AEPD (Spain) - PS/00340/2019

AEPD - PS/00340/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1)(e) GDPR Article 6(1)(f) GDPR Article 21(1) GDPR Article 58(2) GDPR Article 83(5) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	PS/00340/2019
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish DPA (AEPD) found that the Regionalist Party of Aragon (PAR) violated an individual's right to object to processing by continuing to send her political canvassing materials after she had explicitly communicated her opposition to receiving such materials.

English Summary

Facts

The complainant, Mrs AAA, filed a complaint with the AEPD on the basis that she was continuing to receive political materials from the PAR, despite registering with her local census office as a citizen who expressly objected to being sent such materials from political parties.

The AEPD initially took the proceedings under an Article 6(1)(a) basis, ie processing without the complainant's consent, before changing the direction of the investigation to focus on Mrs AAA's right to object as a data subject under Article 21(1) GDPR.

Dispute

Did Mrs AAA have a right to object under Article 21 GDPR? Had the PAR infringed this right?

Holding

The AEPD held that Mrs AAA had a right to object, had exercised it in due time, and that the PAR had infringed her right to object to processing by continuing to send her their canvassing materials.

Regarding the penalty, the AEPD proposed imposing a reprimand on the PAR. Its rationale for imposing a reprimand rather than an administrative fine as a penalty was based on Recital 148, which states the appropriate penalty in a particular should give regard to criteria such as the "nature, gravity and duration of the infringement", or whether any measures were taken to mitigate any damage suffered to the complainant. Following this, the AEPD stated that a reprimand was a more appropriate penalty here because of the limited number of people affected, the extent of the damage caused by the PAR's continued processing, and the fact that this was the first time the situation has arisen.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

DECISION ON DISCIPLINARY PROCEEDINGS
Of the procedure instructed by the Spanish Data Protection Agency and based on the following FIRST FACTS: Mrs. A.A.A. (*hereinafter, the claimant) on June 12, 2019 filed a complaint with the Spanish Data Protection Agency. The claim is directed against PARTIDO ARAGONÉS REGIONALISTA (*hereinafter, the claimant). 
The reasons on which the claim is based are "receipt of political propaganda" despite having expressed their express opposition to this effect. (page nº 1).
Together with the claim, it provides documentary evidence dated 10/06/19 of the Provincial Delegate P.A (Zaragoza Electoral Census Office) certifying that "she is registered in the Electoral Census as an opponent to receive propaganda from political parties since 8 March 2018".
Item, provides documentary evidence accrediting the reception of propaganda of the denounced formation (Probative Doc. nº 1) without the address of the denouncing party.
SECOND: In view of the facts denounced in the complaint and the documents provided by the complainant, the Subdirectorate General of Data Inspection proceeded to carry out preliminary investigative actions to clarify the facts in question, by virtue of the powers of investigation granted to the supervisory authorities in Article 57. 1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD), and in accordance with the provisions of Title VII, Chapter I, Section Two of Organic Law 3/2018 of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD).
As a result of the investigative actions carried out, it has been established that the person responsible for the processing is the one who has been claimed.
THIRD: On 20/06/19 the claim was transferred to the National Statistics Institute (INE) so that it could make the appropriate explanations, in view of the exercise of the aforementioned right of opposition.
The entity -INE- confirms the delivery of the right exercised by providing electronic documentary evidence to this effect.
FOURTH: On October 30, 2019, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the respondent, for the alleged infringement of Article 6.1.a) of the RGPD, typified in Article 83.5 of the RGPD.
In view of the foregoing, the following are considered to be proven facts by the Spanish Data Protection Agency in these proceedings, FACTS 
FIRST. On 12/06/19 a complaint was received from the complainant by means of which she transferred as the main "fact" the receipt of political propaganda, despite her express opposition (page 1). Second. It is proved that the political propaganda is received from the Aragonese Regionalist Party. Third. It is proved that the affected person addressed in a legal way to INE (National Statistical Institute) exercising his right of opposition in order not to receive political propaganda. 
LEGAL FOUNDATIONS I
By virtue of the powers that Article 58.2 of the RGPD grants to each supervisory authority, and as established in Articles 47 and 48 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and resolve this procedure. II
The RGPD (as well as the LOPDGDD) expressly recognises the right of the data subject to object - at any time - on grounds relating to his or her particular situation, to the processing of personal data concerning him or her based on Article 6(1)(e) or (f) of the RGPD, including the drawing up of profiles on the basis of those provisions.
This right is regulated in Article 21 of the GPRS as follows:
"'The data subject shall have the right to object at any time, on grounds relating to his particular situation, to the processing of personal data relating to him on the basis of Article 6(1)(e) or (f), including profiling on the basis of those provisions. The controller shall cease to process personal data unless he proves that there are overriding legitimate grounds for processing that outweigh the interests, rights and freedoms of the data subject or for the lodging, exercise or defence of complaints".
The right to object allows the data subject, in the cases provided for in the RGPD, to oppose the processing of his/her personal data. And the data controller will have to stop processing them.
Thus, in accordance with Article 21 of the Regulation, the data controller is obliged to stop processing the personal data of the data subject, unless he/she proves that there are compelling legitimate reasons for the processing that outweigh the interests, rights and freedoms of the data subject, or for the formulation, exercise or defence of claims.
Notwithstanding the above, for the specific case of the exercise of the right to oppose the processing of data for the sending of electoral propaganda, such right shall be exercised in accordance with the provisions of the regulations governing electoral processes and shall have the effects provided for therein.
With regard to the temporary requirements for the exercise of the right of opposition, unlike the general rule established in Article 21 of the RGPD, according to which said right may be exercised by the interested party at "any time", in the case of opposition to the sending of electoral propaganda, the opposition must be exercised within the period established in the electoral regulations, which extends until the thirteenth day following the calling of the electoral process in question, and will have effects on the same and on subsequent ones, as long as the interested party does not express any other intention.
In this regard, article 39, paragraphs 2 and 3 of Organic Law 5/1985 of 19 June on the General Electoral System (LOREG), the latter modified by Final Provision 3.1 of the LOPDGDD, determines the following
"Town councils and consulates shall be obliged to maintain a consultation service on the electoral lists in force for their respective municipalities and districts during a period of eight days, starting on the sixth day following the call for elections.
The consultation may be carried out by computerised means, after identifying the interested party, or by exhibiting the electoral lists to the public, if there are not sufficient computerised means to do so.
3. Within the previous period, any person may make a complaint to the Provincial Delegation of the Electoral Census Office regarding their census data, although only those complaints referring to the rectification of errors in personal data, changes of address within the same district or the non-inclusion of the complainant in any section of the census in the district, despite having the right to do so, may be taken into account. Requests from voters who oppose their inclusion in the copies of the electoral census provided to the representatives of the candidates for sending out electoral propaganda mailings shall also be dealt with. Those that reflect a change of residence from one district to another, carried out after the closing date of the census for each election, shall not be taken into account for the called election, and they must exercise their right in the section corresponding to their previous address" (section 3 of article 39 of the LOREG modified by Final Provision 3. One of the LOPDGDD).
The Agreement 2/2019, of 23 January 2019, of the Central Electoral Board establishes the following about this opposition:
“1º) In order to facilitate the processing of requests from voters who oppose their inclusion in the copies of the electoral census that the Electoral Census Office must give to the representatives of the candidates to send out electoral propaganda, said requests may be made prior to the calling of an electoral process, in Town Councils, Consulates and Provincial Delegations of the Electoral Census. Likewise, they may be made at the electronic headquarters of the National Statistics Institute, once the Electoral Census Office has enabled said procedure. 2) The referred requests for exclusion shall have permanent effect until the voter makes the opposite statement. 3) The Electoral Census Office shall inform voters of the exclusion requested. 4) This exclusion shall be compatible with the representatives of the candidates being able to have the complete list of voters for the purposes of voting and counting, with the data essential for identifying the voter.
It should be remembered that any citizen may request the INE (National Institute of Statistics) to be removed from the electoral propaganda Census.
To avoid this, there is an online form available to voters on the website of the National Institute of Statistics (INE), with which we can request to be excluded from the copies of the electoral census that are given to party representatives to send out electoral propaganda mailings. III
In relation to the facts subject to the transfer by this Agency, the entity denounced by PAR answered in the previous phase (09/07/19) to the opening of the procedure the following: "...neither is communicated to this Party at the delivery of the Census the voters who have manifested or claimed anything regarding their registration in it, being therefore this Party a mere viewer of the data that appear in it, being the Census Bureau the total responsible for manipulating the data that appear and should not appear".
"That in no case, neither to the PAR, nor to any other political party attending the elections, are the voters who have expressed their willingness to be excluded from what is known as electoral mailing communicated from the Electoral Census Office or from any other body".
In order for citizens to exercise their right not to receive electoral propaganda (electoral mailing), the INE has enabled a way of carrying out this procedure electronically.
It was necessary to enter the INE website, specifically the Electronic Headquarters of the body, where "Procedures" was selected and a drop-down menu appeared: "Request for exclusion/inclusion in copies of the Census for electoral propaganda".
On the website of this procedure, a file appears with the description and some brief instructions. To submit the application, it is necessary to have one of electronic certificates recognised by the INE, such as the electronic ID card, or the Cl@ve certificate.
Once we have identified ourselves electronically, a screen will appear on which our census data are displayed. At the bottom there is a link that will take us to a form with a tab: you must choose between "included (default)" or "excluded".
Almost immediately we will obtain a receipt informing us that our choice "has been estimated and will have permanent effect until it is stated otherwise".
The complainant provided documentary evidence (Probative document nº1) consisting of a certificate issued by the Provincial Delegate of the Electoral Census Office (Zaragoza) which states that the complainant "is registered as an opponent to receiving propaganda from political parties on 8 March 2019".
Likewise, as stated, the complainant provides documentary evidence (Doc. nº 2) that accredits the receipt of electoral propaganda from the Aragonese Party, where the envelope contains the data of the affected party, without stating her home address, but stating her postal code and town.
Article 41.5 LOREG states the following: "The representatives of each candidacy may obtain, within two days following the proclamation of their candidacy, a copy of the census of the corresponding district, ordered by tables, on a medium suitable for computer processing, which may be used exclusively for the purposes provided for in this Law. Alternatively, the general representatives may obtain, under the same conditions, a copy of the current census of the districts where their party, federation or coalition is presenting candidates. Likewise, the Zone Electoral Boards shall have a copy of the usable electoral census, corresponding to their area".
III
In accordance with the evidence available in the present sanctioning procedure, it is considered that the respondent (a) has not complied with the right of opposition exercised in due time and form by the complainant, who continues to receive electoral propaganda despite having expressly opposed it.
The known facts could constitute an infringement, attributable to the defendant, for violation of Article 21 RGPD, by not effectively attending to the exercise of the mentioned right.
On the other hand, the LOPDGDD, in its article 72.1.k), qualifies as a very serious infringement, for the purposes of prescription, "The impediment or the hindrance or the repeated lack of attention to the exercise of the rights established in articles 15 to 22 of Regulation (EU) 2016/679.”
The documentation in the file evidences that the respondent violated Article 21 of the RGPD, since in spite of the fact that the complainant exercised his right to oppose, in time and form, so that no postal electoral publicity was sent to him, he received it at his home. On the one hand, it is proven that the respondent processed the personal data of the complainant -domestic data, name, surname and postal address- associated with the sending of postal election advertising. A copy of the envelope sent by the PSC-PSOE to its postal address, and of the electoral publicity received, is included in the file. 
On the other hand, the claimed party lacked legitimacy for the processing of the personal data of the claimant for the sending of electoral propaganda, having opposed the receipt of said propaganda in the Electoral Office of the INE. 
Article 83.5 of the RGPD states: 'Infringements of the following provisions shall be punishable, in accordance with paragraph 2, by administrative fines of not more than EUR 20 000 000 or, in the case of a company, of not more than 4 % of the total annual turnover of the preceding financial year, whichever is greater: 
(b) the rights of the persons concerned within the meaning of Articles 12 to 22 (...) IV
In determining the appropriate administrative sanction to be imposed, we should read some recitals of the RGPD, among others, 148, which indicates the following:
<<In order to strengthen the enforcement of the rules of this Regulation, any infringement of this Regulation should be subject to sanctions, including administrative fines, in addition to or instead of appropriate measures imposed by the supervisory authority under this Regulation. In the case of a minor infringement, or if the fine likely to be imposed would constitute a disproportionate burden on a natural person, a warning may be imposed instead of a penalty in the form of a fine. However, particular attention should be paid to the nature, gravity and duration of the infringement, its intentional nature, the measures taken to mitigate the damage suffered, the degree of liability or any previous relevant infringement, the manner in which the supervisory authority became aware of the infringement, compliance with measures ordered against the person responsible or entrusted, adherence to codes of conduct and any other aggravating or mitigating circumstances. The imposition of sanctions, including administrative fines, should be subject to adequate procedural safeguards in accordance with the general principles of Union law and the Charter, including the right to effective judicial protection and to a fair trial.
In the case under complaint we must take into consideration that, until very few months ago, political parties were entitled to send electoral propaganda to all voters during the election campaign. There was no rule to oppose to such sending.
This authorisation has been limited by the modification of the LOREG included in the LOPDGDD. Therefore, political parties have had a very short period of time to adapt to this limitation and there have been few complaints about it.
Taking into consideration the very limited number of people affected, the measures adopted, the little damage caused by the treatment carried out, and that this is the first time this situation has arisen, it was agreed to initiate sanctioning proceedings by proposing to warn the political party -Partido Aragonés Regionalista- as a possible sanction.
Therefore, in accordance with the applicable legislation and having assessed the criteria for the graduation of the sanctions whose existence has been accredited, 
the Director of the Spanish Data Protection Agency RESOLVES: 
FIRST: TO IMPOSE on the PARTIDO ARAGONÉS political party, with NIF for an infraction of Article 6.1.a) of the RGPD, typified in Article 83.5 of the RGPD, a penalty of APPRECIATION, in accordance with the provisions of Article 58.2 RGPD. 
SECOND: TO NOTIFY the present resolution to the political party PARTIDO ARAGONÉS and TO INFORM the complainant Doña A.A.A. of the result of the actions.
Once the notification has been received and once it has been executed, if the date of execution is between the 1st and 15th of each month, inclusive, the deadline for making the voluntary payment will be up to the 20th of the following month or the immediately following working month, and if it is between the 16th and last day of each month, inclusive, the deadline for payment will be up to the 5th of the second following month or the immediately following working month.
In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. 
Against this resolution, which puts an end to the administrative procedure in accordance with article 48. 6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, the interested parties may, optionally, lodge an appeal for reversal with the Director of the Spanish Data Protection Agency within a period of one month from the day following notification of this decision or directly lodge an administrative appeal with the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998 of 13 July 1998, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following notification of this act, as provided for in Article 46. 1 of the aforementioned Law.

Mar España Martí 
Director of the Spanish Data Protection Agency