited, the Director of the Spanish Data Protection Agency 
RESOLVE:
FIRST: TO IMPOSE ON PARTIT DELS SOCIALISTES DE CATALUNYA (PSC-PSOE), for an infringement of the content of art. 21 RGPD, having sent electoral propaganda to the denounced party in spite of its opposition in legal form, a sanction of AWARENESS, an infraction typified in art.83.5 b) RGPD, being punishable according to art. 58.2 RGPD.
SECOND: TO NOTIFY the present resolution to PARTIT DELS SOCIALISTES DECATALUNYA (PSC-PSOE) and TO INFORM the result of the actions to the denouncer Don A.A.A.In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties..6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPA-CAP, the interested parties may, optionally, file an appeal for reversal before the Director of the Spanish Data Protection Agency within a period of one month from the day following notification of this resolution or directly file an administrative appeal with the Administrative Chamber of the National Authority, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of 13 July, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following notification of this act, in accordance with the provisions of Article 46.1 of the aforementioned Law.Mar Spain MartíDirector of the Spanish Data Protection Agency