AEPD (Spain) - PS/00273/2021
|AEPD (Spain) - PS/00273/2021|
Article 48(1)(b) LGT
Article 23 LOPDGDD
|Parties:||OASIP SERVICIO INTEGRAL DE COMUNICACIONES S.L.|
|National Case Number/Name:||PS/00273/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||Carmen Villarroel|
The Spanish DPA fined a controller acting on behalf of Vodafone €20,000 for making unsolicited commercial calls to a data subject. The controller failed to adequately check phone numbers against a list of users who did not wish to receive calls.
English Summary[edit | edit source]
Facts[edit | edit source]
A data subject filed a complaint with the Spanish DPA (AEPD) for receiving unsolicited commercial calls on behalf of Vodafone. The complainant was registered on the Robinson list, an advertising exclusion system regulated in Article 23 of the Spanish Data Protection Act (LOPDGDD).
The calls were carried out by the subcontractor Oasip on behalf of Vodafone. The agreement between both companies included the obligation of filtering the list of numbers against the Robinson list, to avoid making calls to the people registered.
Holding[edit | edit source]
The AEPD hold that Oasip is a controller and considered them aware of the problem with filtering the phone-numbers, since it happened seven times in two months without them implementing necessary measures to prevent it from happening again.
The DPA concluded that the company acted for their own benefit, and held them responsible of the infringement. Therefore, and since sending unsolicited commercial communications is forbidden by Article 48(1)(b) of the Spanish Telecommunications Act (LGT) the DPA fined the controller €20,000.
The DPA also noted that it would initiate a different investigation into Vodaphone in relation to the same events, in order to determine whether Vodaphone had acted appropriately.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/25 Procedure No. PS / 00273/2021 RESOLUTION OF SANCTIONING PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: A.A.A. (hereinafter, the claimant), dated July 29, 2020, filed a claim with the Spanish Data Protection Agency (number of check-in 026921/2020) for the reception of commercial calls not desired on behalf of VODAFONE ESPAÑA, S.A.U. (hereinafter, claimed), in the following terms: - The telephone number where calls are received, *** TELEPHONE 1, is is registered in the advertising exclusion system responsibility of the Spanish Association of the Digital Economy (hereinafter Robinson list). - On June 19, 2020, he received two calls, at 1:53 p.m. and 3:21 p.m. hours, from the telephone number *** TELEPHONE. 2. On the same date, at 2:22 p.m., he received another call from the phone number *** PHONE. 3. - On July 21, 2020, he received a call, at 3:49 p.m., from the telephone number *** TELEPHONE. 2. On the same date, at 18:38 hours, received another call from the phone number *** PHONE. 3. - On June 20, 2020, he received two calls, at 3:21 p.m. and 6:58 p.m. hours, from the telephone number *** TELEPHONE. 2. - On July 15, 2020, he received two calls, at 3:53 p.m. and 4:40 p.m. hours, from the telephone number *** TELEPHONE. 2. - On July 21, 2020, he received a call, at 3:49 p.m., from the telephone number *** TELEPHONE. 2. Relevant documentation provided by the claimant: - "Contract form for Orange market services Residential ”dated October 2, 2012 in which it is linked to the claimant's phone number *** PHONE. 1. - Certificate dated June 22, 2020 in which "the List Service Robinson ”states, among other issues, that the telephone number *** TELEPHONE. 1 assigned to the claimant is registered in the section corresponding to the telephone channel since January 16, 2020. C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 2/25 SECOND: In view of the facts denounced in the claim and the documents provided by the claimant / of the facts and documents of which he has this Agency, the Subdirectorate General for Data Inspection, has come to know proceeded to carry out preliminary investigation actions for the clarification of the facts in question, by virtue of the powers of investigation granted to the control authorities in article 57.1 of the Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD), and of in accordance with the provisions of Title VII, Chapter I, Second Section, of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). As a result of the investigative actions carried out, it is verified that the responsible for the treatment is the claimed one. BACKGROUND Claim entry date: July 29, 2020. Claimant: A.A.A. Claimed: VODAFONE ESPAÑA, S.A.U. Facts according to the claims of the claimant: The antecedents that appear in the information systems are the following: In the framework of procedure E / 06811/2020, dated September 7, 2020, the AEPD, by virtue of article 65.4 of Organic Law 3/2018, of December 5, of Protection of Personal Data and guarantee of digital rights, gave transfer of the claim to the defendant. This one, in response of October 9, 2020 (number of entry record in the AEPD O00007128e2000005586) stated, with respect to the Claimant's telephone line that “[…] was listed on the official Robinson list ADigital since June 19, 2018. However, it has been verified that was not registered on Vodafone's internal Robinson list, having been registered on September 9, 2020, as a result of the entry of this claim. ”. In addition, in relation to the calling numbers, it states that “we have verified that some of the lines of origin of the received calls are associated with the following collaborator: Casmar […] this collaborator does not discuss the bases of data provided by Vodafone, but use their own databases ”. He adds that this situation "has led them to immediately begin to consider solutions and measures to be applied in relation to this collaborator, in order to avoid unwanted calls continue to occur. […] Have been implemented since January 2020 the following actions: - Force all collaborators door to door by contract to emit calls from Vodafone numbers through a Voice IP operator made available to you by Vodafone. In this way, through the system of dialing, you can filter with Robinson lists the databases of C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 3/25 campaign recipients. This is so because the databases used for acquisition are owned by the collaborator and since Vodafone does not provide them with databases, we understand that it is the best solution to ensure filtering. We attach as a single document the communication sent to our door to door collaborators reiterating their data protection obligations and privacy and urging them to review their data processing processes at name of Vodafone in order that they comply with all the requirements of current regulations on the protection of personal data, such and as regulated in the contract signed with Vodafone and in the processes and current working procedures between both entities. - Since all sales made by these door to door collaborators door are audited by a supplier outside these collaborators, it has been worked on carrying out a development so that sales can be compared in the systems, rejecting those that have not been made through the operator of Voice and therefore there is no certainty that it meets the requirements of filtered out. In this way, it could not be the case that sales arrived for load into our systems, which come from calls that have not been made from the Vodafone numbers. This way it can be ensured that all traffic is controlled and complies with the requirements dictated by Vodafone, discouraging the use of numbers not authorized by Vodafone and, for Therefore, the previous non-filtering with the advertising exclusion lists. Likewise, on September 17, 2019 we met in person with the responsible for three distributors of the door to door channel: Casmar, Three Quartets and Solivesa, to reiterate the obligations that correspond to them when they perform pick-up calls in the name of Vodafone, even if the databases are yours. In addition, the objective of said meeting was to obtain commitments for their part of improvement of its controls and processes to ensure that cases such as those that constitute this complaint will not happen again in the future. " The defendant has attached to the letter a copy of an email sent on 30 July 2019 to collaborators in which he urges them to review their processes, transfer the obligations to your staff and verify that the data processing performed on behalf of the claimed person "complies with current regulations, with the contract signed between both parties, and with the processes and procedures of current work between our companies ”. The statement specifies the following: "On this occasion and with this statement we want to make special focus on the possible calls that they may be making to potential clients for the purpose of recruitment and remind you of the obligations that must be strictly adhered to in your execution: A) In the event that they process databases of potential customers that Vodafone facilitates directly must: - Use them during the stipulated time and exclusively for the campaign indicated. These databases are previously filtered by Vodafone both with the internal Robinson database as well as the Robinson database of C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 4/25 ADigital in order to ensure that none of the potential clients have communicated your wish not to receive commercial calls or messages. Yes later these databases are used in future campaigns, these they may be out of date and pose a high risk of penalties. B) On the other hand, if they make calls using their own databases data, not provided by Vodafone, you must ensure that: - That they have the prior and express approval of Vodafone to carry out said calls. - That they have the data in a lawful way, informing and obtaining the consent of the holders to be able to carry out commercial actions in Vodafone name. We remind you that the use of databases is prohibited. data for capture purposes on behalf of Vodafone that do not comply with this requirement. - Filter your databases with public Robinson lists, for example, the managed by ADigital, prior to the start of the campaign. - Do not use means of communication that have not been consented to by the campaign recipients. In both scenarios, it is essential that the collaborator: - Provide a simple means for any recipient of the campaign can communicate their willingness not to continue receiving calls or commercial messages on behalf of Vodafone. - Immediately transfer the data of those recipients to Vodafone that they have been informed that they do not wish to receive further communications commercials and ensure that they do not contact them again in future emissions. - In the case of telephone contact, scrupulously comply with the current regulations on consumer rights, and in particular, make calls: within the legally permitted hours (Monday to Friday working days, from 9:00 a.m. to 9:00 p.m.). from an identifiable number. identifying the call as commercial in nature. Additionally, we remind you that you must comply with each and every one of the obligations that correspond to you as processors according to the European Regulation 2016/679 (RGPD) and that have been transferred to you by Vodafone contractually. Finally, it is important that you provide us, if you have not already done so, in a immediate all the numbers through which they make calls to customers and C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 5/25 potential clients since from Vodafone we are creating a database identifying each collaborator with the telephone numbers associated with it. Vodafone cannot maintain its contractual relationship with those collaborators who do not strictly comply with these obligations, so we also We reserve the possibility of auditing, at any time, the performance of the data processing activities that collaborators carry out on their behalf, in order to to verify strict compliance with these requirements. Likewise, Vodafone reserves the right to take any legal actions that correspond to it in the case receiving any type of sanction from the Spanish Agency for the Protection of Data or direct claims of the recipients if they cause the breach of the obligations of a Vodafone collaborator ”. PARTICIPANTS In addition to complaining and complaining, the following have intervened in these proceedings: - CASMAR TELECOM S.L. (hereinafter Casmar) - COLT TECHNOLOGY SERVICES S.A. (hereinafter Colt) - OASIP SERVICIO INTEGRAL DE COMUNICACIONES S.L. (onwards Oasip) - INSURANCE BROKER COMPARATOR RASTREATOR (hereinafter Tracker) - RYV CALL CONECTION E.I.R.L. (hereinafter Ryv) - THREE-QUARTERS FULL S.L. (hereinafter ThreeQ) RESULT OF RESEARCH ACTIONS According to the information obtained from the Registry of Numbering and Operators of Telecommunications of the National Commission of Markets and Competition Calling phone numbers *** PHONE.2 and *** PHONE.3 are found assigned to the telecommunications operator Colt. In relation to the originating telephone number *** TELEPHONE.2 and the calls subject to claim, the following information has been obtained: - Colt informs, dated March 11, 2021 (written with number of entry record in the AEPD O00007128e2100011184), of the following: The ownership of the telephone number *** TELEPHONE. 2 corresponds to Oasip. Confirms the completion, on June 20, 2020, of four phone calls from *** PHONE. 2 to *** PHONE. 1 between 7:00 p.m. and 7:02 p.m. Confirms the completion, on July 15, 2020, of a phone call from *** PHONE. 2 to *** PHONE. 1 at 15:50 hours. Indicates that there are no calls from the number *** TELEPHONE.2 to *** TELEPHONE.1 on June 9 and July 21, 2020. C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 6/25 - Oasip informs, dated March 16, 2021 (written with number of entry record in the AEPD O00007128e2100011983), of the following: Oasip is a provider of telephone lines to clients. Oasip's professional activities do not include that of carry out "telephone promotion campaigns or similar services". On February 6, 2010, Oasip signed an assignment contract and transfer of telephone lines and virtual switchboard with the client with Casmar. Between the telephone lines assigned and assigned to Casmar as part of the contract you will find the telephone number *** TELEPHONE. 2. Indicates that there are no calls from the number *** TELEPHONE. 2 to *** PHONE. 1 on June 9, 2020. Confirms the realization, on June 19, 2020, of a call from *** TELEPHONE.2 to *** TELEPHONE.1 at 3:21 p.m. 62 seconds long. Confirms the realization, on July 15, 2020, of two calls from *** TELEPHONE.2 to *** TELEPHONE.1 at 3:23 p.m. and 4:40 p.m. 9-second hours. Confirm the realization, on July 21, 2020, of a call from *** TELEPHONE.2 to *** TELEPHONE.1 at 3:49 PM 48 seconds long. - Casmar informs, dated May 4, 2021 (written with number of entry record in the AEPD O00007128e2100020301) of the following: It states that "In our files there is no data or record of calls made to the telephone number *** TELEPHONE.1 ”. Attached the document “ANNEX I.- Screenshot of the voice ip CRM” in the no results listed as a result of the call search made from the number *** TELEPHONE.2 to *** TELEPHONE.1 between on June 1 and July 31, 2020. It also describes the following procedure: “As a result of the procedure with File number No.: E / 08519/2019, Vodafone implemented the following measures: • Force all collaborators to make calls from VODAFONE numberings, to be able to filter with the Robinson lists the databases of campaign recipients. • Carry out a development so that the supplier can check prior to loading the sale into the systems, that there has been a Call from an authorized agency number to the potential client. From this way, it cannot be the case that sales are loaded that come from calls that have not been made since VODAFONE numberings. Thus it can be ensured that all traffic is controlled and meets the requirements dictated by VODAFONE. C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 7/25 For this, VODAFONE obliges all collaborators who have the consideration of the Call Center to sign a contract with the company, referred to in the previous point, OASIP SERVICIO INTEGRAL DE COMUNICACIONES S.L (also known simply as OASIP) that supplies the [sic] Voice Ip solutions and filtering through the advertising exclusion files. Without such a contract the company Telefónica does not authorize the subcontracting of the treatment of teleshopping. Through this procedure VODAFONE ensures that calls that are carried out are legal and are not carried out to any number [sic] that is find it in advertising exclusion lists, it also allows you to a traceability of the calls made. " In relation to the originating telephone number *** TELEPHONE.3 and the calls subject to claim, the following information has been obtained: - Colt informs, dated March 11, 2021 (written with number of entry record in the AEPD O00007128e2100011184), of the following: The ownership of the telephone number *** TELEPHONE.3 corresponds to Rastreator. Confirms the making, on June 20, 2020, of two calls phone numbers from *** PHONE. 3 to *** PHONE. 1 at 19:02 hours. Indicates that there are no calls from the number *** TELEPHONE. 3 to *** PHONE. 1 on June 19, 2020. - Rastreator informs, dated March 15, 2021 (written with number entry registration in the AEPD O00007128e2100011901) that the number *** TELEPHONE.3 “does not correspond to any telephone line owned or assigned to Rastreator on the date the calls were made. " Add that Rastreator has contracted with Oasip the telephone traffic service from October 2018 and attaches a certificate signed on March 15, 2021 by Oasip in which it states: “That the line corresponding to the telephone number *** TELEPHONE.3 is assigned to another OASIP client, different from RASTREATOR, before June 20, 2020 " “That when the telephone line corresponding to the number *** TELEPHONE. 3 assigned to another client, RASTREATOR has not been able to make any outgoing calls from this phone number, in date June 20, 2020. " - Oasip informs, dated March 18, 2021 (written with number of entry record in the AEPD O00007128e2100012613), of the following: Oasip is a provider of telephone lines to clients. Oasip's professional activities do not include that of carry out "telephone promotion campaigns or similar services". C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 8/25 On November 14, 2019, Oasip signed an assignment contract and transfer of telephone lines and virtual switchboard with the client with ThreeQ. Between the telephone lines assigned and assigned to ThreeQ as part of the contract you will find the telephone number *** TELEPHONE. 3. Confirms the realization, on June 19, 2020, of a call from *** PHONE. 3 to *** PHONE. 1 at 2:22 p.m. from 32 seconds long. Confirms the realization, on June 20, 2020, of a call from *** TELEPHONE.3 to *** TELEPHONE.1 at 18:38 hours 66 seconds long. Confirm the realization, on June 26, 2020, of a call from *** TELEPHONE.3 to *** TELEPHONE.1 at 3:20 p.m. 43 seconds long. - ThreeQ reports, dated March 30, 2021 (written with number entry registration in the AEPD O00007128e2100014452), of the following: Attached, annex document number 4, a copy of an email Sent on March 18, 2021 by a department employee commercial of Oasip in which the existence of a 66-second call on June 20, 2020 at 18:38 hours from *** TELEPHONE.3 to *** TELEPHONE.1. The reason why the phone calls were made from the *** TELEPHONE.3 to *** TELEPHONE.1 was “the acquisition of customers new for Vodafone ”. ThreeQ has not processed the personal data of the number holder *** TELEPHONE.1, but it is your “collaborator who acquires the Base of data". Attached, annex document number 3, a copy of the contract signed on July 29, 2019 between ThreeQ and Ryv (the latter would have been the "Collaborator" referred to above and who would have dealt with the phone number *** PHONE. 1). It includes the following (the reference to "the agent" is to be understood as ThreeQ; the reference to “the collaborator ”is to be understood as Ryv): “[…] THE AGENT carries out its commercial activity in the sector of the telecommunications, commercial distribution and landline telephony and mobile phone and complementary products, network connection, communication and its accessories […] " “[…] THE COLLABORATOR, develops his professional activity of distribution on own account, in the different sectors of commerce, its general content being the promotion and conclusion of operations sales that have been entrusted to him […] " "For the action of subagents, the express authorization will be required of THE AGENT, responding THE COLLABORATOR of the management performed by the designated person. " C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 9/25 "The duration of this contract is for a specified time, with extinction on December 31, 2019. It will be extended for periods of one year if either party has not expressed its Intention to cancel it by giving two months' notice. " “THE AGENT provides in this act the product catalogs and services and commercial prices, to carry out sales, all of this must be returned by the commercial agency at the end of the present contractual relationship. " "Commissions will accrue monthly, calculated on the set of clients that have contracted and Installed any of the Services during the period Immediately preceding." "The parties undertake to respect the legislation at all times in force regarding the protection of personal data, in the context of this contract. " ThreeQ, “as indicated by Vodafone”, what it does is “facilitate the minutes trunk that takes the Robinson filter to the collaborator so that all your calls go through there ”. In this regard, he adds that “what we do is to facilitate the minutes with the OASIP company which has Robinson filter. When trying to make calls with it, if the client was on said Robinson list the call cannot be make." Attached, annex document number 2, a copy of the “CONTRACT OF PRESENTIAL CHANNEL SERVICE PROVISION ”between the claimed and ThreeQ for the period (as stated in the third clause of the same) from June 1, 2020 to March 31, 2021. The clause of the contract specifies the following (such as "COLLABORATOR" for the purposes of the following text should be understood ThreeQ): "The object of this contract is commercial promotion, both telephone as well as in person, from the VODAFONE Services to the COLLABORATOR's portfolio, so that they are hired by the Customers and consumers on a recurring and consolidated basis. " “[…] The COLLABORATOR will have its own databases of potential clients who must comply with the established requirements by the applicable regulations on data protection and to those who will offer VODAFONE services in the event that they show your interest. Therefore, the CONTRIBUTOR must present to such potential clients on their own behalf, such as responsible for their treatment, complying with the applicable regulations regarding the protection of personal data. " C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 10/25 “At the beginning of this contract, the EMPLOYEE has with the third collaborators listed in Annex II of this contract." "The COLLABORATOR must expressly communicate to VODAFONE the new incorporations of third-party collaborators that must be expressly authorized by VODAFONE in accordance with the clause 6.1. Likewise, the COLLABORATOR must send VODAFONE with quarterly the relationship of third-party collaborators with whom in that moment counts. " "The COLLABORATOR may not use third party collaborators, advertisers, referrers as well as any other figure for the development of the services provided under this contract Except for prior, express and written authorization from VODAFONE. If that the EMPLOYEE subcontracts the services to sub collaborators of any kind who must access personal data VODAFONE Clients or VODAFONE systems, the same must be previously authorized by VODAFONE as indicated in Annex IV of this contract, having to sign a contract by means of which the same subcontractors are transferred obligations regarding the protection of personal data that the imposed by VODAFONE. The COLLABORATOR, within thirty (30) days from the effective date of this contract, must issue and deliver to VODAFONE certification or declaration responsible in which it manifests and declares: (i) that he has subscribed with his sub-collaborators the corresponding contracts regarding the protection of personal data in the that all the obligations required by VODAFONE in accordance with the provisions of clause 13 and Annex IV of this contract, as well as (ii) that he has transferred to his sub-collaborators the obligations established in Annex III of this contract regarding Anti-Corruption Policy, Economic Sanctions and Security Corporate Likewise, the COLLABORATOR must deliver without undue delays, all evidence of compliance that are requested by VODAFONE at any time. The authorization of the sub-processors of the treatment by VODAFONE is conditional on delivery by the COLLABORATOR to VODAFONE of the certification or responsible statement referred to in the maximum term of thirty (30) days. VODAFONE authorization will be automatically revoked in relation to that / those sub-manager / s that the CONTRIBUTOR does not include in the aforementioned certification or responsible declaration. For the incorporation of new treatment sub-managers during the validity of the contract, it will be an essential requirement that the COLLABORATOR deliver the certification or declaration to VODAFONE responsible person referred at the same time of requesting authorization C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 11/25 so that it can expressly authorize and in writing, where appropriate, the subcontracting of services to third-party collaborators for the development of the services that are the object of this contract. " "VODAFONE will accept how many new Clients in Services that are have been carried out through the COLLABORATOR in accordance with the Client validation procedure, the minimums of which are described in this contract. In any case, the CONTRIBUTOR must check and fill in the Customer's data in the contract to proceed to contract the Services, without any doubt reasonable about your personality, ability and accreditation to hire." "The COLLABORATOR must inform VODAFONE at all times of all those phone numbers that both the COLLABORATOR as their third-party collaborators use to contact Clients or Potential VODAFONE Clients in the development of the target activity of this contract. In this sense, the use of numbers of phone not previously informed to VODAFONE will be understood as a breach of contract. VODAFONE reserves the right to verify that sales carried out are carried out through marking systems that guarantee compliance with the data protection regulations of all calls made by the EMPLOYEE to their bases of data, excluding those that have not been made through these systems of the right to obtain the corresponding economic incentive as established in the economic conditions agreed between the parts." "In any case, the COLLABORATOR undertakes to observe the how many provisions are applicable to the activity carried out and to the resources it uses for it, and in particular it is obliged to comply, as an essential obligation, the regulations, the VODAFONE and other procedures detailed in the clause 6.1, Annexes III and Annex IV of this contract, committing to the strict compliance with VODAFONE's anti-corruption policy as of the current regulations on data protection and consumers that he obliges himself, as well as all his employees, collaborators and / or subcontractors, where appropriate, to comply with the highest legal and ethical standards in the realization of the object of the this contract. " "Without prejudice to the provisions of clause 5.1. of this contract and, as a consequence of the provision of the services that constitute the object of this contract, the COLLABORATOR at the time of to carry out the contracting of the VODAFONE Services, will proceed to collect certain personal data from people that, through you or your collaborators, in accordance with the Clause 6.1 of this contract, contract the Services of C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 12/25 VODAFONE. To do this, you can access the VODAFONE systems in order to manage the Clients registered. For this reason and in accordance with current regulations, the COLLABORATOR will have the consideration of data processor for the management of the Customer registration in VODAFONE systems, having to formalize for this purpose the standard data treatment agreement that is attached as Annex IV, through which its obligations are included in this matter. In the event that the EMPLOYEE subcontracts the services to sub-collaborators of any kind who must access personal data of VODAFONE Clients or to systems of VODAFONE, they must be previously authorized by VODAFONE must comply with the COLLABORATOR strictly with the established in clause 6.1 and Annex IV of this contract. " "THE COLLABORATOR shall hold VODAFONE harmless from any damage derived from non-compliance by the COLLABORATOR or of its third-party collaborators, of any of the obligations provided for in this clause or in the annexes of this contract, and in particular for any sanction imposed by the Spanish Agency of Data Protection. " Annex II of the contract, entitled "THIRD EMPLOYEES", no includes no collaborator (“No collaborators”). Annex IV refers to the "DATA PROCESSING AGREEMENT PERSONAL DE VODAFONE ”between the defendant and ThreeQ de application to the processing of personal data whose purpose is the Registration of Vodafone products and services. - ThreeQ performs, dated May 24, 2021 (written with number of registration in the AEPD O00007128e2100023277), the following statements in relation to this case: “As a result of the procedure with File number No.: E / 08519/2019, Vodafone implemented the following measures: Force all collaborators to make calls from VODAFONE numberings, to be able to filter with the lists Robinson's campaign recipient databases. - Carry out a development so that the supplier can check before the load of the sale in the systems, that there has been a call from a number authorized from the agency to the potential client. In this way, the case sales are charged that come from calls that have not been made from the VODAFONE numberings. This way it can be ensured that everything traffic is controlled and complies with the requirements dictated by VODAFONE. To do this, VODAFONE forced us to sign a contract with the company OASIP SERVICIO INTEGRAL DE COMUNICACIONES S.L, is attached as Annex I (in C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 13/25 ahead OASIP) which is the provider of the [sic] Ip Voice solutions and Filtered through the advertising exclusion files. Without such a contract the telephone company does not authorize the subcontracting of the treatment of teleshopping. On the other hand, VODAFONE itself established a mechanism added to the described above for querying numberings that should not be performed a so-called “DrTool” which started working in October 2020. This tool obliges all collaborators to previously upload the list of potential calls to be made to exclude those numbers that the own company has listed on an advertising exclusion list. When the information has already been consulted, a list with the numbers is returned accepted to make the call through the provided ip voice system by the company OASIP. Through this procedure, VODAFONE ensures that calls made carried out are legal and are not carried out to any number [sic] found in advertising exclusion lists or numbers that have expressed directly to VODAFONE who do not want to receive more publicity. A copy of the e-mails where the details of the start of the procedures described, as well as different instructions indicated by VODAFONE for the use of the same. On the other hand, a copy of the contract with RYV CALL is attached as Annex III CONECTION, EIRL where their obligations as managers of the treatment. […] It should be noted that our entity has terminated the contract for the provision of services with VODAFONE so today it does not have any current subcontracting. However, despite the above, the last complete list of collaborators referred to VODAFONE as annex IV. Highlight that the Interlocutor of VODAFONE, B.B.B., is the one who asked us for a copy of the contracts of the collaborators with whom we work and in no case never stated that we should stop working with any of the collaborators. What's more, from OASIP, VODAFONE has access to the call numbers assigned to each of the collaborators. Therefore, the authorization was always tacit, since that despite the fact that VODAFONE had evidence of our collaboration network he never expressed any opposition. " Attached, document annex I, copy of the contract signed on November 2019 between Oasip and ThreeQ. There is no mention in it the responsibility on the application on the filtering of numberings based on the Robinson lists provided by Vodafone. As an object of contract includes the following (understand for these purposes ThreeQ by "THE CLIENT"): C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 14/25 "By this contract, THE CLIENT, may access the services that OASIP sells that allows all its telephone traffic to be handled, as well as the virtual switchboard services described in Annex I. Thus itself, as they are implemented, the user may access other additional services under the conditions and prices that in your case, look at it. " Attached, Annex II document, a set of emails exchanged in connection with the implementation of the measures that Vodafone would have established. They are briefly summarized to continuation: o Email dated October 23, 2019 sent from the address B.B.B. @ vodafone.com in which you request that, “as maximum on November 15, the entire commercial structure that make calls do it through trunks that have from Vodafone's robinson list filter ”. o Emails from October 24 and November 18, 2019 sent from address *** EMAIL.1 with subject “Robinson filtered calendar” in which the commissioning is planned march of the measures dictated by Vodafone. o Email dated January 20, 2020 sent by C.C.C. in which it is indicated that the new Vodafone operation would enter in force on January 27, 2020. It adds that “Those who are not within this new operation you will not be able to manage sales in the Vodafone channel, neither here nor at any other distributor. " Attached, annex III document, copy of “ANNEX I - AGREEMENT TO THE PROCESSING OF PERSONAL DATA ”signed on 29 October 2019 between ThreeQ and Ryv (referred to in the document as "THE COLLABORATOR"). This document incorporates, among others, the Next information: "(A) That in accordance with the provisions of clause 13 of the Service Provision Contract of which this annex brings cause, in in relation to clause 13 of the Agreement between THREEQ and Vodafone, the The person in charge of treatment must comply with the obligations that set out in this Annex. (B) That THE COLLABORATOR for the performance of its services will act under the condition of Treatment Manager, since will process Personal Data, in the name and on behalf of THREEQ and / or Vodafone. " "1.4. THE COLLABORATOR will carry out its activity by committing to: 1.4.1. Use personal data when they are found in one of the following cases: a) They appear in any of the sources accessible to the public considered in the regulations and the interested party has not expressed their refusal or C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 15/25 opposition to your data being processed for the activities described in this section. Sources accessible to the public should be understood as the guides of electronic communications services, under the terms provided by its specific regulations; and lists of people belonging to groups of professionals that contain only the data of name, title, profession, activity, academic degree, address professional and indication of their membership in the group. The direction professional may include the details of the full postal address, number telephone, fax number and email address. b) Have been provided by the interested parties themselves or obtained with their consent for specific, explicit and legitimate purposes related to advertising or commercial prospecting activity, having informed the interested parties about the specific sectors and specific activities regarding which you may receive information or advertising. c) Are not included in advertising exclusion services of consumers such as the Robinson List or other services or lists analogs. " “1.4.4. To be able to execute the services described in the present contract, the Collaborator must make all calls through Ip Voice services provided by the company OASIP. " "7.1. In the event that the data processing carried out by EL COLLABORATOR is carried out outside the territory of the European Union, The latter must formalize the standard international transfer clauses of data collected in "Appendix 3". " Attached, document annex IV, email dated May 28, 2020 listing ThreeQ contributors including Ryv. - On May 6, 2021, a request for information is sent to Ryv in relation to the calls under investigation in this report without response has been obtained. THIRD: By Agreement dated June 10, 2021, the Director of the Agency Spanish Data Protection Agency agreed to initiate a sanctioning procedure at the claimed for the alleged violation of Article 48.1.b) of the LGT of Law 9/2014, of May 9, General of Telecommunications (hereinafter LGT). The facts exposed could imply a violation of Article 48.1.b) of the LGT, typified in the Article 77.37 of the LGT (serious offense), which may be sanctioned with a fine of up to 2,000,000 euros, in accordance with article 79.1.c) of the same LGT. FOURTH: On 7/7/2021, OASIP presented allegations to the agreement to initiate the sanctioning procedure, in summary, in the following terms: C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 16/25 1) << In the agreement to initiate this sanctioning procedure, there has been no considering the principle of RESPONSIBILITY or authorship, by not directing the actions against the perpetrator responsible for the infringement committed, but against a company (the signatory of this writing) with a collateral intervention to the imputed facts, therefore that we understand ... that the examining body has acted incorrectly since The file can only be directed against natural or legal persons who had committed the offense. Our disagreement with the initiation of this sanctioning procedure lies in the disagreement with the imputation of responsibility for the occurrence of some facts in which our intervention is purely "medial" and, specifically, with the improper application to our business activity of article 23.4 of the LOPDGDD. The key to this precept and its relationship with the case brought against OASIP is at the beginning of its literal tenor: "Those who intend to carry out communications direct marketing "; this activity is completely unrelated to the one carried out our company. They are the VODAFONE companies and the so-called collaborators of VODAFONE, among others, CASMAR TELECOM S.L. (hereinafter Casmar) and THREE- QUARTERS FULL SL (hereinafter ThreeQ) who carry out this activity and who profit from the services they offer. Vodafone forces these two distributors or to "filter" these calls to prevent them from calling user numbers that are included in the Robinson list, but those are reluctant to subscribe to the List because it is not free, so Vodafone signs up for the Robinson List service and forces the distributors to follow the system of action that we describe: Vodafone delivers directly or OASIP the Robinson listing or through a "flp" and what our company was a real-time consultation of the call, so that if the number destination was on that list, the call did not go out and if the number was not there, it went out. This 'modus operandi' had the problem that this rise by Vodafone of the Robinson list had to be daily to be up to date, but that was not the case. From done. They updated it every 15 days so there were periods of time during which was not up to date, and finally stopped updating it (the last update was received on 03/9/2020) and the facts that are imputed are dated June and July 2020. In order to prove what has been said, various emails are provided between OASIP and Vodafone, among other documents. Well, making 7 calls out of a total of 520,371 we can qualify it as punctual and fortuitous incident and not a lack of diligence in the observance of the action protocols. The more calls made, the more likely it is to error >> 2) << Violation of the constitutional principle of presumption of innocence, since the The burden of proof should fall on the AEPD, not just simple statements general >>. 3) << Violation of the principle of proportionality in the graduation of the sanction, by how much objective and subjective circumstances have not been taken into account concurrent regarding the analysis of the circumstances and facts to take into account >>. C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 17/25 4) << Error in the classification of the offense and error in the consideration of the Sections c) and g) of art. 80.1 of the LGT as aggravating factors >>. FIFTH: On 07/08/2021, a Resolution Proposal was notified in the following terms: << That the Director of the Spanish Data Protection Agency sanctions OASIP SERVICIO INTEGRAL DE COMUNICACIONES S.L. with NIF B88183660, with fine of € 20,000 (twenty thousand euros) for the violation of article 48.1.b) of the LGT, in relationship with Article 23 of the LOPDGDD, typified in Article 77.37 of the LGT (serious offense). >>. SIXTH: On 07/22/2021, OASIP submitted allegations to the Proposal for Resolution, in summary, in the following terms: 1) The proven fact Third and Fourth of the proposed Resolution are not accredited. The person responsible for the alleged infringement is Vodafone, as it is the competent as responsible for the treatment now analyzed (filtered by robinson listing) 2) Violation of the principle of Responsibility, as Vodafone is responsible of the imputed facts. 3) Violation of the fundamental right to the presumption of innocence. The AEPD it has not proven "incontrovertibly who made the calls." 4) Violation of the principle of proportionality and duty to state the amount of The sanction. 5) Improper application of art 77.37 of the LGT. The offense must be, in all case, classified as mild according to art. 78.11 of the LGT. 6) Improper application of sections c) and g) of art. 80.1 of the LGT as aggravating factors. The seven unwanted calls that are imputed involved a profit of € 0.0083. Wrongful responsibility is inconsistent with serious typing. In the present case, OASIP meets all the criteria for attenuation indicated in art. 80.1 of the LGT. In view of all the actions, by the Spanish Agency for Data Protection In this proceeding, the following are considered proven facts, PROVEN FACTS FIRST: The claimant, dated 07/29/2020, filed a claim with the Spanish Data Protection Agency (entry registration number C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 18/25 026921/2020) for receiving unwanted commercial calls on behalf of the VODAFONE ESPAÑA, S.A.U. (VDF). SECOND: The phone number where the claimant receives calls, *** TELEPHONE. 1, is registered in the advertising exclusion system responsibility of the Spanish Association of the Digital Economy (hereinafter listed Robinson) from the date 01/16/2020. THIRD: From the calling number *** TELEPHONE. 2, and through the call by OASIP, the following commercial calls were made to the confirmed claimant. given by OASIP: Confirms the completion, on June 20, 2020, of four tele- phone calls from *** TELEPHONE.2 to *** TELEPHONE.1 between 19:00 and 19:02 hours. Confirms the making, on July 15, 2020, of a telephone call. ca from *** TELEPHONE.2 to *** TELEPHONE.1 at 3:50 p.m. FOURTH: From the calling number *** PHONE. 3, and through redirection and filtering the call by OASIP, the following commercial calls were made to the claimant confirmed by OASIP: Confirms the realization, on June 19, 2020, of a call from the *** PHONE.3 to *** PHONE.1 at 14:22 hours of 32 seconds duration tion. Confirms the realization, on June 20, 2020, of a call from the *** PHONE.3 to *** PHONE.1 at 18:38 hours of 66 seconds duration tion. Confirms the realization, on June 26, 2020, of a call from the *** TELEPHONE.3 to *** TELEPHONE.1 at 15:20 hours of 43 seconds duration tion. FIFTH: The aforementioned commercial calls are made in the name and on behalf of VDF who obliges its treatment managers to redirect all actions through OASIP in order for this entity to filter the recipients whose lines are included in advertising exclusion lists (Róbinson or list- two interns). SIXTH: The entities in charge of the treatment that act in the name and by account VDF company for commercial promotions (Casmar and TheeQ), provide a contract with OASIP by virtue of the obligation acquired with VDF to carry out joint actions commercial activities on their behalf and in order for said actions to be subject to prior filtering of the call by OASIP with the advertising exclusion lists (Robinson and Listings internal VDF). SEVENTH: VDF has documented the obligation of its treatment managers (Casmar and TheeQ) to carry out commercial actions on their behalf the contracting with OASIP to perform pre-filtering of called lines. (Annex I, II and III in section 1.4.1.c). It consists in allegations by OASIP to the Proposal for Resolution, that OASIP had knowledge months before (since March) that VDF did not C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 19/25 updated the list of excluded that it gave him to proceed to the filtering of calls. FOUNDATIONS OF LAW I In accordance with the provisions of article 84.3) of Law 9/2014, of May 9, General de Telecomunicaciones (hereinafter, LGT), the competence to initiate and Resolve this Penalty Procedure corresponds to the Director of the Spanish Agency for Data Protection. II In relation to the allegations presented by OASIP after the initiation agreement, it is means the following: 1R) First of all, it should be noted that the examining body does not carry out the agreement of start, but is named precisely in that agreement. Second, OASIP's factual rating should be viewed as responsible for the treatment related to the filtering of calls made by the those in charge of the treatment of Vodafone, concept formulated in the RGPD. In the present case, OASIP was previously aware of the problems that arose with the Robinson list provided by Vodafone and continued with the same treatment on the numbers included in the list, for profit, without correcting the deficiencies to which he was bound by contract and which continued until July 2020, which has led to the repeated violation (seven times in two months) of rights and freedoms of the claimant. Finally, it should be noted that the claimant was included in the Róbinson list since June 19, 2018, so the successive updates to the date of the events they did not affect the "modus operandi" of call filtering, since in subsequent lists provided by Vodafone -updated or not- there was always the line of the claimant. Consequently, from the previous inspection actions carried out by this AEPD is accredited that OASIP is ultimately responsible for the conduct now analyzed. 2R) In this regard, it should be noted that this AEPD has carried out an exhaustive prior investigation in order to clarify the responsibilities in the violation of the rights and freedoms of the claimant and has collected sufficient evidence to enervate the principle of presumption of innocence. Said investigation and evidence of position is detailed in the antecedents of this proposal for resolution. 3R) Regarding the alleged violation of the principle of proportionality, it means which was already taken into account in the initiation agreement itself, since the sanction C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 20/25 proposal (initial € 30,000) already contemplated the aforementioned principle as stated in the initiation agreement itself. In fact, the maximum legal penalty is 2,000,000 euros and the current proposal accepting the mitigating measures put forward (20,000 €) is one hundred times less in consideration of the mitigating factors applied at the request of the responsable. 4R) << Error in the classification of the offense and error in the consideration of the Sections c) and g) of art. 80.1 of the LGT as aggravating factors >>. Regarding aggravating 80.1.c) of the LGT, it affects what was said in the initiation agreement. In addition, regarding the absence of benefits, what is relevant is that the OASIP's performance was motivated by the search for economic benefit, by what the fact that it was insignificant or did not finally come to be obtained cannot serve as a basis for an attenuation of guilt or unlawfulness of their conduct. Regarding aggravating 80.1.g) of the LGT, in addition to what has already been said in the beginning, it is proven that OASIP improperly called the claimant in seven occasions despite being included in the advertising exclusion list Róbinson since 2018, and being responsible for avoiding such calls. The error alleged could be taken into account if he were invincible, but in the circumstances now analyzed (seven calls in two months) cannot be described as invincible but as an action, at least, of culpable responsibility. Consequently, the claims to the Initiation Agreement must be rejected. III In relation to the allegations presented on 07/22/2021 by OASIP after the Resolution Proposal, reiterate those already alleged in the Initiation Agreement. However, at Next, the answer to the allegations in the following terms: 1R) The proven fact Third and Fourth of the proposed Resolution are not accredited. The person responsible for the alleged infringement is Vodafone, as it is the competent as responsible for the treatment now analyzed. Regarding the first of the allegations presented, note that the facts proven are fully accredited in the Background after the investigations carried out by the Inspection of this AEPD in the proceedings previous. In addition, the OASIP itself confirms the materialization of the calls made to the claimant on seven occasions, even though her telephone line was registered in the advertising exclusion list since 2020. 2R) Violation of the principle of Responsibility, as Vodafone is responsible for the imputed facts. Regarding the second of the allegations to the Proposal for Resolution, it should be noted that the owner of the calling line is OASIP. In addition, OASIP was in charge of carrying out C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 21/25 the filtering of numberings included in the advertising exclusion lists in the actions carried out by Vodafone. In addition, they are already debugged in separate procedure initiated by this AEPD the responsibilities in which it has incurred Vodafone. In this sense, it should be noted that the responsibilities in the facts imputed by both entities are of a different nature, although both are complementary, which is why different procedures have been initiated. 3R) Violation of the fundamental right to the presumption of innocence. The AEPD does not has proven "incontrovertibly who made the calls." It has already been indicated that the alleged facts have been investigated in the proceedings previous research carried out by this AEPD, and have distorted the aforementioned alleged principle. In fact, it is stated in previous actions that it was OASIP who made through a numbering assigned to her the seven improper calls to the claimant. 4R) Violation of the principle of proportionality and duty to state the amount of the sanction. In this sense, as stated in the Proposal for Resolution, the sanction has been reduced to less than half of the maximum amount of the offenses typified as mild. Finally, it should be emphasized that OASIP was aware of the dysfunctionality of the crossover procedure with ad exclusion listings and continued to allow the making calls even knowing that Vodafone is not regularized the advertising exclusion listings from 03/9/2020, when calls improper actions were carried out during the months of June and July 2020 (as confirmed by OASIP in the allegations). 5R) Improper application of art 77.37 of the LGT. The offense must be, in any case, classified as mild, in accordance with art. 78.11 of the LGT. It has already been pointed out that OASIP materialized the offending act on seven occasions repeatedly violating the rights of the claimant, which makes it possible to classify how serious the offense. 6R) Improper application of sections c) and g) of art. 80.1 of the LGT as aggravating factors. The seven unwanted calls that are imputed represented a benefit of € 0.0083. The wrongful responsibility is inconsistent with the serious classification. At In this case, OASIP meets all the mitigation criteria indicated in the art. 80.1 of the LGT. Already answered extensively and motivated in the allegations to the Initiation Agreement (4R). Consequently, the allegations to the Motion for Resolution must be rejected. IV The art. 23 of the LOPDGDD, states the following: C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 22/25 << Article 23. Advertising exclusion systems. 1. The processing of personal data that is intended to prevent the sending of commercial communications to those who have expressed their refusal or opposition to receive them. For this purpose, information systems, general or sectoral, in which only the data essential to identify the affected. These systems may also include preferred services, through which those affected limit the reception of commercial communications to the from certain companies. 2. The entities responsible for the advertising exclusion systems will notify the competent control authority its creation, its general or sectoral nature, as well as the way in which those affected can join them and, where appropriate, assert your preferences. The competent control authority will make public in its electronic headquarters a list of the systems of this nature that were communicated, incorporating the information mentioned in the previous paragraph. To such In effect, the competent control authority to which the creation has been communicated of the system will make it known to the other control authorities for their publication by all of them. 3. When an affected party expresses to a person in charge his wish that his data not are processed for the referral of commercial communications, it must inform you of the existing advertising exclusion systems, being able to refer to the information published by the competent control authority. 4. Those who intend to make direct marketing communications must previously consult the advertising exclusion systems that could affect your action, excluding from the treatment the data of those affected who had expressed their opposition or refusal to it. For these purposes, to consider Once the above obligation has been fulfilled, consulting the exclusion systems will suffice included in the list published by the competent control authority. It will not be necessary to carry out the query referred to in the previous paragraph when the affected would have provided, in accordance with the provisions of this organic law, its consent to receive the communication to whoever intends to make it >>. In the present case, it is established that the claimant's line number was included in the Adigital Robinson exclusion list since 01/16/2020 and the Advertising calls in the name and on behalf of VDF were made from one line whose owner is OASIP in June and July 2020. Likewise, it is proven that it was OASIP who did not previously filter the call with the advertising exclusion list Robinson of Adigital, when it was his responsibility to do so by imperative of the person in charge advertising actions, repeating the calls seven times. V The known facts are constitutive of an infraction, attributable to the defendant, for violation of article 48.1.b) of the LGT, included in its Title III, which indicates the following: C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 23/25 "Article 48. Right to the protection of personal data and privacy in relation to with unsolicited communications, with traffic and location data and with subscriber guides. 1. Regarding the protection of personal data and privacy in relation to unsolicited communications end users of communications services electronic companies will have the following rights: (…) b) To oppose receiving unwanted calls for commercial communication purposes that are carried out through systems other than those established in the previous letter and to be informed of this right. " The offense is classified as serious in article 77.37 of said rule, which considers as such: "The serious violation of the rights of consumers and users final, as established in Title III of the Law and its implementing regulations ”. On the present case, and in relation to the provisions of art. 78.11 of the LGT (infractions minor), the existence of aggravated liability should be noted upon being accredited the reiteration on seven occasions of the imputed fact, which allows its classification as serious. This serious offense can be sanctioned with a fine of up to 2,000,000 euros, of in accordance with article 79.1.c) of the aforementioned LGT. In accordance with the available evidence, it is considered that graduate the sanction to be imposed according to the following criteria established by the Article 80 of the LGT: As aggravating factors: c) The benefit that has been reported to the offender by the fact that is the subject of the offense. The promotional actions are aimed at obtaining profits business, both directly and indirectly and constitutes a company directly linked to the advertising sector. g) The cessation of the infringing activity, previously or during the processing of the sanctioning file. There is no evidence of the cessation of the infringing activity by OASIP or that has established appropriate measures to guarantee in the communications facilitated to your customers through your virtual switchboard the correct filtering of numbering Callers with Adigital's Robinson Advertising Exclusion List. As mitigating factors: There are no previous infractions in the information system of this AEPD. OASIP is classified as a micro-enterprise, has 2 employees and invoices per year € 890,000. In the present case, OASIP must respond to the inappropriate calls made to the claimant on seven occasions during two months, by not filtering the calls C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 24/25 advertising with the advertising exclusion list, which has resulted in OASIP will materialize the calls to numbers previously included in the lists of advertising exclusion Robinson de Adigital and internal VDF. Taking into account the above-mentioned factors of graduation of the offense classified as serious, it is considered proportional to quantify the penalty at € 20,000. Considering the aforementioned precepts and others of general application, the Director of the Agency Spanish Data Protection RESOLVES: FIRST: IMPOSE OASIP SERVICIO INTEGRAL DE COMUNICACIONES S.L. with NIF B88183660, for the violation of art. 48.1.b) of the LGT, in relation to art. 23 of the LOPDGDD, classified as serious in art. 77.37 of the LGT, the sanction of € 20,000 (twenty thousand euros) SECOND: NOTIFY this resolution to the claimant and OASIP SERVICIO INTEGRAL DE COMUNICACIONES S.L .. THIRD: Warn the sanctioned person that the sanction imposed must be effective once this resolution is enforceable, in accordance with the provisions of the Article 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations, within the voluntary payment period indicated in the Article 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17 December, by entering the restricted account number ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Agency for Data Protection in the entity banking CAIXABANK, S.A. or otherwise, it will be collected in executive period. Received the notification and once executive, if the date of execution is found Between the 1st and the 15th of each month, both inclusive, the deadline for making the payment volunteer will be until the 20th of the following or immediately subsequent business month, and if between the 16th and the last day of each month, both inclusive, the payment term It will be until the 5th of the second following or immediate business month. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to administrative proceedings (article 48.6 of the LOPDGDD), and in accordance with the provisions of articles 112 and 123 of the Law 39/2015, of October 1, of the Common Administrative Procedure of the Public Administrations, the interested parties may file, optionally, appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month from the day following notification of this resolution or directly administrative contentious appeal before the Chamber of Contentious-administrative of the National Court, in accordance with the provisions of the Article 25 and in section 5 of the fourth additional provision of Law 29/1998, of July 13, regulator of the Contentious-Administrative Jurisdiction, within the period of two months from the day following the notification of this act, as provided for in article 46.1 of the aforementioned legal text. C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es 25/25 Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of Law 39/2015, of October 1, of the Common Administrative Procedure of the Administrations Public, the final resolution may be suspended provisionally through administrative channels if the interested party expresses his intention to file a contentious-administrative appeal. If this is the case, the interested party must formally communicate this fact through writing addressed to the Spanish Agency for Data Protection, presenting it through of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica- web /], or through any of the other records provided for in art. 16.4 of the cited Law 39/2015, of October 1. You must also transfer to the Agency the documentation that proves the effective filing of the contentious appeal- administrative. If the Agency is not aware of the filing of the appeal contentious-administrative within a period of two months from the day following the notification of this resolution would terminate the precautionary suspension. 815-141020 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.agpd.es 28001 - Madrid sedeagpd.gob.es