AEPD - PS-00362-2020
|AEPD - PS-00362-2020|
Article 43(1)(b) LSSI
Article 21 LSSI
Article 38(4)(d) LSSI
Article 39(1)(c) LSSI
|National Case Number/Name:||PS-00362-2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||Francesc Julve Falcó|
The Spanish DPA (AEPD) fined a website creation company €2000 for sending advertising e-mails without the recipient's consent.
English Summary[edit | edit source]
Facts[edit | edit source]
The complainant informed the AEPD on 2 July 2020 that he had been receiving e-mails from the website creation company "beiNNova" without him having any relationship with that company.
The complainant sent emails to unsubscribe to the newsletter and to stop the sending of unwanted mail but he did not receive a reply from the company and the sending of emails continued.
The AEPD initiated a sanctioning proceeding against "bieNNova" on 4 December 2020. Subsequently, the AEPD tried to contact the company and did not obtain any response or allegations.
Dispute[edit | edit source]
Is sending advertising emails without the consent of the recipient an infringement of Article 21 of the Spanish Information Society Services Act (LSSI) implementing the e-Privacy Directive?
Holding[edit | edit source]
The AEPD considered that the conduct of the company "bieNNova" infringed Article 21 LSSI (Ley de Servicios de Sociedad de la Información y de Comercio Electronico).
Article 21 establishes that it is forbidden to send advertising or promotional communications by e-mail or any other equivalent means of electronic communication that have not been previously requested or expressly authorised by the recipients of such communications.
Article 38(4)(d) of the same law graduates the sanction as minor, defining the conduct as "the sending of commercial communications by electronic mail or other equivalent means of electronic communication when such mailings do not comply with the requirements set out in Article 21 and do not constitute a serious infringement".
In this case, the aggravating circumstance of the existence of intentionality was taken into account (Article 40(a) LSSI).
The AEPD fined the controller €2000 for failing to comply with Article 21 LSSI.
Comment[edit | edit source]
The Director of the Spanish Data Protection Authority is competent to carry out this procedure, in accordance with the provisions of Article 43(1), second paragraph, of the LSSI.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/4 Procedure No.: PS / 00362/2020 938-0419 RESOLUTION OF SANCTIONING PROCEDURE In the sanctioning procedure PS / 0362/2020, instructed by the Spanish Agency for Data Protection, before D. A.A.A. (BEINNOVA.ES), with NIF.:***NIF.1, hereinafter, “The person claimed”), by virtue of the complaint presented by D. *** B.B.B., (In addition lante, “the claimant”), and based on the following: BACKGROUND FIRST: On 07/02/20, you have an entry in this Agency, a complaint filed by the claimant in which it indicated, among others, the following: “I denounce the indiscriminate harassment of mailings from the beiNNova company. I do not know this company, I have tried to unsubscribe from their newsletter and they even wrote an email. Ignore all attempts ”. The claim letter is accompanies the following documentation: 1.- Newsletter sent on 06/03/20, from the email address: beiNNova; <info © beinnova.es> to the claimant's email address. In this email, there is a banner with the following information: "Legal note: The content of this email co and its attachments are confidential. In compliance with the RGPD you can exercise close the rights by sending an email to: email@example.com 2.- Newsletter sent on 06/10/20, from the email address: beiNNova; <info © beinnova.es> to the claimant's email address. In this email, there is a banner with the following information: "Legal note: The content of this email co and its attachments are confidential. In compliance with the GDPR (you can exercise close the rights by sending an email to: firstname.lastname@example.org. 3.- Email dated 06/10/20, sent by the claimant to the address: beiNNova <info © beinnova.es>, in response to the email from point (2), saying in it: “I have NOT subscribed to your newsletter. I have unsubscribed 3 times and they keep sending me emails. I would appreciate it if you check that my email has been deleted correctly. tamente, since if it continues I will file a complaint with the AEPD ”. 4.- Newsletter of 06/17/20, from the email address: beiNNova; <info © beinnova.es> to the claimant's email address. SECOND: On 12/04/20, the Director of the Spanish Agency for the Protection of Data agreed to initiate a sanctioning procedure against the claimed entity, by virtue of the powers established, for failing to comply with the provisions of article 21 of the LSSI, impose nding an initial penalty of 2,000 euros (two thousand euros) to the person claimed. FOURTH: Notified the initiation agreement to the person claimed, it has not been presented no brief of allegations, in the period granted for that purpose. PROVEN FACTS C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/4 1º.- According to the complainant's complaint, he receives emails from the company beiN- Nova, without your consent. 2º.- In view of the facts presented in the claim, this Agency directed two studies Information request credits from the claimed entity. None of which had an answer. 3.- Initiated sanctioning proceedings against the claimed entity, as of today there has been no received in this Agency, any letter of allegations to said initiation. FOUNDATIONS OF LAW I The Director of the Spanish Agency is competent to resolve this procedure of Data Protection, in accordance with the provisions of art. 43.1, second paragraph second, of the LSSI. II The joint assessment of the documentary evidence in the procedure brings to knowledge of the AEPD, a vision of the denounced action that has been strapped in the facts declared proven above related. In the present case, the claimant has received several emails, with "Newsletter", of the claimed entity. According to the complaint, he does not know the company and you have never requested such a service. It also indicates that you have attempted to unsubscribe from the "newsletter", up to three times in the link intended for it in the received emails, and even sent an email to the address email@example.com, requesting to unsubscribe, but has not received a reply some. III The facts presented, consisting of the sending of commercial communications, do not consented to the claimant, constitute an infringement, on the part of the claimed entity gives the provisions of article 21 of the LSSI, which provides the following: "1. The sending of advertising or promotional communications by co- electronic mail or other equivalent electronic means of communication that previously have not been requested or expressly authorized by the recipients of the themselves. 2. The provisions of the preceding section shall not apply when there is a relationship prior contractual provision, provided that the provider has obtained lawfully the contact details of the recipient and will use them to send communications with related to products or services of your own company that are similar those who were initially contracted with the client. In any case, the provider must offer the recipient the possibility of opposing the processing of your data for promotional purposes using a simple procedure and free of charge, both at the time of data collection and in each of the commercial communications to direct you. When the communications have been sent by email, said me- The diode must necessarily consist of the inclusion of an email address C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/4 address or other valid electronic address where this right can be exercised, remain- It is prohibited to send communications that do not include said address ”. IV The aforementioned offense is classified as minor in art. 38.4.d) of said nor- ma, which qualifies as such, “Sending commercial communications by email sole or other equivalent electronic means of communication when in said shipments the requirements established in article 21 are not met and does not constitute an infringement serious". In accordance with the provisions of article 39.1.c) of the LSSI, minor offenses may be sanctioned with a fine of up to € 30,000, establishing the criteria for its regulation in article 40 of the same rule. After the evidence obtained, it is considered Therefore, in this case, it acts as an aggravating factor: - The existence of intentionality (section a), since, the claimed entity in- via commercial advertising to the claimant's phone, through emails unique without consent. In accordance with these criteria, it is considered appropriate to impose a sanction on the defendant 2,000 euros (two thousand euros), for sending advertising emails without the consent of the affected party. In view of the above, the following is issued: RESOLVES: FIRST: IMPOSE D. A.A.A. (BEINNOVA.ES) with NIF.:***NIF.1, a sanction of 2,000 euros (two thousand euros), for violation of article 21 of the LSSI. SECOND: NOTIFY this resolution to D.A.A.A. (BEINNOVA.ES) and to the clamoring about the result of the claim. Warn the sanctioned person that the sanction imposed must be effective once it is executive this resolution, in accordance with the provisions of article 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of the Ad- Public Ministries (LPACAP), within the voluntary payment period indicated in article 68 of the General Collection Regulation, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17, me- when entering the restricted account number ES00 0000 0000 0000 0000 0000, opened on behalf of the Spanish Agency for Data Protection in Banco CAIXABANK, S.A. or otherwise, it will be collected in the executive period. Received the notification and once executive, if the date of execution is found between the 1st and the 15th of each month, both inclusive, the deadline for making the vo- luntario will be until the 20th day of the following or immediately subsequent business month, and if between the 16th and the last day of each month, both inclusive, the payment term It will be until the 5th of the second following or immediate business month. In accordance with the provisions of article 82 of Law 62/2003, of December 30- of fiscal, administrative and social order measures, this Resolution is C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/4 will be made public, once it has been notified to the interested parties. The publication is made- It will be in accordance with the provisions of Instruction 1/2004, of December 22, of the Agency Spanish Data Protection Agency on the publication of its Resolutions. Against this resolution, which puts an end to administrative proceedings, and in accordance with established in articles 112 and 123 of the LPACAP, the interested parties may interpose ner, optionally, appeal for reconsideration before the Director of the Spanish Agency of Data Protection within a period of one month from the day following the notification fication of this resolution, or, directly administrative contentious appeal before the Contentious-administrative Chamber of the National Court, in accordance with the provisions set out in article 25 and in section 5 of the fourth additional provision of the Law 29/1998, of 07/13, regulating the Contentious-administrative Jurisdiction, in the or two months from the day following the notification of this act, according to the provisions of article 46.1 of the aforementioned legal text. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, may provisionally suspend the final resolution through administrative channels if the interested party do manifests its intention to file a contentious-administrative appeal. Of being In this case, the interested party must formally communicate this fact in writing addressed to the Spanish Agency for Data Protection, presenting it through the Re- Electronic registry of the Agency [https://sedeagpd.gob.es/sede-electronicaweb/], or to through any of the other records provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. You must also forward the documentation to the Agency that certifies the effective filing of the contentious-administrative appeal. If the Agency was not aware of the filing of the contentious-administrative appeal trative within two months from the day following notification of this resolution, would terminate the precautionary suspension. Mar Spain Martí Director of the Spanish Agency for Data Protection. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es