AEPD (Spain) - EXP202316737
From GDPRhub
| AEPD - EXP202316737 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Ley 34/2002 |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 24.10.2023 |
| Decided: | 09.09.2024 |
| Published: | |
| Fine: | 20,000 EUR |
| Parties: | The Nude Project |
| National Case Number/Name: | EXP202316737 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | Ao |
The DPA fined a clothing retailer €20,000 for failing to demonstrate that the data subject had consented to commercial advertisements when providing their e-mail address in order to receive a digital receipt for a purchase.
Facts
On the 24 October 2023, the data subject filed a complaint with the Spanish DPA (AEPD) against the controller, a clothing retailer called “Nude project”. The data subject alleged that the controller had infringed Law 34/2002 which is the Spanish national implementation of the EU e-privacy Directive.
On the 23 September 2023, the data subject was in one of the controller’s shops and upon requesting the receipt for a purchased item, was told that they can only be provided digitally. They had the option of either providing an e-mail address or a telephone number and were then handed a tablet to enter their e-mail address. The data subject details that the tablet did not show any option to object to receiving advertising.
Before filing the complaint, the data subject had received three advertisement e-mails from the controller. The e-mails included a passage which offered the option of unsubscribing from the advertising e-mails.
The controller argued that cashiers inform customers that receipts are preferably delivered digitally but that it is possible to get a physical receipt. It further claimed that the tablet does display an option to object to receiving advertising and provided three screenshots as proof. The first screenshot was of the tablet screen showing a box agreeing to advertisement which could be unticked, the second screeshot showed the data subject's account which showed a ticked box to receive advertisements via e-mail and the third showed a confirmation of the data subject having unsubscribed from the e-mail advertisements.
Holding
The AEPD stated, that in order to show that consent was obtained according to the requirements of the GDPR, the controller must keep a record of the actions carried out to obtain consent of the data subject.
The AEPD highlights that the controller did not for example provide a log demonstrating that the data subject gave consent or a screenshot of the signature of the data subject together with the user ID. Therefore, the controller had submitted no evidence which showed that the data subject had given consent to commercial advertisements as per the requirements of Article 7 GDPR.
The AEPD further stated that the controller's intent constituted an aggravating factor. By leaving customer's with no other option but to receive advertising communications via e-mail or text message in order to be provided with a receipt, the controller intentionally breached the provisions of Law 34/2002.
The AEPD sanctioned the controller for a violation of Article 21 of Law 34/2002, classified as minor under Article 38(4)(d) of Law 34/2002, with a fine of €20,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/16 Procedure No.: EXP202316737 (PS/00110/2024) SANCTIONING PROCEDURE RESOLUTION From the actions carried out by the Spanish Data Protection Agency and based on the following: BACKGROUND FIRST: On 10/24/23, D. A.A.A. (the complaining party), filed a complaint with the Spanish Data Protection Agency. The complaint is directed against the entity NUDE PROJECT, S.L. with CIF.: B01945328, (the respondent party), for the alleged violation of Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI). The complainant states that on 23/09/23 he went to a store of the defendant entity to make a purchase and that, when he requested the corresponding purchase receipt, he was told that it was not possible to deliver it physically, and that he had to provide his email address or telephone number, being forced to provide said data to receive the corresponding purchase receipt. He also states that, when he provided said data on a Tablet in the establishment, at no time did any message or form appear where he could object to receiving advertising. Despite this, he has received up to three advertising emails from the defendant entity in his email, all without having authorized it. The following documentation is attached to the complaint: - Dated 23/09/23, 28/09/23 and 01/10/23, a copy of the emails sent from the NUDE PROJECT address <help@nude—project.com> received by the complainant, containing advertising messages and photographs, such as, for example: o NUDE PROJECT© Thank you for your purchase! Visit Our store. Order summary … o NUDE PROJECT© NEW IN T-SHIRTS HOODIES BOTTOMS o By Artists, For Artists… o So, let's play who's who... you choose. Also, we have some last units of new Playboy garments. Have a look. JACK HAB LOW… or PLAYBOY CARDIGAN PLAYMATE SHIRT PLAYBOY CHINO PANTS SHOP THE LOOK DRAKE… or CHESS KNITTED POLO POOL DENIM PANTS CHAMPAGNE PROBLEMS HAT NAVY SHOP THE LOOK RIHAN NA… or WOMEN RACING JACKET BIG HEART WHITE BABY BUNNY BOWLING BAG WHITE/NAVY SHOP THE LOOK LIL NAS sedeagpd.gob.es 2/16 In each of the emails received, there is the following message, in English: Do you no longer want to receive these emails? Unsubscribe. NUDE PROJECT CIPujadas. 81 Barcelona. Barcelona 08005) SECOND: On 11/22/23, in accordance with the provisions of article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights, (LOPDGDD), this Agency transferred said claim to the respondent party so that it could proceed to analyze it and report, within a period of one month, on what was set forth in the claim letter. The transfer was carried out in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (LPACAP), by electronic notification, with access to the content of the notification taking place on 12/01/23 as recorded in the file. No response has been received to this transfer letter. THIRD: On 01/24/24, in accordance with article 65 of the LOPDGDD, the claim submitted by the claimant was admitted for processing. FOURTH: On 03/12/24, the Director of the Spanish Data Protection Agency agreed to initiate disciplinary proceedings against the entity NUDE PROJECT, S.L., in accordance with the provisions of articles 63 and 64 of the LPACAP, for the alleged infringement of article 21 of the LSSI, classified as "minor" in art. 38.4.d) of the same regulation. In the opening agreement it was determined that the sanction that could be imposed, taking into account the evidence existing at the time of the opening, would amount to a total of 20,000 euros (twenty thousand euros). FIFTH: Having been notified of the aforementioned initiation agreement in accordance with the rules established in the LPACAP, the respondent party submitted a written statement of allegations on 03/27/24, in which it states the following: “First.- First of all, we must indicate that the statement of facts does not reflect the reality of what happened. This party has received advice on privacy, personal data protection and electronic commerce, so it is aware of the obligation provided for in the aforementioned article to obtain the express consent, or that it had been requested by the recipient of the same, to allow the sending of advertising communications by email or equivalent means. The company that I represent has been able to verify that the complainant effectively made a purchase at the company's store located in La Roca Village on September 23, 2023 at 5:00 p.m. However, this entity must indicate that the consent of its clients was obtained in order to send them commercial communications, and furthermore, there are a series of measures implemented by default to avoid sending communications to those clients who have not requested it or whose consent has not been expressly obtained. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 3/16 At the time of payment, the cashier informs you that, in accordance with the commitment to eliminate paper, the ticket is preferably delivered electronically by email. However, it is not true that the option of delivering the physical ticket was not given, nor that a message or form to oppose the receipt of advertising did not appear on the establishment's Tablet. Attached as DOCUMENT Nº 2 is a screenshot of the Tablet screen in which you can see in the “customer options” section a first tab called “accept advertising”, which as you can see is unchecked by default. At that moment all customers are expressly asked if they wish to accept the sending of advertising before opening said tab, which occurred in this case. That is, the complainant expressly accepted the sending of advertising, since he was interested in receiving information about other products of the brand that would be subsequently marketed. Attached as DOCUMENT Nº 3 is a screenshot of the final purchase in which you can see the customer's subscription to said advertising by email to be sent to the address ***EMAIL.1 If you look at the screenshot of Document Nº 2 you can draw different conclusions: Firstly, we can see how the box for commercial communications by email has been checked because the user accepted that option during the purchase. Likewise, it can be observed that consent was not given to receive communications via SMS, which can be classified as another means of electronic communication equivalent to emails, according to article 21 of the LSSI. In this regard, and following the instructions of the client, all commercial communications were sent via email, for which the client's consent was obtained. Additionally, it can be observed that it was indicated that the notifications would be received in English. Nude Project, S.L. never sends advertising to people who have not given their express consent to such delivery by subscribing. Once D. A.A.A. had subscribed, it is true that Nude Project, S.L. sent the emails detailed in the agreement to initiate the sanctioning procedure. However, we must point out that the client was fully aware that he could cancel the subscription since this is stated in each email that is sent. In fact, the complainant canceled the subscription on December 20, 2023 at 8:57 a.m., simply by clicking on the link he received in the emails under the word "unsubscribe". The proof of said deletion is provided as DOCUMENT NO. 4. It is therefore surprising that if he did not wish to receive emails, he could have easily C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 4/16 cancelled the subscription upon receiving the first one on the same day of purchase, September 23, or the second one a few days later (September 28). We would like to emphasise that from the moment you unsubscribed, Nude Project, S.L. has not sent any other commercial communications. In short, we consider that Nude Project, S.L. has acted correctly, complying with the mandates of its client, both in sending commercial communications and in unsubscribing; and all of this in strict compliance with the provisions of current legislation. Second.- In any case and in a subsidiary manner, we understand that the actions of Nude Project, S.L. will be covered by the second section of article 21 of Law 34/2002 on Information Society Services and Electronic Commerce. This law establishes that: 1. The sending of advertising or promotional communications by email or other equivalent means of electronic communication that have not previously been requested or expressly authorised by the recipients of the same is prohibited. 2. The provisions of the previous section shall not apply when there is a prior contractual relationship, provided that the provider has lawfully obtained the recipient's contact details and used them to send commercial communications regarding products or services of its own company that are similar to those that were initially contracted. In any case, the provider must offer the recipient the possibility of opposing the processing of their data for promotional purposes through a simple and free procedure, both at the time of data collection and in each of the commercial communications sent to them. When the communications have been sent by email, this means must necessarily consist of the inclusion of an email address or other valid electronic address where this right can be exercised, and the sending of communications that do not include this address is prohibited. We have underlined the second section of said article since it establishes that the first section is not applicable (prohibition of sending advertising communications), when the following requirements are met: - There is a prior contractual relationship. - The provider had lawfully obtained the client's contact details. - The provider used said data to send commercial communications regarding products or services of its own company similar to those that were the subject of the contract. The action of Nude Project, S.L. is covered by the second section of the aforementioned article because: 1) The complainant D. A.A.A. contracted with Nude Project, S.L. the acquisition of a product (varsity sweatshirt) on September 23, 2023. 2) Nude Project, S.L. lawfully obtained the client's data as the client was the one who voluntarily provided it, ordering the sending of the purchase ticket by email. 3) Nude Project, S.L. sent commercial communications to its client, now the complainant, via C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 5/16 emails in which information was provided about products similar to the one purchased by Mr. A.A.A.. 4) Nude Project, S.L. gave the client the opportunity to unsubscribe in each email it sent, simply by clicking on a link. 5) Nude Project, S.L. did not send a single email to the complainant after he expressed his desire not to receive any more commercial communications. Third.- The sending of the purchase receipt by email is protected by Royal Decree 1619/2012 of 30 November, which approves the Regulations governing billing obligations. Specifically, article 8 specifies that invoices may be issued by any means, on paper or in electronic format, while article 9 supports invoices that are issued and received in electronic format. Fourth.- In terms of sanctions, the Constitutional Court has established as one of the basic pillars for the interpretation of administrative sanctioning law that the basic principles and guarantees present in the field of criminal law are applicable, with certain nuances, in the exercise of any sanctioning power of the Public Administration (for example, in the Constitutional Court's rulings 76/1990, 120/1994, 154/1994, 23/1995, 97/1995, 147/1995, 45/1997 of April 26, among many others). Article 25.1 of the Constitution establishes that no one may be convicted or sanctioned for actions or omissions that at the time of their occurrence did not constitute a crime, misdemeanor or administrative infraction according to the legislation in force at that time. The Constitutional Court has held that the principle of typicality consists of the need for normative predetermination of the offending conduct and the corresponding sanctions (SSTC 61/1990, 116/1993, 151/1997, 124/2000113/2002, 129/2003, 297/2005, 129/2006 etc.). In the same sense, article 27 of Law 40/2015 on the Legal Regime of the Public Sector defines the principle of typicality in the same terms in that only violations of the legal system provided for as such violations by a Law may constitute administrative infractions. In the present case, disciplinary proceedings are initiated and a sanction is proposed against Nude Project, S.L. for having allegedly infringed article 38.4.d) of Law 34/2002 on Information Society Services and Electronic Commerce, which classifies as a minor infraction “the sending of commercial communications by email or other equivalent means of electronic communication, when said sending does not comply with the requirements established in article 21 and does not constitute a serious infraction” Given that, as we have seen, the actions of Nude Project, S.L. is protected by the second section of article 21, the imposition of a sanction would constitute a violation of the principle of typicality that governs all administrative sanctioning procedures. In the rulings of the National Court (5 February 2019 EDJ 2019/543106, 25 March 2016 EDJ 2016/66100, 4 FEBRUARY 2010 EDJ 2010/12007, 23 May 2007 EDJ 2007/76092) of C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 6/16 which we are aware of and which have been handed down in similar cases, sanctions are only upheld in cases where the affected parties received emails after expressly stating their opposition to receiving them. In the present case, the situation is completely different. The complainant not only gave his express authorization to receive commercial communications, but could have replied to the first communication received indicating that he did not wish to receive any more. This could be done in several ways: - Clicking in the indicated place in the email "unsubscribe". - Replying to the email received - Sending a message to customer service. In the "about us" section of the website www.nude-project.com there is a direct form to send any questions or considerations. There is also a direct email to send it, specifically, help@nude-project.com - Indicating it personally in any of the company's physical stores. We are therefore not in the cases regulated in the Sentences in which the sanction imposed by the AEPD has been validated. Fifth.- We also oppose the grading of the sanction that appears in the agreement initiating the sanctioning procedure, which applies the aggravating circumstance of the existence of intent, when in our opinion it is not applicable, and also without taking into consideration the rest of the circumstances provided for in article 40 of Law 34/2002 on Information Society Services and Electronic Commerce. The existence of intent is justified in that commercial communications were sent after obtaining the client's email address in order to send the purchase receipt and there being no possibility of rejecting the sending of commercial communications when the email is provided. The application of this circumstance is absolutely erroneous since as has been proven: 1) The client expressly allowed the sending of commercial communications, modifying at that time the corresponding tab of the application; given that he was expressly interested in receiving commercial communications. 2) Once the purchase receipt was received, the customer was perfectly able to cancel his subscription, just as he was able to do when he received the other two communications. 3) The complainant himself deleted his subscription on December 20, 2023. The National Court's ruling of June 21, 2023 (EDJ 2023/606757) considers the application of this aggravating circumstance of intentionality to be correct in the case where a commercial email is sent after the user expressly expressed his opposition, but not in the case at hand. But what is more, the truth is that none of the other circumstances of article 40 apply to the actions of Nude Project, S.L., specifically: o Period of time during which the infringement is supposedly committed, which according to the complaint itself is only 8 days. o Recidivism: Non-existent in this case since Nude Project, S.L. has not been C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 7/16 sanctioned for an infringement of the same nature. o Nature and amount of the damages caused. No damages have been caused in this case. o Benefits obtained from the infringement: Nude Project, S.L. has not obtained any benefits given that the customer did not purchase any items after his purchase on September 23. o The turnover is non-existent. That is to say, in this case, the sanction imposed should have taken into account all of these circumstances, so a fine of 20,000 euros when the range is between 1 and 30,000 euros seems clearly excessive. This incorrect application represents the violation of another constitutional right, such as the principle of proportionality, which has been established as an instrument of control over discretionary administrative decisions. It is included in articles 103.1 and 106 of the Spanish Constitution and in article 29 of Law 40/2015 on the Legal Regime of the Public Sector. In this last article it is determined that the appropriateness and necessity of the sanction to be imposed and its adaptation to the seriousness of the act constituting the infringement must be observed on the basis of four criteria: a) Degree of guilt or intentionality b) Continuity or persistence of the conduct c) Damages caused d) Recidivism. Given all the above, we understand that the hypothetical sanction should be in any case within the lower quarter of the amount proposed in the Standard. Sixth.- As a continuation of the previous argument, we invoke the application of article 39 ter of Law 24/2002 in the sense that we understand that there is sufficient data so that, even in the case that the infringement could be understood to have been committed, the archiving of the sanctioning procedure is agreed and in its place a warning with the adoption of corrective measures determined by the competent body. In this regard, we indicate that this entity, having obtained the recommendations of our advisors on personal data protection, has decided to carry out the following actions, aimed at avoiding a repeat of an incident such as the one that is the subject of notification: The aforementioned advisors are requested to provide information on the legal considerations regarding consent in electronic communications. The written statement of allegations is accompanied by the following documentation: - DOCUMENT No. 1 – Screenshot showing the option to receive advertising unchecked by default. - DOCUMENT No. 2 – Screenshot of the claimant's account, where it is indicated that electronic communications can be sent because they have given their consent, their contact email, and the option to send communications by SMS unchecked. - DOCUMENT No. 3 – First communication with the option to unsubscribe. - DOCUMENT No. 4 – Withdrawal of consent to receive commercial communications by the complainant. - DOCUMENT No. 5.- Report with considerations on consent in commercial communications. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 8/16 - DOCUMENT No. 6.- Screenshot of registration in the system. - DOCUMENT No. 7 – Screenshot with the system check carried out on 03/21/24. SIXTH: On 07/30/24, a resolution proposal was made in the sense that the Director of the AEPD would sanction the respondent party for violation of the provisions of article 21 of the LSSI, classified as "minor" in art. 38.4.d) of the same regulation with a penalty of 20,000 euros (twenty thousand euros). In FD II of the resolution proposal, the objections were answered at the initiation of the file: First: The complainant states in his complaint that on 09/23/23, when making a purchase in one of the establishments of the entity being claimed, he was told that it was not possible to deliver the physical purchase ticket and that he had to provide his email address or telephone number. He also points out that, when providing said data on a Tablet of the establishment, at no time did any message or form appear through which he could object to receiving advertising, having received up to three advertising emails from the entity in his email without having authorized it. To corroborate the above, a copy of the three advertising emails received on 23/09/23, 28/09/23 and 01/10/23 is attached. For its part, the respondent party states in its written allegations to the initiation of the file that it is true that the claimant made a purchase in one of its stores on 23/09/23 but that at the time of making the payment, the cashier informed him that in accordance with the commitment to eliminate paper, the ticket is preferably delivered electronically by email, there being also the option of delivering the physical ticket. That the claimant agreed to receive the ticket by email and that when giving it, he was expressly asked if he wished to accept the sending of advertising before opening said tab, which occurred in this case and is attached to the capture of the screen of the Tablet where the option to receive advertising is shown unchecked by default; the screenshot of the claimant's account, where the list of purchases made appears, on the one hand, the only one dated 09/23/23 and on the other hand, the email address: ***EMAIL.1; and a copy of the screen for withdrawing consent to receive commercial communications where the following information appears: Email Unsubscribe: ***EMAIL.1 Unsubscribe Date Dec 20, 2023 at 8:57 pm. Now, regarding the consent that the user gives to the person responsible for the processing of his/her data so that, for example, as in the present case, he/she can send him/her commercial communications, Directive 5/2020 on consent within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27/04/16 on the Protection of Natural Persons with regard to the Processing of Personal Data and the Free Circulation of such Data (RGPD) establishes, points 105 to 108, the following: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 9/16 105. Recital 42 establishes that: “When the processing is carried out with the consent of the interested party, the controller must be able to demonstrate that the latter has given his/her consent to the processing operation.” 106. Controllers are free to develop methods to comply with this provision that are tailored to their daily operations. At the same time, the obligation to demonstrate that a controller has obtained valid consent should not in itself lead to excessive additional data processing. This means that controllers should have sufficient data to show a link to the processing (to show that consent was obtained), but should not collect further information. 107. It is up to the controller to demonstrate that it has obtained valid consent from the data subject. The GDPR does not prescribe how this should be done exactly. However, the controller must be able to demonstrate that in a specific case a data subject has given consent. The obligation to demonstrate consent will exist for the duration of the data processing activity in question. After the end of that activity, proof of consent should not be kept longer than is strictly necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims, in accordance with Article 17(3)(b) and (e). 108. For example, the controller must keep a record of the declarations of consent received, so that it can demonstrate how and when consent was obtained, and the information that was provided to the data subject at the time must also be demonstrated. The controller must also be able to demonstrate that the data subject was informed and that the controller's workflow met all relevant criteria for valid consent. The logic underlying this obligation in the GDPR is that controllers must be accountable for obtaining valid consent from data subjects and for the consent mechanisms they have adopted. For example, in an online context, a controller could retain information about the session in which consent was expressed, together with documentation about the consent workflow when that session took place, and a copy of the information that was presented at that time to the data subject. It would not be sufficient to refer only to a correct configuration of the website in question. The GDPR establishes that consent must be “free, specific, informed and unequivocal”. In addition, the interested party must be given control over it and be given the possibility of accepting or rejecting the terms under which it is given. Article 7 of the GDPR establishes that, when the treatment is carried out based on consent, this must be verifiable and the controller must be able to demonstrate that the interested party gave it in a valid manner. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 10/16 The GDPR does not establish a specific mechanism on how the controller must be able to prove that it has obtained valid consent, having freedom to implement the form of obtaining and recording that best suits the processes of the organization but, at least, must be able to prove who gave the consent, when, how and for what, as well as the information that was provided at the time of obtaining it. This obligation remains in force as long as the processing of personal data continues to be carried out under the initial conditions in which the data was collected and must be verifiable in the event of an audit or inspection. It is therefore of interest to implement tools that offer guarantees to the various parties involved in the consent process and allow them to manage the processing of personal data that is being carried out. Therefore, to assess whether consent is granted in a valid manner, the data controller must keep a log of the actions carried out to obtain consent. In the present case, the entity being complained about only presents a capture of the screen of a Tablet where the option to receive advertising is displayed unchecked by default; the screenshot of the claimant's account, where on the one hand the list of purchases made appears and on the other hand, the claimant's email address and the screenshot of a screen of the Tablet where the withdrawal of consent to receive commercial communications appears but does not provide, for example, a history of the "log" that can demonstrate that the interested party gave consent to receive commercial communications in a valid manner, or a screen where the signature of the interested party appears together with the ID number, thus complying with what is established in the current regulations, regarding the obligation of those responsible for the treatment to demonstrate that they have obtained consent in a valid manner. In short, on the one hand, the claimant, in his complaint, states that he has received commercial communications from the defendant without prior authorization, thereby breaching the provisions of article 21 of the LSSI, and on the other, from the documentation presented by the defendant in its allegations at the initiation of the file, there is no evidence that the interested party gave valid consent to receive commercial communications, as established in article 7 of the GDPR. Second: Regarding the grading of the sanction in which the aggravating circumstance of the existence of intentionality is applied, stating that it is not applicable, since, according to the defendant, the client expressly allowed the sending of commercial communications, and once the purchase receipt was received, the client could perfectly cancel his subscription, just as he could do when he received the other two communications and did so on 09/20/23. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 11/16 State that, with regard to the fact that the complainant expressly allowed the sending of commercial communications, as set out in the previous section, in relation to the point, in this case, there is no evidence that the complainant clearly expressed consent to receive commercial communications as established in article 7 of the RGPD and in relation to the fact that the complainant was able to unsubscribe easily and directly, both when receiving the purchase receipt and through the emails received, indicate that this file is not dealing with the possibility of opposition to the processing of personal data for promotional purposes as established in section 2 of article 21 of the LSSI, but rather the fact that before being able to exercise his right to oppose receiving advertising, the complainant received advertising emails without him having requested them or expressly permitted them, article 21.1 LSSI, so, in the case at hand, the application of the burden of intent is considered correct, in the sense that these events could and should have been avoided, observing and complying with a rule that imposed a duty of care. The claimant continues by stating that “(…) the sanction imposed should have taken into account all of these circumstances, so a sanction of 20,000 euros when the range is between 1 and 30,000 euros seems excessive (…), thereby violating the principle of proportionality (…)”. Regarding the latter, let us remember that the infringement charged is classified as “minor” in art. 38.4.d) of the LSSI and that article 39.1.c) establishes that said infringements may be sanctioned with a fine of up to 30,000 euros and to graduate said sanction, article 40 LSSI, establishes that said graduation will be taken into account in the following criteria: a) The existence of intentionality. b) Period of time during which the infringement has been committed. c) Recidivism by committing infringements of the same nature, when this has been declared by a final resolution. d) The nature and amount of the damages caused. e) The benefits obtained by the infringement. f) Volume of turnover affected by the infringement committed. g) Adherence to a code of conduct or a system of advertising self-regulation applicable to the infringement committed, which complies with the provisions of article 18 or the eighth final provision and which has been favourably reported by the competent body or bodies. Furthermore, article 29.3 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector (RJSP), establishes that, (…) in the imposition of sanctions by Public Administrations, the appropriateness and necessity of the sanction to be imposed and its adequacy to the seriousness of the fact constituting the infringement must be observed (…)”. In our case, it is considered that it is appropriate to graduate the sanction to be imposed according to the existence of intent (section a), as has been set out above and therefore, it is considered that the amount of the sanction complies with the proportionality criteria of article 29 of the LRJSP and 40 of C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 12/16 the LSSI, without the initially proposed sanction reaching the maximum of the range established for this type of infraction. The notification of the aforementioned resolution proposal was carried out in accordance with the rules established in the LPACAP, by electronic notification, with access to the content of the notification taking place on 01/08/24 as recorded in the file. No response has been received to this written resolution proposal. In view of all the actions taken, the Spanish Data Protection Agency in this procedure considers the following proven facts: PROVEN FACTS First: It has been established that on 23/09/23 the claimant made a purchase in the store of the defendant located in La Roca Village. Second: It is known that the claimant received, in the email ***EMAIL.1 on the days 23/09/23, 28/09/23 and 01/10/23, three emails sent from the address NUDE PROJECT <help@nude—project.com> containing advertising messages and photographs in English, such as: - NUDE PROJECT© Thank you for your purchase! ¡Visit Our store. Order summary … - NUDE PROJECT© NEW IN T-SHIRTS HOODIES BOTTOMS - By Artists, For Artists… - So, let's play who's who... you choose. Also, we have some last units of new Playboy garments. Have a look. JACK HAB LOW… - PLAYBOY CARDIGAN PLAYMATE SHIRT PLAYBOY CHINO PANTS SHOP THE LOOK DRAKE… - CHESS KNITTED POLO POOL DENIM PANTS CHAMPAGNE PROBLEMS HAT NAVY SHOP THE LOOK RIHAN NA… - WOMEN RACING JACKET BIG HEART WHITE BABY BUNNY BOWLING BAG WHITE/NAVY SHOP THE LOOK LIL NAS - Screenshot of the Tablet showing the option to receive advertising unchecked by default. - Screenshot of the claimant's account, where the list of purchases made appears, the only one dated 09/23/23, and on the other hand, the email address: ***EMAIL.1 with the annotation "notifications will be made in English". It can be seen that the option "subscribed email" is checked and the option to send communications by SMS is unchecked. There is no signature of the claimant's authorization. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 13/16 - Copy of the screen for withdrawing consent to receive commercial communications where the following information appears, in English: Email Unsubscribed: ***EMAIL.1Subscription details Status Unsubscribed or Method Email Link Date Dec 20, 2023, at 8:57 pm UTC. (Unsubscribe Email: ***EMAIL.1 Subscription details Status: Unsubscribe Date Dec 20, 2023) LEGAL BASIS I Competence. In accordance with the provisions of article 43.1 of the LSSI and the provisions of articles 47, 48.1, 64.2 and 68.1 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to resolve this procedure. Likewise, article 63.2 of the LOPDGDD determines that: "The procedures processed by the Spanish Data Protection Agency will be governed by the provisions of Regulation (EU) 2016/679, in this organic law, by the regulatory provisions issued in its development and, insofar as they do not contradict them, in a subsidiary manner, by the general rules on administrative procedures." The fourth additional provision "Procedure in relation to the powers conferred on the Spanish Data Protection Agency by other laws" establishes that: "The provisions of Title VIII and its implementing regulations will apply to the procedures that the Spanish Data Protection Agency must process in the exercise of the powers attributed to it by other laws." II Prohibition of unsolicited or expressly authorized commercial communications The LSSI prohibits unsolicited or expressly authorized commercial communications, based on a concept of commercial communication that is classified as an information society service and is defined in its Annex as: “f) Commercial communication”: any form of communication aimed at promoting, directly or indirectly, the image or the goods or services of a company, organization or person who carries out a commercial, industrial, artisanal or professional activity. Therefore, the concept of commercial communication, according to the previous definition, includes all forms of communication intended to promote, directly or indirectly, goods, services or the image of a company, organization or person with a commercial, industrial, artisanal or professional activity. On the other hand, the LSSI in its Annex a) defines “Information Society Service” as “any service normally provided for a fee, at a distance, by electronic means and at the individual request of the recipient, which also includes services not remunerated by their recipients, to the extent that they constitute an economic activity for the service provider”. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 14/16 According to section d) of the aforementioned Annex, the recipient is the “natural or legal person who uses, whether or not for professional reasons, an information society service” III Classification of the infringement committed by sending commercial communications without having been requested or expressly authorized. The fact that the respondent sends advertising emails to the complainant that had not previously been requested or expressly authorized constitutes a violation of the provisions of article 21 of the LSSI, as it establishes the following: “1. The sending of advertising or promotional communications by email or other equivalent means of electronic communication that have not previously been requested or expressly authorized by the recipients of these is prohibited. 2. The provisions of the previous section will not apply when there is a prior contractual relationship, provided that the provider has lawfully obtained the recipient's contact details and used them to send commercial communications regarding products or services of its own company that are similar to those that were initially the subject of the contract with the client. In any case, the provider must offer the recipient the possibility of opposing the processing of their data for promotional purposes through a simple and free procedure, both at the time of data collection and in each of the commercial communications sent to them. When the communications have been sent by email, this means must necessarily consist of the inclusion of an email address or other valid electronic address where this right can be exercised, and the sending of communications that do not include this address is prohibited.” IV Sanction The aforementioned infringement is classified as “minor” in art. 38.4.d) of said regulation, which qualifies as such, “The sending of commercial communications by email or other equivalent means of electronic communication when said sendings do not comply with the requirements established in article 21 and do not constitute a serious infringement.” According to the provisions of article 39.1.c) of the LSSI, minor infringements may be sanctioned with a fine of up to €30,000, while article 40 of the LSSI establishes the criteria for grading the amount of the sanctions: “The amount of the fines imposed will be graded according to the following criteria: a) The existence of intent. b) Period of time C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 15/16 during which the infringement has been committed. c) Recidivism in the commission of infringements of the same nature, when this has been declared by a final resolution. d) The nature and amount of the damages caused. e) The profits obtained from the infringement. f) Volume of turnover affected by the infringement committed. g) Adherence to a code of conduct or a system of advertising self-regulation applicable to the infringement committed, which complies with the provisions of article 18 or the eighth final provision and which has been favourably reported by the competent body or bodies." Based on the evidence obtained, it is considered that the sanction to be imposed should be graded in accordance with the aggravating criteria established in art. 40 LSSI: - The existence of intentionality (section a), since, if the customer wishes to receive the purchase ticket, he must provide the email address or telephone number where it will be sent, but he will also receive commercial communications by said means, even if he does not wish to, since there is no possibility of rejecting the sending of commercial communications when the email or telephone number is provided. According to these criteria, it is considered appropriate to propose a fine of 20,000 euros (twenty thousand euros), for the violation of article 21.1 of the LSSI. In accordance with the applicable legislation and having assessed the criteria for grading the sanctions whose existence has been proven, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: TO IMPOSE on the entity NUDE PROJECT, S.L. with CIF: B01945328, for the infringement of article 21 of the LSSI, classified as “minor” in art. 38.4.d), a fine of 20,000 euros (twenty thousand euros). SECOND: TO NOTIFY this resolution to the entity NUDE PROJECT, S.L. THIRD: To warn the sanctioned party that the sanction imposed must be made effective once this resolution is enforceable, in accordance with the provisions of article 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, within the voluntary payment period indicated in article 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17, by depositing it in the restricted account No. ES00 0000 0000 0000 0000, opened in the name of the Spanish Data Protection Agency at the banking entity CAIXABANK, S.A. or otherwise, it will be collected in the enforcement period. Once the notification has been received and has become enforceable, if the date of enforceability is between the 1st and 15th of each month, both inclusive, the deadline for making the voluntary payment will be until the 20th of the following month or the next business day thereafter, and if it is between the 16th and the last day of each month, both inclusive, the payment deadline will be until the 5th of the second following month or the next business day thereafter. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 16/16 In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which ends the administrative procedure (article 48.6 of the LOPDGDD), and in accordance with the provisions of articles 112 and 123 of Law 39/2015, of October 1, on the Common Administrative Procedure of the Public Administrations, interested parties may optionally file an appeal for reconsideration with the Director of the Spanish Data Protection Agency within one month from the day following notification of this resolution or directly file an administrative appeal before the Administrative Litigation Division of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned legal text. Finally, it is noted that in accordance with the provisions of art. 90.3 a) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, the final resolution in administrative proceedings may be provisionally suspended if the interested party expresses his intention to file an administrative appeal. If this is the case, the interested party must formally communicate this fact by means of a written document addressed to the Spanish Data Protection Agency, presenting it through the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronicaweb/], or through one of the other registries provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. The documentation proving the effective filing of the administrative appeal must also be transferred to the Agency. If the Agency is not aware of the filing of the administrative appeal within two months from the day following notification of this resolution, it will consider the precautionary suspension to be terminated. Mar España Martí Director of the Spanish Data Protection Agency. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es
