| AEPD - PS/00149/2020 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 6 GDPR 21 of the Spanish Law on Information Society Services (LSSI) |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 10.07.2020 |
| Fine: | 600 EUR |
| Parties: | Centro Internacional de Crecimiento Laboral y Profesional, S.L. |
| National Case Number/Name: | PS/00149/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Spanish |
| Original Source: | AEPD decision (in ES) |
| Initial Contributor: | Miguel Garrido de Vega |
10 July 2020 - The Spanish Data Protection Agency (AEPD) decided to early finish the sanction procedure against Centro Internacional de Crecimiento Laboral y Profesional, S.L. (the defendant) for the infringement of Article 21 of the Spanish Law on Information Society Services (LSSI) —this is the Spanish law regulating the prohibition to send unsolicited commercial emails without a legal basis, connected to Article 6 of the GDPR—, as the defendant agreed to an early and guilty voluntary payment of the corresponding part (600 €) of the fine suggested by the AEPD (1,000 €).
English Summary
Facts
The decision is the consequence of a sanction procedure started by the AEPD against the defendant due to a complaint submitted by a Spanish citizen stating that the defendant had sent him unsolicited commercial emails, and that such emails did not include the corresponding unsubscribing option.
Dispute
The AEPD started the corresponding sanction procedure.
Holding
Without prejudice to the results of the final investigations corresponding to the sanction procedure, the AEPD understood that the defendant could have breached the prohibition of sending unsolicited commercial emails as per Article 21 LSSI: on the basis of the available evidences, the defendant sent a commercial email to the address of the claimant even after having confirmed him/her that his/her personal data have been deleted. Consequently, after considering some aggravating/mitigating circumstances [(i) there is a negligence by the defendant, but (iii) the defendant has not obtained any advantages from such negligence nor the claimant has suffered any damages], the AEPD understood that, in case the sanction procedure resulted in a successful decision, this infringement would be fined with 1,000 € to the defendant. In this sense, the AEPD offered the defendant the possibility to settle the issue before the decision takes place by agreeing to a voluntary payment of part of the fine with two possible discounts: (i) acknowledging of its liability (800 €) and early voluntary payment (600 €). The defendant agreed to both concepts, so it paid 600 € and the sanction procedure was closed by the AEPD.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/8936-031219 Procedure No.: PS / 00149/2020RESOLUTION R / 00298/2020 OF TERMINATION OF THE PAYMENT PROCEDUREVOLUNTARYIn the sanctioning procedure PS / 00149/2020, instructed by the AgencySpanish Data Protection to CENTRO INTERNACIONAL DE CRECIMIENTOLABORAL Y PROFESIONAL, SL , having regard to the complaint filed by AAA , andbased on the following,BACKGROUNDFIRST: On June 17, 2020, the Director of the Spanish Agency forData Protection agreed to initiate sanctioning procedure to CENTROINTERNACIONAL DE CRECIMIENTO LABORAL Y PROFESIONAL, SL (inhereinafter, the claimed), through the Agreement that is transcribed:<<Procedure Nº: PS / 00149/2020PENALTY PROCEDURE STARTING AGREEMENTOf the actions carried out by the Spanish Agency for the Protection ofData and based on the followingACTSFIRST: AAA (hereinafter, the claimant) dated April 8, 2020, filedclaim before the Spanish Agency for Data Protection.The claim is directed against INTERNATIONAL GROWTH CENTERLABORAL Y PROFESIONAL, SL with NIF B54687264 (hereinafter, the claimed).C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 2 2/8The reasons on which the claim is based are the receipt of emails from theclaimed in the domain "grupoladona.com", a company dedicated to hospitality.It states that these emails have been sent without consent and that the addressto unsubscribe does not exist.Along with the claim, he provides two emails dated 03/29/2020 and 04/08/2020.SECOND: In view of the facts reported in the claim and thedocuments provided by the complainant / of the facts and documents from which he hasThis Agency, the General Sub-Directorate for Data Inspection, had knowledgeproceeded to carry out preliminary investigation actions for theclarification of the facts in question, under the powers of investigationgranted to supervisory authorities in article 57.1 of Regulation (EU)2016/679 (General Data Protection Regulation, hereinafter RGPD), andpursuant to the provisions of Title VII, Chapter I, Second Section, of the LawOrganic 3/2018, of December 5, Protection of Personal Data and guarantee ofdigital rights (hereinafter LOPDGDD).As a result of the investigation actions carried out, it is foundthat the person responsible for the treatment is the one claimed.FUNDAMENTALS OF LAWIIn accordance with the provisions of article 43.1, second paragraph, of theof Law 34/2002, of July 11, on Services of the Information Society andElectronic Commerce (hereinafter, LSSI) is competent to initiate and resolve thisSanctioning Procedure the Director of the Spanish Agency for the Protection ofData.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 3 3/8IIWithout prejudice to what results from the investigation, the exposed facts,consisting of sending a commercial communication, could be constitutive ofan infringement, by the person claimed, of the provisions of article 21 of the currentLaw 34/2002, of July 11, on Services of the Information Society and CommerceElectronic (hereinafter LSSI), which provides the following:"one. The sending of advertising or promotional communications is prohibited.by email or other equivalent electronic means of communication thatpreviously they had not been requested or expressly authorized by therecipients of the same.2. The provisions of the preceding section shall not apply when there is aprior contractual relationship, provided that the provider had obtained lawfullythe recipient's contact information and use it to send communicationscommercials referring to products or services of your own company that aresimilar to those that were initially contracted with the client.In any case, the provider must offer the recipient the possibility ofoppose the processing of your data for promotional purposes through asimple and free procedure, both at the time of data collection andin each of the commercial communications that you direct.When the communications have been sent by email,This means must necessarily consist of the inclusion of an address ofemail or other valid email address where this can be exercisedright, being prohibited the sending of communications that do not include saiddirection."The aforementioned offense is classified as minor in article 38.4.d) ofthe LSSI, which qualifies as such “The sending of commercial communications by mailelectronic or other equivalent electronic means of communication when in saidshipments do not meet the requirements established in article 21 and do not constituteserious offense ” .In the present case, the violation of article 21 of the LSSI that is imputed to theclaimed must be classified as a minor offense, considering the number ofcommercial messages forwarded to the complainant.Under the provisions of article 39.1.c) of the LSSI, minor infringementsThey may be sanctioned with a fine of up to € 30,000, establishing the criteria for theirgraduation in article 40 of the same standard, the literal wording of which is as follows:“Article 40. Graduation of the amount of the sanctions.The amount of the fines imposed will be graduated according to the followingcriteria:a) The existence of intentionality.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 4 4/8b) Period of time during which the offense has been committed.c) The recidivism for committing infractions of the same nature, whenhas been declared by firm resolution.d) The nature and amount of the damages caused.e) The benefits obtained for the infraction.f) Billing volume affected by the infringement committed.g) Adherence to a code of conduct or a system of advertising self-regulationapplicable with respect to the offense committed, which complies with the provisions of article18 or in the eighth final provision and that has been favorably informed by thecompetent body or bodies. "In relation to the criteria for graduation of the sanctions included in thetranscribed article 40 of the LSSI, with the evidence available in thepresent moment of agreement to initiate the sanctioning procedure, and without prejudiceof what results from the instruction, it is considered that in this case it acts asaggravating criterion a) of the mentioned article, because there has been a lackof diligence on the part of the claimed when using the email addressof the claimant to send him a commercial communication after confirming thatYour request for the deletion of personal data would be handled, whenever it isspecial knowledge of the requirements contained in article 21 of theLSSI being an entity used to sending this type of message in developmentof your activity.At the same time, criterion d) and e) included in thecited article 40 of the LSSI, in the absence of evidence that the claimant hassuffered damages or the claimed has obtained benefits derived from the commission ofthe offense.Accordingly, it is considered appropriate to the seriousness of the factsanalyzed impose on the entity INTERNATIONAL GROWTH CENTERLABORAL Y PROFESIONAL, SL a penalty of 1,000 euros.Therefore, in light of the above,By the Director of the Spanish Agency for Data Protection,C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 5 5/8HE REMEMBERS:1. INITIATE SANCTIONING PROCEDURE at INTERNATIONAL CENTERDE CRECIMIENTO LABORAL Y PROFESIONAL, SL with NIF B54687264in accordance with the provisions of articles 63 and 64 of Law 39/2015, of 1 ofOctober, of the Common Administrative Procedure of the Public Administrationspublic (hereinafter, LPACAP), for the alleged violation of article 21 of theLSSI, classified as minor infractions according to article 39.1.c) of said textlegal.1. APPOINT RRR as an instructor and SSS as secretary , indicatingthat any of them may be challenged, if applicable, in accordance with the provisions ofcited in articles 23 and 24 of Law 40/2015, of October 1, RegimePublic Sector Law (LRJSP).2. INCORPORATE into the sanctioning file, for evidentiary purposes, the claim-tion filed by the claimant and its documentation; the documents obtainedtwo and generated by the General Sub-Directorate for Data Inspection duringthe investigation phase; as well as the report of previous actions of Ins-pection; they are all part of the record.3. THAT for the purposes provided in art. 64.2 b) of the LPACAP, the sanction thatcould correspond would be 1,000 euros , without prejudice to what results from theinstruction.4. NOTIFY this agreement to CENTRO INTERNACIONAL DEGROWTH AND PROFESSIONAL WORK, SL with NIF B54687264 , otor-giving it a hearing period of ten business days to formulate the allegationstions and present the evidence it deems appropriate. In his writing ofallegations must provide your NIF and the procedure number that appears inthe heading of this document.If, within the stipulated period, no allegations are made to this initial agreement, theit may be considered a resolution proposal, as established in theArticle 64.2.f) of Law 39/2015, of October 1, of the Administrative ProcedureCommon of Public Administrations (hereinafter, LPACAP).C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 6 6/8In accordance with the provisions of article 85 of the LPACAP, in the event ofthat the sanction to be imposed was a fine, you may recognize your responsibility withinof the term granted for the formulation of allegations to this initial agreement; thewhich will entail a reduction of 20% of the sanction to be imposed inthe present procedure, equivalent in this case to 200 euros . With the application ofthis reduction, the sanction would be established at 800 euros , resolving theprocedure with the imposition of this sanction.In the same way, at any time prior to the resolution of thethis procedure, carry out the voluntary payment of the proposed sanction, whatwhich will mean a reduction of 20% of its amount, equivalent in this case to 200euros . With the application of this reduction, the sanction would be established at 800euros , resolving the procedure with the imposition of this sanction.The reduction for the voluntary payment of the sanction is cumulative to the oneIt is appropriate to apply for the recognition of responsibility, provided that thisacknowledgment of responsibility is made clear within the deadlinegranted to make allegations to the opening of the procedure. The payvoluntary of the amount referred to in the preceding paragraph may be done at anymoment before resolution. In this case, if applicable, apply bothreductions, the amount of the sanction would be established at 600 euros.In any case, the effectiveness of any of the two mentioned reductionsit will be conditioned to the withdrawal or resignation of any action or resource in processadministrative against the sanction.In the event that you choose to proceed to the voluntary payment of any of theamounts indicated above ( 800 or 600 euros), you must make it effectiveby entering the account number ES00 0000 0000 0000 0000 0000 opened atname of the Spanish Agency for Data Protection in the CAIXABANK Bank,SA, indicating in the concept the reference number of the procedure that appears inthe heading of this document and the reason for reducing the amount to whichwelcomes.Likewise, you must send the proof of income to the General Subdirectorate ofInspection to continue the procedure in accordance with the quantityentered.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 7 7/8The procedure will have a maximum duration of nine months fromthe date of the initiation agreement or, if applicable, the draft initiation agreement.After this period will expire and, consequently, the file ofperformances; in accordance with the provisions of article 64 of the LOPDGDD.Finally, it is pointed out that in accordance with the provisions of article 112.1 of theLPACAP, there is no administrative appeal against this act. Mar España Martí Director of the Spanish Agency for Data Protection >>SECOND : On July 2, 2020, the requested party has paid thesanction in the amount of 600 euros making use of the two reductions provided forthe Initiation Agreement transcribed above, which implies the recognition of theresponsibility.THIRD : The payment made, within the period granted to make allegations tothe opening of the procedure, implies the renunciation of any action or recourse in processadministrative against the sanction and the recognition of responsibility in relation tothe facts referred to in the Home Agreement.FUNDAMENTALS OF LAWIBy virtue of the powers that article 58.2 of the RGPD recognizes to each authority ofcontrol, and as established in art. 47 of Organic Law 3/2018, of 5 ofDecember, on Personal Data Protection and guarantee of digital rights (inhereinafter LOPDGDD), the Director of the Spanish Agency for Data Protectionis competent to sanction the infractions that are committed against saidRegulation; infractions of article 48 of Law 9/2014, of May 9, GeneralTelecommunications (hereinafter LGT), in accordance with the provisions of thearticle 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and38.4 d), g) and h) of Law 34/2002, of July 11, on services of the society of theinformation and electronic commerce (hereinafter LSSI), as provided in the article43.1 of said Law.IIArticle 85 of Law 39/2015, of October 1, of the Administrative ProcedureCommon of Public Administrations (hereinafter, LPACAP), under the heading" Termination in sanctioning procedures " provides the following:C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 8 8/8"one. Initiated a sanctioning procedure, if the offender acknowledges hisresponsibility, the procedure may be resolved with the imposition of the sanctionthat proceed.2. When the sanction is solely pecuniary or fitsimpose a pecuniary and a non-pecuniary sanction but it has been justifiedthe inadmissibility of the second, the voluntary payment by the alleged responsible, inany time prior to the resolution, will imply the termination of the procedure,except with regard to the replacement of the altered situation or the determination of thecompensation for the damages caused by the commission of the offense.3. In both cases, when the sanction is solely pecuniary in nature,the competent body to resolve the procedure will apply reductions of, toless, 20% on the amount of the proposed sanction, these being cumulativeeach. The aforementioned reductions must be determined in the notification ofinitiation of the procedure and its effectiveness will be conditioned to the withdrawal orwaiver of any administrative action or recourse against the sanction.The reduction percentage provided in this section may be increasedby regulation.According to what was stated,the Director of the Spanish Agency for Data Protection RESOLVES :FIRST: DECLARE the termination of the procedure PS / 00149/2020 , ofin accordance with the provisions of article 85 of the LPACAP.SECOND: NOTIFY this resolution to INTERNATIONAL CENTER OFCRECIMIENTO LABORAL Y PROFESIONAL, SL .In accordance with the provisions of article 50 of the LOPDGDD, thisResolution will be made public once the interested parties have been notified.Against this resolution, which ends the administrative procedure as prescribed bythe art. 114.1.c) of Law 39/2015, of October 1, of the Administrative ProcedureCommon of Public Administrations, interested parties may file an appealadministrative litigation before the Contentious-administrative Chamber of theNational Court, in accordance with the provisions of article 25 and section 5 ofthe fourth additional provision of Law 29/1998, of July 13, regulating theContentious-Administrative Jurisdiction, within a period of two months fromday after notification of this act, as provided in article 46.1 of thereferred Law. Mar España Martí Director of the Spanish Agency for Data Protection
