AEPD (Spain) - PS/00258/2020
|AEPD (Spain) - PS/00258/2020|
|Relevant Law:||Article 21 GDPR|
Article 48(1)(b) Telecommunications Act
|Parties:||AUDAX RENOVABLES, S.A.|
|National Case Number/Name:||PS/00258/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish DPA (AEPD) fined an energy company €12,000 for making marketing calls to a data subject that had signed up to a Robinson List.
English Summary[edit | edit source]
Facts[edit | edit source]
A data subject lodged a complaint with the Spanish DPA (AEPD) against an energy company. The company had called them for commercial reasons, despite the data subject having signed up for the Robinson List a few months before. A Robinson List is an opt-out list for people who do not wish to receive marketing communications.
Holding[edit | edit source]
The AEPD remarked that the Spanish Telecommunications Act (LGT) forbids, in its Article 48(1)(b), commercial communications when the subject has opposed to them. The DPA also related this prohibition to Article 21 GDPR, which gives the data subject the right to oppose to the processing of their personal data.
The controller alleged that the LGT was not applicable to the case, since the main activity of the energy company is not related to telecommunications. However, the DPA argued that Article 48(1)(b) GDPR is applicable to commercial communications, regardless of the main activity of the company that carries out such communications.
Therefore, the AEPD concluded that the controller had ignored the right to oppose to the processing of the data subject, exercised via the inclusion in the Robinson List, and therefore violated Article 48(1)(b) GDPR. The DPA fined the controller €12,000.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/8 Procedure No. PS / 00258/2020 RESOLUTION OF SANCTIONING PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following: BACKGROUND FIRST: D. A.A.A. (hereinafter, the claimant) dated May 16, 2020 filed a claim with the Spanish Data Protection Agency. The claim is directed against AUDAX RENOVABLES, S.A. with CIF A62338827 (in forward, the claimed one). The reasons on which the claim is based are the following: "Yesterday, 05/15/2020 at 12:39 I received a call to my mobile phone *** PHONE 1 of the number *** PHONE 2 of a person named B.B.B. So what Call on behalf of Audax to offer me a discount on my electricity bill. I explain that I have not asked for any information or discount at any time and that I have been on the Robinson List for years, of which he tells me he does not know what it is or what it is for. It is already the third call that I receive from them in one month. I ask you for information about where they got my number and name and I He says that from a list that has been passed to him. I orally request that I do not want more information and that they do not call me again like the other two calls previous, but these continue to occur. […] " Along with the claim, provide the following documents: 1. Invoice stating that the mobile number where the call was received is contracted on behalf of the claimant. 2. Screenshots of the Robinson List service where the mobile number where the call was received and where you have also opposed the sending advertising in other sections such as the sanctioned entity. Has been marked among others, the section on “Energy and water: products related to electricity, hydrocarbons, gas and water ”, as the type of company to be blocked. SECOND: In view of the facts denounced in the claim and the documents provided by the claimant, the Subdirectorate General for Inspection of Data proceeded to transfer the claim in accordance with the provisions in article 65.4 of Organic Law 3/2018, of December 5, on the Protection of C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 2/8 Personal Data and guarantee of digital rights (hereinafter LOPDGDD). This transfer was notified on June 9, 2020. THIRD: The Director of the Spanish Data Protection Agency admitted to processing the claim by agreement of August 12, 2020. FOURTH: By Agreement dated November 5, 2020, the Director of the Spanish Data Protection Agency agreed to initiate a sanctioning procedure at the claimed for the alleged violation of Article 48.1.b) of the LGT of Law 9/2014, of May 9, General of Telecommunications (hereinafter LGT), typified in the Article 78.11 of the aforementioned rule, and that the sanction that may correspond to it would be of 12,000 euros, without prejudice to what results from the instruction. FIFTH: The defendant presented allegations to the agreement to initiate the procedure sanctioner on December 10, 2020, stating that he did not carry out any call the claimant and that they do not have any personal data of the claimant in their database. It adds that the call to the claimant was made by an external commercial agent, who has commercial relationship with the claimed and that they have communicated in writing to the agent commercial that the claimant does not wish to receive advertising calls and he confirms that has proceeded to delete your data. Attach as document number 2 a copy of the certificate issued by the indicated agent comercial, Fundraising F2F, S.L., certifying the deletion of the data of the claimant. Likewise, it states that it is engaged in an activity different from that regulated by the LGT, since it does not operate telecommunication networks, nor does it provide electronic communications, but is dedicated to acquiring energy for sale to the final consumer. On the other hand, it indicates that in the documentation of this sanctioning procedure identifies with date and time a single call made to the claimant, although it is not provides documentary accreditation of it, not even a screenshot and for Therefore, the call cannot be included in the infraction included in the article 48.1.b) of the LGT. Likewise, they indicate that the claimant does not certify that he is enrolled in the List Robinson. SIXTH: On February 11, 2021, the instructor of the procedure agreed to the opening of a period of practical tests, taking as incorporated the preliminary investigation actions, E / 04031/2020, as well as the documents provided by the claimed and the claimant. By Agreement dated May 13, 2021, the Director of the Spanish Agency of Data Protection agreed to change the Instructor of this procedure sanctioner, notified to the defendant on the 14th of the same month and year. C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 3/8 SEVENTH: On May 26, 2021, the examining body issued a Proposal for Resolution in the following terms: <That the Director of the Spanish Data Protection Agency sanctions AUDAX RENOVABLES, S.A. with CIF A62338827, with a fine of € 12,000 (twelve thousand euros) for the violation of article 48.1.b) of the LGT Law classified as “mild” in the article 78.11) of the aforementioned LGT Law in relation to article 21 of the RGPD, and the Article 23.4 of the LOPDGDD>. EIGHTH: On June 9, 2021, the defendant presented allegations to the Proposed Resolution: 1.- It is reiterated in the absence of participation and guilt the facts that are the object of sanction. 2.- It indicates that the defendant is a company that sells electricity and gas, not a telecommunications company and, as such, is not part of the subjective scope of the LGT. 3.- The file of the sanctioning procedure is agreed without imposition of sanction some. PROVEN FACTS FIRST: The claimant submitted to this AEPD on May 16, 2020, a claim against the defendant for telephone calls, the last one dated 15 May 2020 from the line *** TELEPHONE 2, from advertising content to your number line (*** PHONE. 1) despite being included in the exclusion list adigital's robinson advertising since March 16, 2010. SECOND: It consists in the invoice procedure where the mobile number appears where the call has been received and is contracted on behalf of the claimant. THIRD: The claimant certifies that he is included in the exclusion list ADigital's robinson advertisement since March 16, 2010, where the number mobile phone where the call was received and also the section relative to “Energy and water: products related to electricity, hydrocarbons, gas and water ”, as the type of company to be blocked. FOURTH: The claimed person is responsible for the treatment now analyzed when carrying out effect of the advertising calls to the claimant when the calling entity acts as a of the person in charge of the treatment in the name on behalf of the determines ownership and means. This is proven in this procedure. FIFTH: The defendant learned of the claim through this AEPD due to the request for information dated June 9, 2020 and dated June 9, December 2020 has proceeded to delete the claimant's data from its database data. C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 4/8 SIXTH: There is no evidence of the implementation of corrective measures for filtering with the Robinson Adigital listing nor has provided, after the request of this AEPD, communication with the claimant about the steps taken regarding the claim in order to minimize the impact on the claimant, despite knowing the contact details of the claimant through the transfer of the claim for this AEPD on June 9, 2020. FOUNDATIONS OF LAW I In accordance with the provisions of article 84.3) of the LGT, the competence to initiate and resolve this Penalty Procedure corresponds to the Director of the Spanish Agency for Data Protection. II Regarding the allegations presented by the person responsible for the claim, it is necessary to note the following: It is proven before this AEPD that the treatment now analyzed by the aforementioned entity is carried out in the name and on behalf of the claimed party, the latter acting in quality of person in charge when defining the purpose and means. In this regard, the very claimed brings up that the call to the claimant was made by a commercial agent external, which has a commercial relationship with the claimed and which they have communicated by written to the commercial agent that the claimant does not wish to receive advertising calls and This confirms that it has proceeded to delete your data. From the allegation itself it is inferred that the complained party is responsible for the treatment now analyzed, since the defendant confirms that he is the one who facilitates the instructions for the treatment that is entrusted to the entities that use their own databases on purpose and means. The defendant adds that the LGT is not applicable to him, as it is a company that is dedicated to acquire energy for sale to the final consumer. Well, the scope of the LGT is telephone calls as in the present case, regardless of the subject who carried them out. Consequently, the LGT is fully applicable to the defendant. Article 48.1.b) of Law 9/2014, of May 9, General Telecommunications which indicates that the final consumer b) To oppose receiving unwanted calls with commercial communication purposes that are carried out through systems other than those established in the previous letter and to be informed of this right. ". Therefore, there is no doubt, given the regulation, that the claimant (final consumer) received a call on May 15, 2020 from line *** TELEPHONE. 2, from advertising content to your line number (*** PHONE. 1) despite being included C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 5/8 on ADigital's robinson advertising exclusion list since March 16, 2010. On the other hand, the defendant states that in the documentation of this sanctioning procedure a single call made is identified with date and time to the claimant, although no documentary proof of it is provided, not even a screenshot and thus makes the call unable to be framed in the infringement contained in article 48.1.b) of the LGT. As has been indicated, the claimant has provided screenshots of the Robinson List service where the mobile number is included where it has been received the call and where the section relating to “Energy and water: products related to electricity, hydrocarbons, gas and water ”, such as type of company to be blocked, and also accredits the call received. Consequently, the allegations must be rejected. III Article 21 of the General Data Protection Regulation 2016/679, hereinafter RGPD), regarding the right of opposition, states the following: "1. The interested party will have the right to object at any time, for reasons related to your particular situation, what personal data concerning you are subject to a treatment based on the provisions of Article 6 (1), letters e) or f), including profiling based on these provisions. The data controller will stop processing personal data, unless prove compelling legitimate reasons for the treatment that prevail over the interests, rights and freedoms of the interested party, or for the formulation, the exercise or defense of claims. 2. When the purpose of the processing of personal data is marketing direct, the interested party will have the right to object at any time to the treatment of personal data concerning you, including profiling in the insofar as it is related to the aforementioned marketing. 3. When the interested party opposes the treatment for direct marketing purposes, personal data will no longer be processed for these purposes. 4. At the latest at the time of the first communication with the interested party, the right indicated in sections 1 and 2 will be explicitly mentioned to the interested party and it will be presented clearly and apart from any other information. 5. In the context of the use of information society services, and not Notwithstanding the provisions of Directive 2002/58 / EC, the interested party may exercise his right to object by automated means that apply specifications techniques. 6. When personal data is processed for scientific research or historical or statistical purposes in accordance with Article 89 (1), the The interested party will have the right, for reasons related to their particular situation, to C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 6/8 oppose the processing of personal data concerning you, unless it is necessary for the fulfillment of a mission carried out for reasons of interest public". IV Article 48.1.b) of Law 9/2014, of May 9, General Telecommunications (in hereinafter, LGT), included in its Title III, which indicates the following: "Article 48. Right to the protection of personal data and privacy in relation to with unsolicited communications, with traffic and location data and with subscriber guides. 1. Regarding the protection of personal data and privacy in relation to unsolicited communications end users of communications services electronic companies will have the following rights: (…) b) To oppose receiving unwanted calls for commercial communication purposes that are carried out through systems other than those established in the previous letter and to be informed of this right. " The offense is classified as minor in article 78.11 of the LGT, which considers as such “The breach of public service obligations, of the obligations of public nature and the violation of consumers and end users, as established in Title III of the Law, its implementing regulations ”. This infraction can be sanctioned with a fine of up to 50,000 euros, according to with article 79.1.d) of the aforementioned LGT. V In the present case, it is proven that the defendant is responsible for the treatment carried out by the person in charge indicated whenever acting on behalf of and for account of the claimed and this decides on the purpose and means of the treatment. It also appears that on behalf of the claimed person, the aforementioned data processor I make a phone call to the claimant. According to the available evidence, it is considered that it proceeds graduate the sanction to be imposed according to the following criteria established by the Article 80.1) and 2) of the LGT: - The low social impact of the offense (article 80.1b) of the LGT). - The consideration of the financial situation of the offender (article 80.2 of the LGT). In view of the above, the following is issued C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 7/8 Considering the aforementioned precepts and others of general application, the Director of the Agency Spanish Data Protection RESOLVES: FIRST: IMPOSE AUDAX RENOVABLES, S.A., with CIF A62338827, for a violation of Article 48.1.b) of the LGT, typified in Article 78.11 of the LGT (minor offense), a fine of 12,000 euros (twelve thousand euros). SECOND: NOTIFY this resolution to AUDAX RENOVABLES, S.A. THIRD: Warn the sanctioned person that the sanction imposed must be effective once this resolution is enforceable, in accordance with the provisions of the Article 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations, within the voluntary payment period indicated in the Article 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17 December, by entering the restricted account number ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Agency for Data Protection in the entity banking CAIXABANK, S.A. or otherwise, it will be collected in executive period. Received the notification and once executive, if the date of execution is found Between the 1st and the 15th of each month, both inclusive, the deadline for making the payment volunteer will be until the 20th of the following or immediately subsequent business month, and if between the 16th and the last day of each month, both inclusive, the payment term it will be until the 5th of the second following or immediately subsequent business month. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to administrative proceedings (article 48.6 of the LOPDGDD), and in accordance with the provisions of articles 112 and 123 of the Law 39/2015, of October 1, of the Common Administrative Procedure of the Public Administrations, the interested parties may file, optionally, appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month from the day following notification of this resolution or directly administrative contentious appeal before the Chamber of Contentious-administrative of the National Court, in accordance with the provisions of the Article 25 and in section 5 of the fourth additional provision of Law 29/1998, of July 13, regulator of the Contentious-administrative Jurisdiction, within the period of two months from the day following the notification of this act, as provided for in article 46.1 of the aforementioned legal text. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of Law 39/2015, of October 1, of the Common Administrative Procedure of the Administrations Public, the final resolution may be suspended provisionally through administrative channels if the interested party expresses his intention to file a contentious-administrative appeal. If this is the case, the interested party must formally communicate this fact through writing addressed to the Spanish Agency for Data Protection, presenting it through of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica- web /], or through any of the other records provided for in art. 16.4 of the C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 8/8 cited Law 39/2015, of October 1. You must also transfer to the Agency the documentation that proves the effective filing of the contentious appeal- administrative. If the Agency is not aware of the filing of the appeal contentious-administrative within a period of two months from the day following the notification of this resolution would terminate the precautionary suspension. 815-141020 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es