AEPD (Spain) - PS/00223/2021
|AEPD (Spain) - PS/00223/2021|
|Relevant Law:||Article 17 GDPR|
Article 21 GDPR
Ley 9/2014, de 9 de mayo, General de Telecomunicaciones
|National Case Number/Name:||PS/00223/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish DPA fined Vodafone €100,000 (reduced to €80,000) for processing personal data to make unsolicited commercial calls to a data subject that had exercised their right to object and to erasure.
English Summary[edit | edit source]
Facts[edit | edit source]
A data subject filed a case before the Spanish DPA (AEPD) for receiving unsolicited commercial calls on behalf of Vodafone, even after explicitly exercising their right to object and right to erasure as per Articles 21 and 17 GDPR. The data subject had also signed up for the Robinson List.
Holding[edit | edit source]
The Spanish DPA investigated the case and applied the national Telecommunications Act. Particularly, the DPA found a violation of Article 48(1)(b) of this law, setting the right to object to unsolicited communications.
The DPA then considered the violation as serious, following Article 77 of the same law. Specifically, the reasons why the violation was deemed as serious are: (a) the previous offences committed by Vodafone, (b) the benefit derived to Vodafone by the infringement, (c) the damage caused and its reparation, (d) the non-cessation of the infringing activity.
For these reasons, the Spanish DPA imposed a fine of €100,000 to Vodafone, reduced a 20% (to €80,000) because of early payment.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/12 File No.: PS / 00223/2021 RESOLUTION OF TERMINATION OF THE PROCEDURE BY PAYMENT VOLUNTARY Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: On May 20, 2021, the Director of the Spanish Agency for Data Protection agreed to initiate a sanctioning procedure against VODAFONE ONO, S.A.U. (hereinafter the claimed part). Notified the initiation agreement and after analyzing the allegations presented, on June 16, 2021 the proposal of resolution that is transcribed below: << Procedure number: PS / 00223/2021 Of the actions carried out by the Spanish Agency for Data Protection and in based on the following BACKGROUND FIRST: A.A.A. (hereinafter the claimant), dated February 12, 2020 and February 18, September 2020, filed a claim with the Spanish Protection Agency of data. The claim is directed against VODAFONE ONO, S.A.U., with CIF A62186556 (hereinafter the claimed one). The reasons on which the claim is based is the receiving unwanted commercial calls on behalf of the claimed. The claimant provides the following documentation: Copy of the emails exchanged by the claimant with the address *** EMAIL. 1. Thus, on September 4, 2019, he stated that he did not want to continue to receive calls of a commercial nature at telephone numbers: *** PHONE. 1 and *** PHONE. 2. Also, on September 25, 2019 He adds that he does not want to receive calls of a commercial nature on the number phone *** PHONE. 3. Among the emails, there is one, dated 13 January 2020, in which the claimant is informed that her phone number on the respondent's internal Robinson list. Nevertheless, subsequently, on February 10, 2020, the claimant indicates that it continues receiving calls from the number *** PHONE. 4. The defendant indicates, in C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/12 relation to the number *** TELEPHONE.4, which does not belong to “any agent currently working with Vodafone ”. Copy of an invoice corresponding to the month of December 2019 from R CABLE y TELECABLE TELECOMUNICACIONES, S.A.U. on behalf of the claimant in which the telephone numbers *** TELEPHONE 1, *** PHONE. 2 and *** PHONE. 3. Copy of an email sent by the claimant on the 18th of September 2020 in which it informs Vodafone's DPD that it continues receiving calls on behalf of the defendant. Screen print of a telephone showing an “incoming call” one minute from the telephone number *** TELEPHONE.4 “today” to 4:35 p.m. Screen print of a telephone showing a "missed call" from the telephone number *** TELEPHONE.4 “yesterday” at 7:59 p.m. Screen print of a telephone showing an “incoming call” one minute long from the phone number *** PHONE. 5 “the day before yesterday” at 4:36 pm. SECOND: In view of the facts denounced in the claim and the documents provided by the claimant and the facts and documents of which he has this Agency, the Subdirectorate General for Data Inspection, has come to know proceeded to carry out preliminary investigation actions for the clarification of the facts in question, by virtue of the powers of investigation granted to the control authorities in article 57.1 of the Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD), and of in accordance with the provisions of Title VII, Chapter I, Second Section, of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). As a result of the investigative actions carried out, it is verified that the responsible for the treatment is the claimed one. Likewise, the following points are found: BACKGROUND Claim entry date: February 12, 2020 (nre: 006650/2020) Claimant: A.A.A. (the claimant) Claimed: VODAFONE ESPAÑA, S.A.U. with CIF A80907397 and address at Avda.de America 115, 28042 Madrid. (the claimed one) Facts according to the claims of the claimant: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 12/3 The claimant files a claim (entry registration numbers 006650/2020 and O00007128e2000002446) for receiving unwanted commercial calls in name of the claimed. To this end, it specifically refers to the following facts: - Refers that the phone numbers where you receive calls are: *** PHONE. 1, *** PHONE. 2. In addition to the documentation provided together with the claim, it appears that he would also have received calls on the number *** PHONE. 3. - It refers that the telephone numbers from which the calls are received are: *** PHONE. 6, *** PHONE. 4. In addition to the documentation provided together with the claim, it appears that he would also have received calls from number *** PHONE. 7. The antecedents that appear in the information systems of the AEPD are the following: In the framework of procedure E / 02603/2020, dated March 24, 2020, the AEPD, by virtue of article 65.4 of Organic Law 3/2018, of December 5, of Protection of Personal Data and guarantee of digital rights, gave transfer of the claim to the defendant. The claimed, in response of June 29, 2020 (entry registration number in the AEPD 022195/2020) stated, with respect to the claimant's lines *** TELEPHONE.1, *** TELEPHONE.2 and *** TELEPHONE.3 following: “We have verified that the claimant's telephone lines are on the list Robinson official ADigital since February 13, 2020. Likewise, it has been verified that their mobile lines are registered on the list Robinson has been internal to Vodafone since September 9, 2019, and his telephone fixed from January 2, 2020. " Furthermore, in relation to the calling numbers *** TELEPHONE.8 and *** TELEPHONE.4, states that “we have verified that one of the calling numbers is associated with a collaborator of the Televenta channel: *** CHANNEL.1 ”. In this regard he adds that “for the campaigns carried out by Telesales, it is Vodafone who facilitates the data object of the campaign and is the entity in charge of filtering it previously by the Robinson lists, both from ADigital and Vodafone's own ”. INVESTIGATED ENTITIES In addition to the claimant and the defendant, they have intervened in these performances: - R CABLE Y TELECABLE TELECOMUNICACIONES S.A.U. (onwards RCable) - VODAFONE ONO, S.A.U. (hereinafter ONO or investigated), with CIF A62186556. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/12 RESULT OF RESEARCH ACTIONS Adigital's advertising exclusion system is listed on the AEPD's electronic headquarters in accordance with the forecast made in article 23 of Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of rights digital (LOPDGDD). On October 14, 2020, the claimant was required to provide the following information There is access to it by the claimant on October 15, 2020: - “Date and time the commercial calls were received on behalf of of "Vodafone" indicating the specific number of origin of each call (*** PHONE 8 or *** PHONE 4) and the specific destination number of each call (*** PHONE.1, *** PHONE.2, or *** PHONE.3). Make it easy, yeah if possible, the information that proves the existence of such calls. " To date, no response has been received to the previous request for information. The claimant's telecommunications operator, RCable, has facilitated the Next information: - Report, dated October 22, 2020 (written with number of entry record in the AEPD O00007128e2000007150) that are not listed in their systems registered calls from numbers *** PHONE. 8 or *** PHONE 4 to the numbers *** PHONE 1, *** PHONE 2 and *** PHONE. 3 on January 24, 2020. - Inform, dated February 3, 2021 (written with registration number of entry in the AEPD O00007128e2100004324), in relation to the reception in the telephone numbers *** TELEPHONE.1, *** TELEPHONE.2 and *** TELEPHONE.3 of calls from the lines *** TELEPHONE.7 and *** TELEPHONE.4 between the September 14 and 18, 2020, which are only registered in their systems the following calls directed to *** PHONE. 1: One minute and fourteen second long call made on September 16, 2020 at 4:36 p.m. from the issue *** PHONE. 7. Five-second call made on the 17th of September 2020 at 7:59 p.m. from the number *** PHONE. 4. One minute and twenty second call made on September 18, 2020 at 4:35 p.m. from the number *** PHONE. 4. According to the information obtained from the Registry of Numbering and Operators of Telecommunications of the National Commission of Markets and Competition: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/12 - The telecommunications operator that manages the telephone numbers *** PHONE 8 and *** PHONE 7 is the one claimed. - The telecommunications operator that manages the phone number *** PHONE. 4 is ONO. The claimed, dated December 3, 2020 (written with registration number of entry in the AEPD O00007128e2000013303), has provided the following information in relation to the numbers *** TELEPHONE.8 and *** TELEPHONE.7: - The number *** PHONE. 8 as of January 24, 2020 did not appear assigned to any client or user of the claimed. - The number *** TELEPHONE. 7 corresponds to an internal Vodafone number assigned to Customer Service. - Calls made from the number do not appear in their systems *** PHONE. 7 to the claimant's lines (*** PHONE. 1, *** PHONE. 2, and *** PHONE. 3) during the 14th, 15th, 16th, and 17th of September 2020 between 3:00 p.m. and 6:00 p.m. On the other hand, ONO, dated March 4, 2021 (written with registration number of entry in the AEPD O00007128e2100009682), has provided the following information in relation to the number *** PHONE. 4: - The holder of the number *** TELÉFONO.4 is: “CABLEUROPA, S.L., with C.I.F. A62186556 ". - Calls made from the number do not appear in their systems *** PHONE. 4 to the claimant's lines (*** PHONE. 1, *** PHONE. 2, and *** PHONE. 3) during the 15th, 16th, 17th, and 18th of September 2020 between 3:00 p.m. and 9:00 p.m. THIRD: By Agreement dated May 20, 2021, the Director of the Spanish Data Protection Agency agreed to initiate a sanctioning procedure at the claimed for the alleged violation of Article 48.1.b) of the LGT of Law 9/2014, of May 9, General of Telecommunications (hereinafter LGT). The facts exposed could imply a violation of Article 48.1.b) of the LGT, typified in the Article 77.37 of the LGT (serious offense), which may be sanctioned with a fine of up to 50,000 euros, in accordance with article 79.1.d) of the same LGT. FOURTH: The investigated company (ONO) presented allegations to the initiation agreement of sanctioning procedure, in the following terms: 1. The calls were made due to a mere error in filtering with the list Robinson, so in October 2020 a new filtering excluding claimant numbering. Provides a list of numbering in <Document 1> which does not include the numbering of the claimant. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/12 1. Although it is acknowledged that the calls were made, ONO does not consider your classification as serious. 2. Disagreement with the application of the aggravating factor of article 80.1.a) of the LGT, by motivating him in a generic way. 3. Disagreement with the application of the aggravating factor of article 80.1.c) of the LGT, to the not having reported any benefit to the company for the alleged infringement. 4. Disagreement with the application of the aggravating factor of article 80.1.g) of the LGT, considering that the activity ceased and the specific error was corrected in October 2020, as evidenced by <Document 1> provided. FIFTH: On 06/07/2021, ONO contributed <Document 1> for its incorporation as documentary evidence to the file. As the Second Antecedent of this Proposal for Resolution, said document has been incorporated into the proceedings. SEVENTH: Of the actions carried out in this procedure, it has remained accredited the following: PROVEN FACTS FIRST: On 09/04/2019, the claimant exercised before ONO the right to opposition to commercial calls on two lines owned by you (*** PHONE. 1 and *** PHONE. 2). On 09/18/2019, the claimant insists ONO by mail email that continues to receive business calls on behalf of ONO. SECOND: On 09/25/2019, the claimant added her opposition to calls her line *** PHONE. 3. THIRD: On 01/13/2020, ONO answers the claimant that it has been included their lines in the internal advertising exclusion list. FOURTH: On 09/17/2020 the claimant receives a commercial call at ONO name at 16:30. On 09/18/2020 the claimant receives a call commercial on behalf of ONO at 4:35 p.m., and another missed call on 09/17/2020 at 19:59. FIFTH: ONO recognizes calls made on its behalf. FOUNDATIONS OF LAW I In accordance with the provisions of article 84.3) of the LGT, the competence to initiate and resolve this Penalty Procedure corresponds to the Director of the Spanish Agency for Data Protection. II C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/12 Regarding the allegations made by the data controller (ONO), it is means the following: 1. The calls were made due to a mere error in filtering with the list Robinson, so in October 2020 a new filtered excluding the claimant's numbering. Provides a list of numbering in <Document 1> which does not include the numbering of the claimant. In the present case, there are successive calls (three accredited) after the exercise on two previous occasions of the right of opposition and deletion and that it was attended by ONO on 01/13/2020 incorporating the internal exclusion list advertising, which undoubtedly excludes that it was not caused by an error punctual but due to a regular and continued improper practice. 1. Although it is acknowledged that the calls were made, ONO does not consider your classification as serious. The investigated and accredited facts converge on the fact that we are faced with a conduct classified as serious. In this sense, it should be noted that there is recklessness when a legal duty of care and the offender does not behave with the required diligence, to what must be added that the element of enforceability of a different conduct consists of the capacity of the obligated subject to act differently and therefore Therefore, in accordance with the legal system. In the present case, ONO has not been set to the legal system and this lack of diligence constitutes the applicable type of guilt in the behavior now analyzed. 2. Disagreement with the application of the aggravating circumstance of article 80.1.a) of the LGT, by motivating it in a generic way. In this regard, it means that in the same period of time this AEPD accredited, between others, the same behaviors. It is enough to bring up the Annex of PS / 00059/2020, now known to ONO. 3. Disagreement with the application of the aggravating factor of article 80.1.c) of the LGT, as the alleged infringement has not reported any benefit to the company. There is no doubt that the marketing action carried out by ONO now imputed, corresponds to the profit motive of the entity. This is not an obstacle to that, assuming the cost / benefit risk, may result in a specific case unfavorable. In this regard, the serious conduct charged is part of the insistence on their misconduct as a result of deficiencies in the organizational and / or technical measures implemented, with absolute omission of the due diligence and profit motive. It is worth mentioning the provisions of article 29.2 of Law 40/2015, of 1/10, on the Legal Regime of the Public Sector. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 12/8 4. Disagreement with the application of the aggravating factor of article 80.1.g) of the LGT, considering that the activity ceased and the specific error was corrected in October 2020, as evidenced by <Document 1> provided. It should be noted that the document provided by ONO (Document 1) as the basis for prove the elimination of the call list the claimant's line lacks evidentiary interest, both for its lack of authenticity and for its impossibility of traceability from its origin. Consequently, the allegations must be rejected. II The art. 17.1.c) of the RGPD, states the following: << Article 17 Right to erasure ("the right to be forgotten") 1. The interested party shall have the right to obtain without undue delay from the person responsible for the treatment the deletion of personal data that concerns you, which will be obliged to delete without undue delay the personal data when there is any of the following circumstances: (…) c) the interested party opposes the treatment in accordance with article 21, paragraph 1, and does not other legitimate reasons for the treatment prevail, or the interested party opposes the treatment in accordance with Article 21 (2); (…) >> Article 21.2 of the RGPD states the following: << Article 21 Right of opposition (...) 2. When the purpose of the processing of personal data is marketing direct, the interested party will have the right to object at any time to the treatment of personal data concerning you, including profiling in the insofar as it is related to the aforementioned marketing >>. III Of the documentation in the file as a result of that provided by the claimant, the investigated ONO and the previous investigations carried out by this AEPD, It appears that the line of the claimed was included in the list of Robinson call exclusion from Adigital from 02/13/2020, eight months before the date of receipt of the calls now subject to claim. In the In the same sense, it also appears that it was included in the internal exclusion list of the claimed from the date 9/9/2019, as a consequence of the exercise of the right was deleted from September 2019 and appears as attended on 01/13/2020. Regarding ONO's communications to the claimant, it has been verified by the Claimant's operator receiving calls. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 9/12 IV The known facts could be constitutive of an infraction, attributable to the claimed, for violation of article 48.1.b) of Law 9/2014, of May 9, General of Telecommunications (hereinafter, LGT), included in its Title III, which notes the following: "Article 48. Right to the protection of personal data and privacy in relation to with unsolicited communications, with traffic and location data and with subscriber guides. 1. Regarding the protection of personal data and privacy in relation to unsolicited communications end users of communications services electronic companies will have the following rights: (…) b) To oppose receiving unwanted calls for commercial communication purposes that are carried out through systems other than those established in the previous letter and to be informed of this right. " The offense is classified as serious in article 77.37 of said rule, which considers as such: "The serious violation of the rights of consumers and users final, as established in Title III of the Law and its implementing regulations ”. This infraction can be sanctioned with a fine of up to 2,000,000 euros, according to with article 79.1.c) of the aforementioned LGT. In accordance with the evidence available, the sanction should be graduated to be imposed in accordance with the following criteria established in article 80 of the LGT: As aggravating factors: a) The seriousness of the offenses previously committed by the subject to whom the sanctions. This AEPD consists of numerous previous antecedents known to OR NOT. c) The benefit that has been reported to the offender by the fact that is the subject of the offense. The promotional actions are aimed at obtaining profits business, both directly and indirectly. d) The damage caused and its repair. The claimant exercised the right of deletion who was allegedly treated and, however, has had to take action before this AEPD as a consequence of the repetition in time of the calls not desired. There are no remedial actions by VDF. g) The cessation of the infringing activity, previously or during the processing of the sanctioning file. There is no evidence of the cessation of the infringing activity. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 10/12 In view of the above, the following is issued MOTION FOR A RESOLUTION That the Director of the Spanish Data Protection Agency sanctions VODAFONE ONO, S.A.U. with CIF A62186556, with a fine of € 100,000 (one hundred thousand euros) for the violation of Article 48.1.b) of the LGT, classified as serious in the Article 77.37 of the LGT. Likewise, in accordance with the provisions of article 85.2 of the LPACAP, informs that you may, at any time prior to the resolution of this procedure, carry out the voluntary payment of the proposed sanction, which It will mean a reduction of 20% of the amount of the same. With the application of this reduction, the penalty would be set at € 80,000 eighty thousand euros) and its payment will imply the termination of the procedure. The effectiveness of this reduction will be conditioned to the withdrawal or resignation of any action or remedy in administrative against the sanction. In case you choose to proceed to the voluntary payment of the specified amount above, in accordance with the provisions of the aforementioned article 85.2, you must do it effective by entering the restricted account number ES00 0000 0000 0000 0000 0000 opened in the name of the Spanish Agency for Data Protection in the entity banking CAIXABANK, S.A., indicating in the concept the reference number of the procedure that appears in the heading of this document and the cause, for voluntary payment, reduction of the amount of the penalty. Likewise, you must send the proof of entry to the General Inspection Subdirectorate to proceed to close The file. By virtue of this, you are notified of the foregoing, and the procedure is revealed so that within ONE MONTH you can claim whatever you consider in your defense and present the documents and information it deems pertinent, in accordance with Article 89.2 of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations, in relation to article 84.4 of the LGT. 813-151020 Manuel Garcia Prieto INSPECTOR / INSTRUCTOR >> SECOND: On July 20, 2021, the claimed party has proceeded to pay the penalty in the amount of 80,000 euros making use of the reduction foreseen in the proposed resolution transcribed above. THIRD: The payment made entails the waiver of any action or recourse in progress. administrative against the sanction, in relation to the facts to which the motion for resolution. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 11/12 FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and as established in art. 47 of Organic Law 3/2018, of 5 of December, Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection is competent to sanction the infractions that are committed against said Regulation; infractions of article 48 of Law 9/2014, of May 9, General of Telecommunications (hereinafter LGT), in accordance with the provisions of the article 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and 38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of the information and electronic commerce (hereinafter LSSI), as provided in article 43.1 of said Law. II Article 85 of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations (hereinafter LPACAP), under the rubric "Termination of sanctioning procedures" provides the following: "1. Initiated a sanctioning procedure, if the offender acknowledges his responsibility, the procedure may be resolved with the imposition of the appropriate sanction. 2. When the sanction is solely of a pecuniary nature or it is possible to impose a pecuniary sanction and other non-pecuniary sanction but the inadmissibility of the second, the voluntary payment by the presumed responsible, in any time prior to the resolution, will imply the termination of the procedure, except in relation to the replacement of the altered situation or to the determination of the compensation for damages caused by the commission of the offense. 3. In both cases, when the sanction is solely of a pecuniary nature, the competent body to resolve the procedure will apply reductions of, at least, 20% on the amount of the proposed sanction, these being cumulative among themselves. The aforementioned reductions must be determined in the notice of initiation of the procedure and its effectiveness will be conditional on the withdrawal or resignation of any action or appeal in administrative proceedings against the sanction. The percentage of reduction foreseen in this section may be increased regulations. " In accordance with the above, the Director of the Spanish Agency for the Protection of Data RESOLVES: FIRST: DECLARE the termination of procedure PS / 00223/2021, of in accordance with the provisions of article 85 of the LPACAP. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 12/12 SECOND: NOTIFY this resolution to VODAFONE ONO, S.A.U .. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure as prescribed by the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations, interested parties may file an appeal administrative litigation before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following notification of this act, as provided in article 46.1 of the referred Law. 968-160721 Mar Spain Martí Director of the Spanish Agency for Data Protection 28001 - Madrid 6 sedeagpd.gob.es