AEPD (Spain) - PS/00339/2019
From GDPRhub
| AEPD (Spain) - PS/00339/2019 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(f) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | None |
| Parties: | Anonymous Instituto Nacional de Estadística and COALICIÓ COMPROMÍS |
| National Case Number/Name: | PS/00339/2019 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | n/a |
In case of political propaganda, if the party relies on a list mistakenly formed by a third party, the sending is lawful unless the investigation proves the violation is conscious or negligent.
English Summary
Facts
A Spanish citizen objects to the sending of political propaganda. The request, addressed to the Instituto Nacional de Estadística, is ignored and data subject's contact details shared with a political party. The party, which could not be aware of the violation of the Institute, uses the information. According to the AEPD the party is not liable.
Dispute
Is a political party liable for the sending of propaganda, when the contact details used is provided by a third-party?
Holding
In the present case, the party sent political material at the address of a data subject who had already objected to such processing. According to the AAPD, however, the conduct of the party was not negligent as it was impossible for the controller to know how the list was formed. Therefore, the authority archived the proceeding.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the original. Please refer to the Spanish original for more details.
Procedure No.: PS/00339/2019 938-051119 DECISION ON DISCIPLINARY PROCEEDINGS From the procedure instructed by the Spanish Data Protection Agency and based on the following FACTS FIRST: Mrs. A.A.A. (*hereinafter, the claimant) on April 22, 2019 filed a complaint with the Spanish Data Protection Agency. The reasons on which the complaint is based are "I am sending you this complaint because I have asked the National Institute of Statistics (INE) to exclude my personal data from being given to political parties so that they cannot send electoral propaganda. I attach a copy of the justification issued by the INE and photographs of the consignments received". (sheet no. 1). Together with the complaint, it provides Documentary evidence No. 1 "receipt of filing at the Registry" dated 06/04/19 with the Opposition Summary of Parties. SECOND: In view of the facts denounced in the complaint and the documents provided by the complainant, the Subdirectorate General for the Inspection of Professional Data agreed to carry out preliminary investigative actions for the clarification of the facts in question, by virtue of the powers of investigation granted to the supervisory authorities in article 57.1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter referred to as the GPRD), and in accordance with the provisions of Title VII, Chapter I, Section 2 of Organic Law 3/2018 of December 5, 1978, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter referred to as the LOPDGDD). As a result of the investigative actions carried out, it was established that the person responsible for the processing was the one who had been requested: Compromís. THIRD: On 18/11/19, this Agency received a reply from the Compromis political party stating the following: "The facts that are the subject of the complaint correspond to the sending by this political party of the electoral propaganda for the general elections held on April 28, 2019 in concurrence with the elections to Les Corts Valencianes. In accordance with current regulations, in order to be able to make said dispatch, the representatives of this candidacy received a copy of the voter census file of the corresponding districts from the Electoral Census Office. Specifically, the file used for sending propaganda in said elections was submitted by the Electoral Census Office to COALICIÓ COMPROMÍS within the terms determined by legislation. The copy of the voter registration file that is sent to the political parties has the registration design that is included in the document attached to this document as DOCUMENT 1. Therefore, if a political party sends electoral propaganda to a voter's home, it is necessarily because the file received contained that address, which presupposes that that person has not exercised a right of opposition to receive electoral publicity. In both cases, the fact that the claimant's right to oppose has not been taken into account is not at all attributable to COALICIÓ COMPROMÍS, since it does not have the means to know if a person has exercised his or her right to oppose before the INE, having limited itself to sending electoral publicity, trusting in the correction of the file received from the Public Administration for this purpose. The above implies that there is no fault of this political party in the facts that are imputed to it. Therefore, I APPLY TO THAT SPANISH DATA PROTECTION AGENCY: In view of the fact that this document has been submitted together with the documents that accompany it, please accept it and consider the allegations made so that, in view of them, this sanctioning file is DEFINITELY ARCHIVED". FOURTH: On November 4, 2019, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the respondent, for the alleged infringement of Article 6 of the RGPD, typified in Article 83.5 of the RGPD. In view of the foregoing, the following are considered to be proven facts by the Spanish Data Protection Agency in these proceedings PROVEN FACTS First. On 22/04/19 this Agency received a complaint from the complainant, by which it transferred the following as the main "fact": "reception of electoral propaganda of the Compromis formation in spite of the fact that it bids the exclusion of my personal data to be given to the political parties in order not to be able to send electoral propaganda, I have received two mailings sent by political formations". Attached documentary evidence (Doc. nº 1) which accredits having exercised Opposition Law before the INE on 06/04/19. "Having examined your request for exclusion of the copies of the electoral roll which are given to the representatives of the candidates for postal dispatch of electoral propaganda, you are informed that it has been estimated and will have permanent effect until it manifests itself in the opposite direction". Second. It is accredited the sending of electoral propaganda of the political formation Compromis when providing the denounced (Doc. nº 2) the envelope of the denounced formation, to the address ***DIRECTION.1), coincident with the one of the affected. Third. The call for the General Elections of 28 April 2019 was made on 5 March, so the deadline for the submission of claims was set from 11 to 18 March 2019. The same deadlines apply to requests for exclusion. It This is because the electoral rolls given to the political parties cannot be changed. for a specific election, once the deadline for the census for these elections. It has been accredited that the presentation of the request for non-reception of electoral propa- ganda is made by the complainant on 06/04/2019 12:46:47 (Peninsular time). LEGAL FOUNDATIONS I By virtue of the powers that article 58.2 of the RGPD recognises to each control authority, and in accordance with the provisions of articles 47 and 48 of the LOPDGDD, the Governing Body of the Spanish Data Protection Agency is competent to initiate and resolve this procedure. II In the present case, the complaint of date of entry into this body on 22/04/19 by means of which the following was transferred as the main event is examined: "reception of electoral propaganda of Compromis formation in spite of the fact that it is tendered the exclusion of my personal data to be given to the political parties in order not to be able to send electoral propaganda, I have received two mailings sent by political formations" (sheet nº 1). The legal tool that allows citizens to request the right of exclusion that we are dealing with is found in the recent Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDPGDD), which introduced in its third final provision two amendments to the Organic Law 5/1985, of 19 June, on the General Electoral System (in accordance with the LOREG). Paragraph 5 of this article 58 bis ensures that "the addressee is provided with a simple and free way of exercising the right to oppose this dispatch of electoral pro- paganda". Article 39.3 LOREG (LO 5/1985, June 19, of the General Electoral Regime) provides the following: "Within the previous period, any person may make a complaint to the Provincial Delegation of the Electoral Census Office regarding their registration data, although only those referring to the rectification of errors in personal data, changes of address within the same district or the non-inclusion of the claimant in any section of the district census, despite having the right to do so, may be taken into account. Requests from voters who oppose their inclusion in the copies of the electoral census provided to the representatives of the candidates to make postal deliveries of electoral pro- paganda will also be attended to. Those who change their residence from one district to another, made after the closing date of the census for each election, shall not be taken into account for the election called, and must exercise their right in the section corresponding to their previous address". The RGPD (as well as the LOPDGDD) expressly recognises the right of the data subject to object - at any time - on grounds relating to his or her particular situation, to the processing of personal data concerning him or her based on Article 6(1)(e) or (f) of the RGPD, including the drawing up of profiles on the basis of those provisions. For its part, the LOPDGDD in its article 18 regulates the right of opposition in the following terms: "The right of objection, as well as the rights related to automated individual decisions, including profiling, shall be exercised in accordance with Articles 21 and 22 of Regulation (EU) 2016/679 respectively. Article 21 GGPD REGULATION (EU) 2016/679 OF THE EU PARLIAMENT ROPEO AND COUNCIL of 27 April 2016 provides: 'The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data relating to him or her on the basis of Article 6(1)(e) or (f), including the drawing up of profiles on the basis of those provisions. The data controller shall cease to process the personal data, unless he proves that there are compelling legitimate grounds for processing that take precedence over the rights and freedoms of the data subject, or for the formulation, exercise or defence of a claim". Agreement 2/2019 of 23 January 2019 of the Central Electoral Board states the following about this opposition <1º) In order to facilitate the processing of requests from voters who oppose their inclusion in the copies of the electoral census that the Electoral Census Office must deliver to the representatives of the candidates to send out electoral propaganda, said requests may be made prior to the calling of an electoral process, in Municipalities, Consulates and Provincial Delegations of the Electoral Census. Likewise, they may be carried out at the electronic headquarters of the National Statistics Institute, once the Electoral Census Office has enabled said procedure. 2) The aforementioned requests for exclusion shall have permanent effect until the voter expresses his or her opinion to the contrary. 3) The Electoral Census Office shall notify voters of the exclusion only quoted. 4) This exclusion must be compatible with the fact that the representatives of candidates can have the complete list of voters for the purposes of voting and counting, with the data essential for identifying the voter. In the present case, we find two organic laws (art. 81 CE) regulating the matter that concerns us, understanding that based on the criterion of specificity, the matter that concerns us is the own of the general electoral Regime, and it is in this framework where the affected exercised her right not to receive electoral propaganda. As the right has been proved, it was not exercised within the term marked in the LOREG, that is, until 18/03/19 inclusive, reason that originated the reception of electoral propaganda of the political formation Compromis in its usual domicile. This does not prevent the right to receive new political propaganda from having an effect on subsequent political campaigns, as long as the affected party "does not manifest the contrary". The electoral rolls were sent to the political parties, with the personal data updated to the closing date of the same, without the opposition exercised by the complainant being recorded, having been carried out outside the period of time established by the regulations in force. III Article 25 of Law 40/2015 (1 October) provides as follows "Only natural and legal persons may be punished for acts constituting an administrative offence, as well as, when a law recognizes their capacity to act, groups of affected persons, unions and entities without legal personality and independent or autonomous patrimonies, which are responsible for them by way of fraud or guilt. This principle of culpability also applies to administrative offences, since insofar as the punishment of such an offence is one of the mani- festations of the ius puniendi of the State, a regime of strict or no-fault liability is inadmissible in our system (STC 76/1990 -EDJ 1990/4435-)... Moreover, this same ruling requires guilt in the case of ad- ministrative infractions committed by legal persons, stating that "Even this Court has described as "correct" the principle of personal responsibility for one's own actions - the principle of the personality of the penalty or sanction - (STC 219/1988 - EJD 1988/535). The jurisprudence of the Supreme Court, in line with that of the Constitutional Court, has established that the sanctioning power of the Administration, as a manifestation of the "ius puniendi" of the State, is governed by the principles of criminal law, with the basic structural principle being that of culpability, incompatible with a regime of strict liability, without fault. Thus, the SSTS of 12 (rec. 388/1994) and 19 May 1998, Section Six, state that in the area of sanctions "any attempt to construct objective liability is forbidden" and that "in the area of administrative liability it is not sufficient that the conduct be anti-legal and typical, but it is also necessary that it be guilty, that is, the consequence of an action or omission attributable to its author by malice or imprudence, negligence or inexcusable ignorance (...)....) that is to say, as a requirement deriving from Article 25.1 of the Constitution, no one may be condemned or punished except for acts that may be imputed to him by way of malice or guilt (principle of culpability)". IV In accordance with the above, it should be noted that the complainant exercised her right not to receive political propaganda from the aforementioned group, outside the time limit set out in the specific legislation governing the matter, without the subjective element of guilt having been appreciated, since the political group denounced proceeded to process the data of the same, as sent to it by the elected Census Bureau. It is therefore appropriate to order the termination of the present proceedings since the infringement of the right claimed by the complainant has not been established. Therefore, in accordance with the applicable legislation and based on the above, the Director of the Spanish Data Protection Agency RESOLVES FIRST: ORDER the ARCHIVE of the present procedure as no administrative infringement of data protection has been accredited. SECOND: TO NOTIFY the present resolution to the political formation COALITION COMMITMENTS and TO INFORM the result of the actions to the complainant Mrs. A.A.A. In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure in accordance with Article 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPA- CAP, the interested parties may, optionally, file an appeal for reversal with the Director of the Spanish Data Protection Agency within a period of one month from the day following notification of this decision or directly appeal to the Contentious Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998 of 13 July 1998, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following notification of this act, in accordance with the provisions of Article 46.1 of the aforementioned Act. Mar Spain Marti Director of the Spanish Data Protection Agency
