AEPD (Spain) - EXP202406716
From GDPRhub
| AEPD - EXP202406716 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 21.1 LSSI |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 22.04.2024 |
| Decided: | 05.12.2024 |
| Published: | 12.12.2024 |
| Fine: | 20,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | EXP202406716 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | ao |
The DPA fined a controller €20,000 for failing to respond to the data subject’s multiple requests to discontinue the delivery of advertising emails.
English Summary
Facts
The data subject had used the contact form provided by the controller three times in order to cancel the advertising emails they were getting. The first contact form request was sent on the 30 January 2024 but there had been no response by the controller to any of the requests. The data subject also sent an email to the contact email address available in the controller's privacy policy but again there was no response.
On the 22 April 2024, the data subject lodged a complaint against the controller, with the Spanish DPA (Agencia Española de Protección de Datos - AEPD). The AEPD on the 3 May 2024 forwarded the complaint to the controller and after receiving no response, resent the documents on the 14 May 2024. The AEPD again received no response from the controller.
Holding
On the 13 September 2024, the AEPD initiated disciplinary proceedings for the violation of Article 21.1 of Ley 34/2002 (de servicios de la sociedad de la información y de comercio electroónico - LSSI) which transposes the e-privacy Directive into national Spanish law. Article 21 regulates the sending commercial messages through electronic means and establishes, as a general rule, that consent is necessary for such messages.
With regard to the considerations laid out in Article 40 of the LSSI the AEPD found a fine of €20,000 appropriate.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/10 Procedure No.: EXP202406716 (PS/00356/2024) SANCTIONING PROCEDURE RESOLUTION From the actions carried out by the Spanish Data Protection Agency and based on the following: BACKGROUND FIRST: On 04/22/24, Ms. A.A.A. (the complaining party), filed a complaint with the Spanish Data Protection Agency. The complaint is directed against the entity DIGITAL PHOTO IMAGE, S.A. with NIF: A60984259, (the respondent party), for the alleged violation of Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI). The complaining party states that he or she does not wish to continue receiving emails from this company. In your emails you say “…you can exercise the rights of access, rectification, cancellation... after accessing www.nikonistas.com or the contact form...” but you have written 3 times to the contact form and have not received a response. You have also written directly to the contact email that appears in the privacy area, but you have not received any response either. There is no contact telephone number. Along with the complaint letter, the following documentation is attached: - Dated 01/30/24, copy of the email sent from the address no-reply@nikonistas.com to the address ***EMAIL.1, with the subject: “Nikonistas, Support query sent” and the following message: or “Thank you very much for contacting us. Regarding your query, as soon as possible one of our support agents will send you the response with the appropriate information. Name and surname: A.A.A. Email: ***EMAIL.1. Description of the query: I request to be removed from the Nikonistas Club and that you please stop sending me emails. Thank you!” - Dated 02/14/24, copy of the email sent from the address no-reply@nikonistas.com to the email address ***EMAIL.1, with the subject: “Nikonistas, Support query sent” and the following message: or “Thank you very much for contacting us. Regarding your query, as soon as possible one of our support agents will send you a response with the appropriate information. Name and surname: A.A.A. Email: ***EMAIL.1. Description of the query: Good morning. 15 days ago I requested to be removed from the club and to delete all my data, but I continue to receive your emails. PLEASE, I do not want to continue receiving your promotional emails to my email address, they are very numerous. If C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 2/10 they continue to not respond to my request, I will have to report them for non-compliance with the European Data Protection Regulation”. - Dated 21/02/24, copy of the email sent from the address no-reply@nikonistas.com to the email address ***EMAIL.1, with the subject: “Nikonistas, Support query sent” and the following message: or “Thank you very much for contacting us. Regarding your query as soon as possible one of our support agents will send you the response with the appropriate information. Name and surname: A.A.A. Email: ***EMAIL.1 Description of the query: PLEASE, this is the 3rd time I write. I request that you delete my data from your file and STOP SENDING ME MESSAGES TO MY EMAIL. If you do not do so, I will file a complaint against you for non-compliance with the Data Protection Law.” - Dated 02/29/24 copy of the email sent from the address no-reply@nikonistas.com to the address ***EMAIL.1 with the Subject: “Precision technology that takes your game to the next level with Nikon COOLSHOT rangefinders” and containing the following advertising message: or “A.A.A.: Nikon laser rangefinders stand out for their cutting-edge laser ranging technology, which guarantees millimeter precision in distance measurement.” - Dated 05/03/24, copy of the email sent from the address ***EMAIL.1 to the address club@nikonistas.com, with the subject: A/A DIGITAL PHOTO IMAGE / About personal data / Privacy and containing the following message: or “Good afternoon: I have been receiving your emails for a long time because I once had a Nikon camera, but I no longer want to receive them and I want you to delete my data from your archive. According to the bottom of your newsletter: "You can exercise the rights of access, rectification, cancellation, opposition, deletion, limitation and portability by modifying the personal data in 'edit my profile', after accessing www.nikonistas.com or the contact form.” Well, this is not true. I have not been able to exercise my rights to cancel my data. I have already sent 3 messages to the contact form and, not only have I not received a response, but I continue to receive your newsletters very often to my email. Searching on your website, I found this other address and that is why I am writing to you by this means. Please stop sending me emails and delete my data.” - Dated 03/14/24 copy of the email sent from the address no-reply@nikonistas.com to the address ***EMAIL.1 with the Subject: “Renew your Nikon Z 9 thanks to the latest updates” and containing the following advertising message: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 3/10 or “A.A.A., the new update will allow for additional improvements in the operation of the Nikon Z 9, such as greater visibility and an increase in the number of functions that can be assigned to custom controls...” - Dated 03/25/24 copy of the email sent from the address no-reply@nikonistas.com to the address ***EMAIL.1 with the Subject: “Exploring the best binoculars for your outdoor adventures” and containing the following advertising message: or “Nikon Sport Optics stands out as one of the leading manufacturers of binoculars, specializing in the creation of all-terrain binoculars. AA.A., whether you are a casual outdoor enthusiast or a dedicated hobbyist, having the best Nikon binoculars is essential for your specific activity. Today we propose four of the best Nikon binoculars, …” - Dated 03/27/24 copy of the email sent from the address no-reply@nikonistas.com to the address ***EMAIL.1 with the Subject: “Nikon AF system with eye detection and tracking for animals” and containing the following advertising message: or A.A.A., photographing our pets can be fun and easy if they are docile and remain still. However, for more energetic pets or animals it can be an odyssey. Nikon Z cameras... - Dated 04/05/24 copy of the email sent from the address no-reply@nikonistas.com to the address ***EMAIL.1 with the Subject: “Nikon Z 6II Experts Talks | We talk to B.B.B., a travel, event, gastronomy, etc. photographer.” and containing the following message: o In this online chat B.B.B. will mainly tell us about his experience with the Nikon Z 6II and other Nikon Z cameras he has worked with, such as the Z fc and the Z f, among others. We will talk about travel photography, events, gastronomy, etc. as well as his work and projects. He will also tell us about the lenses he works with, their advantages, their quality. - In each advertising email received there is the following message: o You can exercise the rights of access, rectification, cancellation, opposition, deletion, limitation and portability by modifying the personal data in 'edit my profile', after accessing www.nikonistas.com or the contact form. o Do not reply to this email, this sender does not accept incoming mail, so you will not receive a reply. SECOND: On 03/05/24, in accordance with the provisions of article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 4/10 Guarantee of Digital Rights, (LOPDGDD), this Agency forwarded the claim to the respondent party so that it could proceed to analyze it and report, within one month, on what was set out in the claim letter. The transfer was carried out in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (LPACAP), by electronic notification, with the following result: "expired due to expiration, as the deadline established for the appearance was exceeded, on 14/05/24 00:00", as stated in the certificate in the file. Although the notification was validly carried out by electronic means, in accordance with the provisions of article 41.5 of the LPACAP, said claim was sent again to the respondent party on 14/05/24, with access to the content of the notification taking place on 14/05/24 by C.C.C., as stated in the file. There is no record of any response to the request for information being received by this Agency. THIRD: On 03/05/24, this Agency accessed and completed the information that appeared in the “Privacy Policy” of the website www.nikonistas.com (https://www.nikonistas.com/digital/politica-privacidad.php), where, among other issues, it is noted: “DIGITAL PHOTO IMAGE, S.A. – PRIVACY NOTICE (…) YOUR RIGHTS: You can contact us to exercise any of the rights granted to you under applicable data protection laws, (…) and (6) the right to object to the processing, and, where we have asked for your consent, withdraw this consent (…). or 6) The right to object: You also have the right to object to the processing of your personal data, which means that you can ask us not to process your personal data. At any time and free of charge, you may object to the processing of your data for direct marketing purposes, in cases where they are processed for such purposes, including the creation of profiles for the purpose of direct sales. If you exercise this right, we will not process your personal data for such purposes. o CONTACT INFORMATION FOR YOUR PRIVACY QUERIES: DIGITAL PHOTO IMAGE, S.A. Ciencias 81, Nave 8 Polígono industrial Pedrosa, (08908) L’Hospitalet de Llobregat (Barcelona) club@nikonistas.com. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 5/10 o This site is managed by Digital Photo Image, S.A. (Finicon Group) with NIF: ESA-60984259 and Mercantile Registry of Barcelona, Volume 28,661, Folio 9, Sheet B141,711. FOURTH: On 07/22/24, the Director of the Spanish Data Protection Agency issued an agreement to admit the processing of the claim submitted, in accordance with article 65 of the LOPDGDD. FIFTH: On 09/13/24, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the respondent party in accordance with the provisions of articles 63 and 64 of the LPACAP, for the alleged violation of article 21.1 of the LSSI, classified as minor in art. 38.4.d) in the aforementioned regulation. In the opening agreement it was determined that the sanction that could correspond, considering the evidence existing at that time and without prejudice to what would result from the instruction, would amount to a total of 20,000 (twenty thousand euros). The notification of the initiation of the file was carried out in accordance with the rules established in the LPACAP, by electronic notification, with the following result, producing access to the content of the notification on 09/13/24, as shown in the file. SIXTH: Notified the aforementioned initiation agreement in accordance with the rules established in the LPACAP and the period granted for the formulation of allegations having elapsed, it has been confirmed that no objection to the initiation of the file has been received, in this Agency. Article 64.2.f) of the LPACAP - a provision of which the respondent party was informed in the agreement to open the procedure - establishes that if no allegations are made in the period provided for regarding the content of the agreement to initiate the procedure, when it contains a precise statement about the imputed liability, it may be considered a resolution proposal. In the present case, the agreement to initiate the sanctioning procedure determined the facts in which the imputation was specified, the infringement of the LSSI attributed to the respondent and the sanction that could be imposed. Therefore, taking into account that the respondent party has not made allegations to the agreement to initiate the procedure and in accordance with the provisions of article 64.2.f) of the LPACAP, the aforementioned agreement to initiate the procedure is considered in the present case a resolution proposal. In view of all the actions taken, the Spanish Data Protection Agency considers the following proven facts in this procedure: PROVEN FACTS First: From the documentation provided by the claimant it appears that the entity Digital Photo Image S.A. is responsible for the processing of personal data in relation to electronic communications sent by the “Nikonistas” platform through the email no-reply@nikonistas.com. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 6/10 Second: From the documentation provided by the complainant, it is clear that, on 30/01/24, the complainant requested, through the contact form on the Nikonistas website (www.nikonistas.com), to be removed from the club and to stop the sending of advertising emails, as can be seen from the communication received by the complainant from the address no-reply@nikonistas.com with the automatic acknowledgement message. Third: From the documentation provided by the complainant, it is clear that on 14/02/24 and 21/02/24, the complainant reiterated her request to unsubscribe and delete her personal data, stating that she had not received any response to her previous request, and that she continued to receive promotional emails, as can be seen from the copy of the communication received from the address no- reply@nikonistas.com with the same automatic acknowledgement message. Fourth: From the documentation provided by the complainant, it is clear that she continued to receive electronic communications with advertising content from the respondent entity. The following emails are attached as evidence, sent from the address no-reply@nikonistas.com to the complainant's email address on 29/02/24; 14/03/24; 25/03/24; 27/03/24 and 05/04/24. Fifth: From the documentation provided by the complaining party, it is clear that the complaining party also attempted to exercise its rights to data cancellation by sending a direct email to the address club@nikonistas.com on 05/03/24, in which it reiterated its request to unsubscribe and have its personal data deleted. A copy of the email sent is provided. Sixth: All advertising emails sent by Digital Photo Image S.A. from the address no-reply@nikonistas.com include the following standard message at the bottom of them: “You can exercise the rights of access, rectification, cancellation, opposition, deletion, limitation and portability by modifying the personal data in ‘edit my profile’, after accessing www.nikonistas.com or the contact form. Please do not reply to this email, this sender does not accept incoming mail, so you will not receive a reply.” LEGAL BASIS I Jurisdiction. In accordance with the provisions of article 43.1 of the LSSI and the provisions of articles 47, 48.1, 64.2 and 68.1 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and resolve this procedure. Likewise, article 63.2 of the LOPDGDD determines that: “The procedures processed by the Spanish Data Protection Agency will be governed by the provisions of Regulation (EU) 2016/679, by this organic law, by the regulatory provisions issued in its development and, as long as they do not contradict them, on a subsidiary basis, by the general rules on administrative procedures.” C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 7/10 The fourth additional provision “Procedure in relation to the powers conferred on the Spanish Data Protection Agency by other laws” establishes that: “The provisions of Title VIII and its implementing regulations shall apply to the procedures that the Spanish Data Protection Agency must process in the exercise of the powers conferred on it by other laws." II Summary of the facts: In the present case, the claimant alleges in her claim that, despite having requested on several occasions that the sending of commercial emails be stopped, she received no response to her requests and continued to receive promotional communications from the company. She states that she used the means of contact provided in the company's emails, as well as the contact form on its website, without obtaining any response. Along with its claim, the complainant attached several emails that it sent to the respondent and that documented its desire not to receive further commercial communications from the respondent entity. These emails, sent between January and April 2024, reflect repeated requests to unsubscribe and cancel its data, without the respondent complying with these requests despite having replied to the complainant with the "acknowledgement of receipt" of having received them. III Classification of the infringement committed by sending commercial communications without them having been requested or expressly authorized. The LSSI prohibits unsolicited or expressly authorized commercial communications, based on a concept of commercial communication that is classified as an information society service and is defined in its Annex as: “f) any form of communication aimed at the direct or indirect promotion of the image or the goods or services of a company, organization or person that carries out a commercial, industrial, artisanal or professional activity The fact that the respondent sends advertising emails to the complainant that have not previously been requested or expressly authorized may constitute a violation of the provisions of art. 21 of the LSSI, as it establishes: “1. The sending of advertising or promotional communications by email or other equivalent means of electronic communication that have not previously been requested or expressly authorized by the recipients of these is prohibited. 2. The provisions of the previous section shall not apply when there is a prior contractual relationship, provided that the provider has lawfully obtained the recipient's contact details and used them to send commercial communications regarding products or services of its own company that are similar to those that were initially contracted with the client. In any case, the provider must offer the recipient the possibility of opposing the processing of their data for promotional purposes through a simple and free procedure, both at the time of data collection and in each of the commercial communications sent to them. When the communications have been sent by email, this means must necessarily consist of the inclusion of an email address or other valid electronic address where this right can be exercised, and the sending of communications that do not include this address is prohibited.” IV Sanction The aforementioned infringement is classified as “minor” in art. 38.4.d) of said regulation, which qualifies as such, “The sending of commercial communications by e-mail or other equivalent means of electronic communication when said sending does not comply with the requirements established in article 21 and does not constitute a serious infringement”. According to the provisions of article 39.1.c) of the LSSI, minor infringements may be sanctioned with a fine of up to €30,000. Furthermore, article 40 of the LSSI establishes the criteria for the graduation of the amount of the sanctions: “The amount of the fines imposed will be graduated according to the following criteria: a) The existence of intentionality. b) Period of time during which the infringement has been committed. c) Recidivism in the commission of infringements of the same nature, when so declared by a final resolution. d) The nature and amount of the damages caused. e) The benefits obtained from the infringement. f) The turnover volume affected by the infringement committed. g) Adherence to a code of conduct or a self-regulation advertising system applicable to the infringement committed, which complies with the provisions of article 18 or the eighth final provision and which has been favorably reported by the competent body or bodies. Based on the evidence obtained, it is considered that it is appropriate to graduate the sanction to be imposed in accordance with the following circumstances, established in art. 40 of the LSSI: - The existence of intentionality (section a) since the respondent receives up to three requests to be removed from the system by the complainant without accessing the request since it is noted that the complainant continues to send commercial communications after receiving the requests. In accordance with these criteria, it is considered appropriate to impose a fine of 20,000 euros (twenty thousand euros), for the infringement of article 21.1 of the LSSI. In accordance with the applicable legislation and having assessed the criteria for grading the sanctions whose existence has been proven, the Director of the Spanish Data Protection Agency RESOLVES: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 9/10 FIRST: TO IMPOSE on the entity DIGITAL PHOTO IMAGE, S.A. with NIF: A60984259, for the infringement of article 21.1 of the LSSI, classified as minor in art. 38.4.d) of the aforementioned regulation, a fine of 20,000 euros (twenty thousand euros). SECOND: NOTIFY this resolution to DIGITAL PHOTO IMAGE, S.A. THIRD: Warn the sanctioned party that the sanction imposed must be made effective once this resolution is enforceable, in accordance with the provisions of article 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, within the voluntary payment period indicated in article 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17 December, by depositing it in the restricted account No. ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Data Protection Agency at the banking entity CAIXABANK, S.A. or, otherwise, it will be collected during the enforcement period. Once the notification has been received and enforced, if the enforcement date is between the 1st and 15th of each month, both inclusive, the deadline for making the voluntary payment will be until the 20th of the following month or the next business day thereafter, and if it is between the 16th and the last day of each month, both inclusive, the payment deadline will be until the 5th of the second following month or the next business day thereafter. In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which ends the administrative procedure (article 48.6 of the LOPDGDD), and in accordance with the provisions of articles 112 and 123 of Law 39/2015, of October 1, on the Common Administrative Procedure of the Public Administrations, interested parties may optionally file an appeal for reconsideration with the Director of the Spanish Data Protection Agency within one month from the day following notification of this resolution, or directly file an administrative appeal before the Administrative Litigation Chamber of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned legal text. Finally, it is noted that in accordance with the provisions of art. 90.3 a) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, the final resolution may be provisionally suspended by administrative means if the interested party expresses his intention to file a contentious-administrative appeal. If this is the case, the interested party must formally communicate this fact by means of a written document addressed to the Spanish Data Protection Agency, presenting it through the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronicaweb/], or through one of the other registries provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 10/10 You must also forward to the Agency the documentation that proves the effective filing of the administrative appeal. If the Agency is not aware of the filing of the administrative appeal within two months from the day following notification of this resolution, it will consider the precautionary suspension to be terminated. Mar España Martí Director of the Spanish Data Protection Agency. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es
