AEPD (Spain) - PS/00026/2021
|AEPD - PS/00026/2021
|Article 21 GDPR
Article 28 GDPR
Article 23 of the Law on the Protection of Personal Data and Guarantee of Digital Rights
Article 48(1)(b) of the Law on General Telecommunications
|Vamavi Phone SL
|National Case Number/Name:
|European Case Law Identifier:
|AEPD (in ES)
The Spanish DPA (AEPD) found that the data processor, Vamavi Phone SL, had violated Article 48(1) LGT, Article 21 GDPR in link with Article 23 LOPDGDD and Article 28 GDPR by making a commercial call on behalf of Vodafone España, SAU to a data subject registered on the Robinson List. Vamavi paid a fine of €24,000 (reduced from €40,000).
English Summary[edit | edit source]
Facts[edit | edit source]
The complainant filed a complaint as they received a commercial call on behalf of "Vodafone España, SAU" despite being listed on the Robinson List (advertising exclusion list).
The Spanish DPA (AEPD) therefore began an investigation to clarify the facts at stake. This revealed that Vamavi Phone SL was responsible for the data processing. Vamavi had made the commercial call to the Claimant on behalf of Vodafone España, SAU.
Dispute[edit | edit source]
Does a commercial call made by a processor to a claimant on the Robinson List entail a breach of Article 48(1) LGT, Article 21 GDPR in link with Article 23 LOPDGDD and Article 28 GDPR?
Holding[edit | edit source]
The Spanish DPA (AEPD) held that the facts in question indicated a breach of Article 48(1)(b) of the Spanish Law on General Telecommunications (LGT) by Vamavi. This provision outlines that individuals have the right to oppose receiving unwanted calls for commercial communication purposes. The DPA went on to outline that this must be read in light of Article 21 GDPR (right to object) and Article 23 of the Spanish Law on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
The DPA held that by acting on behalf of Vodafone, Vamavi acted as a data processor within the meaning of Article 28 GDPR. Vamavi was nonetheless the one found responsible for the data processing in question.
As Vamavi made a voluntary, early and guilty payment, the fine paid was reduced to €24,000 (rather than the original fine of €40,000).
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/16 Procedure No.: PS / 00026/2021 RESOLUTION R / 00087/2021 OF TERMINATION OF THE PROCEDURE FOR PAYMENT VOLUNTARY In the sanctioning procedure PS / 00026/2021, instructed by the Spanish Agency for Data Protection to VAMAVI PHONE, S.L., considering the complaint filed by A.A.A., and based on the following, BACKGROUND FIRST: On January 27, 2021, the Director of the Spanish Agency for Data Protection agreed to initiate a sanctioning procedure to VAMAVI PHONE, S.L. (hereinafter, the claimed), through the Agreement that is transcribed: << Procedure No.: PS / 00026/2021 AGREEMENT TO INITIATE THE SANCTIONING PROCEDURE Of the actions carried out by the Spanish Agency for Data Protection and in based on the following ACTS FIRST: A.A.A. (hereinafter the claimant) filed a claim with the Agency Spanish Data Protection Agency (hereinafter AEPD) for receipt on January 31 2020, at 11:34 am, from a commercial call on behalf of “Vodafone España, S.A.U. ”, with NIF A80907397 (hereinafter VDF), to its telephone line *** PHONE. 1 that is registered on the advertising exclusion list Robinson, from the line *** PHONE. 2. Relevant documentation provided by the claimant: - 34-second audio file corresponding to the call recording commercial on behalf of VDF. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/16 - Copy of the invoice (issued by XFERA MÓVILES, S.A.U. with NIF A82528548) of the telephone line *** TELEPHONE. 1 in which the ownership of this by part of the claimant. - Copy of the certificate of the Robinson List registration issued on 01/31/2020, in which your phone line *** PHONE. 1 is registered against phone calls commercials since 08/03/2018. SECOND: In view of the facts reported in the claim and the documents provided by the claimant / of the facts and documents of which he has this Agency, the Subdirectorate General for Data Inspection proceeded to carry out preliminary investigation actions for the clarification of the facts in question, by virtue of the powers of investigation granted to the control authorities in article 57.1 of the Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD), and in accordance with the provisions of Title VII, Chapter I, Second Section, of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). As a result of the investigative actions carried out, it is verified that the responsible for the treatment is the entity VAMAVI PHONE, S.L. BACKGROUND Claim entry date: February 3, 2020. Claimant: A.A.A .. Dated 04/15/2020 in check-in 014582/2020, associated with procedure E / 02271/2020, the AEPD found allegations of the VDF in which it established that he had no record in his database of the number *** PHONE. 2 C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/16 associated with your collaborators who make recruitment calls on your behalf. VDF in that same registry, he stated that the claimant was recorded in the List Robinson corresponding from 08/03/2018. In addition, VDF reports having included in the internal Robinson list of your entity to the telephone line *** TELEPHONE 1 of the claimant as a result of the transfer of the claim, becoming recorded as registered in she. VDF stated that it had not contacted the claimant to notify him of the procedures made by not having your contact information INVESTIGATED ENTITIES As stated in the Diligence, incorporated in the associated Investigation File (E / 09385/2020) on 11/25/2020, the telephone line with number *** TELEPHONE. 2 was operated by SEWAN COMUNICACIONES, as recorded in the Records of Numbering and Telecommunications Operators of the National Commission of Markets and Competition (hereinafter, CNMC). Consequently, during these proceedings, the following has been investigated entity: SEWAN COMUNICACIONES, S.L.U. (hereinafter, the investigated # 1), with NIF B73619215 and address *** ADDRESS. 1. Likewise, by the very course of these previous actions of investigation, the need to proceed to investigate also the following entity: VAMAVI PHONE, S.L. (hereinafter, the VAMAVI), with NIF B87914446 and address *** ADDRESS. 2. RESULT OF INVESTIGATION ACTIONS The claimant's telecommunications operator, XFERA MÓVILES, S.A.U. manifests confirmation of receipt at the number *** PHONE. 1 C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/16 (ownership of the claimant) of the call made by the line *** PHONE. 2, on January 31, 2020 at 11:34:50 am. This line of origin of the call is recorded as incoming in the interconnection platform operated by investigated # 1. The investigated # 1 claims to be a telecommunications operator that provides telephone services to customers, end users and resellers. The investigated # 1 provides a copy of the CNMC public registry of operators in that is thus identified. The investigated # 1 identifies VAMAVI as its client owner of the line telephone *** TELEPHONE. 2 on January 31, 2020 at 11:34:50 a.m., and specifically in its ownership since October 2, 2019. The investigated # 1 alleges that he did not make the call or have a contract or any connection with VDF to advertise its commercial services. The investigated # 1 confirms that the call from the telephone line *** PHONE. 2 to line *** PHONE. 1 (owned by the claimant) produced on January 31, 2020 at around 11:34 a.m. and had a duration of 39 seconds. The investigated # 1 provides a copy of the invoice corresponding to the month of January 2020 issued to VAMAVI, as its client owner of the telephone line *** TELEPHONE. 2, in which said phone call. VAMAVI confirms the realization of a commercial call on January 31, 2020 at 11:34 a.m. to offer commercial services from the VDF, to the line Claimant's telephone number *** TELEPHONE.1 from line *** TELEPHONE.2 (under your ownership). VAMAVI identifies itself as a subagent of the entity SOLIVESA MASTER FRANCHISE, S.L. (hereinafter SOLIVESA), with NIF B97154488, who acts as an authorized commercial distributor of the VDF. VAMAVI provides a contract between you and SOLIVESA dated 03/21/2019, for the activity of intermediation in client registrations through commercial telephone calls in favor of VDF and with a duration of 12 months. VAMAVI states that customer acquisition for VDF through calls commercial telephony occurred in the private segment, self-employed and of micro-enterprises. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/16 VAMAVI claims that it does not have files related to the owners of the lines telephone numbers to which he called commercially due to the fact that lists were generated of random numbers from the list of valid published numberings by the CNMC. VAMAVI provides a copy of the list of telephone numbers allegedly taken from the CNMC. VAMAVI states that it has a Robinson list in which to carry out the filtering to avoid numbers that oppose business calls and add recognize the claimant's telephone line *** TELEPHONE.1 included in said list. VAMAVI alleges, after identifying the claimant's number involved in the commercial call produced, which [sic]: “(…) so it seems that this is a specific error in our filtering system. " FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and as established in articles 47 and 48 of the LOPDGDD, the Director of the Spanish Agency for Data Protection is competent to initiate and to solve this procedure. In accordance with the provisions of article 84.3) of the LGT, the competence to initiate and resolve this Penalty Procedure corresponds to the Director of the Spanish Agency for Data Protection. II The known facts could constitute an infraction, attributable to VAMAVI, for violation of article 48.1.b) of Law 9/2014, of May 9, General of Telecommunications (hereinafter, LGT), included in its Title III, which states: << Article 48. Right to the protection of personal data and privacy in relation with unsolicited communications, with traffic and location data and with subscriber guides. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/16 1. Regarding the protection of personal data and privacy in relation to unsolicited communications end users of communications services electronic will have the following rights: (…) b) To oppose receiving unwanted calls for commercial communication purposes that are carried out through systems other than those established in the previous letter and to be informed of this right. >> Although, the aforementioned article does not configure such a right, so we must go to the data protection rules that regulate the right of opposition: article 21 of the RGPD, (Regulation (EU) 2016/679, of the European Parliament and of the Council, 04/27/2016, regarding the Protection of Natural Persons with regard to the Processing of Personal Data and Free Circulation of this Data) and article 23 of the LOPDGDD (Organic Law 3/2018, of December 5, on Data Protection Personal Rights and Guarantee of Digital Rights). The offense is classified as minor in article 78.11 of said rule, which considers as such: “The breach of public service obligations, of the public obligations and the violation of consumer rights and end users, as established in Title III of the Law and its regulations on developing". This offense can be sanctioned with a fine of up to 50,000 euros, according to with article 79.1.d) of the aforementioned LGT. In accordance with the evidence available at the present time of agreement to initiate the sanctioning procedure, and without prejudice to what results from the instruction, it is considered that the sanction to be imposed should be graduated in accordance with the following criteria established in article 80 of the LGT: As aggravating factors: Art 80.1 of the LGT. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/16 a) The seriousness of the offenses previously committed by the subject to whom the sanctions. This AEPD consists of numerous previous antecedents known to VDF. c) The benefit that the offending event has provided to the offender. The promotional actions are aimed at obtaining profits business. d) The damage caused and its repair. The claimant has had to take action before this AEPD. There are no remedial actions by VDF. g) The cessation of the infringing activity, previously or during the processing of the sanctioning file. There is no evidence of the cessation of the infringing activity. Considering the exposed factors, the initial assessment that reaches the amount of the The fine for the violation of art 48.1.b) of the LGT imputed is € 20,000 (twenty thousand euros). III Article 28 of the RGPD establishes the following: In charge of the treatment <1. When a treatment is to be carried out on behalf of a person responsible for the treatment, it will only choose a manager who offers sufficient guarantees to apply appropriate technical and organizational measures, so that the treatment is in accordance with the requirements of this Regulation and guarantees the protection of the rights of the interested party. 2. The person in charge of the treatment will not resort to another person in charge without prior authorization in writing, specific or general, of the person in charge. In the latter case, the manager will inform the person in charge of any change foreseen in the incorporation or replacement of other managers, thus giving the person in charge the opportunity to oppose to such changes. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 8/16 3. The treatment by the person in charge will be governed by a contract or other legal act with under Union or Member State law, which binds the person in charge with respect to the person in charge and establish the object, duration, nature and purpose of the treatment, the type of personal data and categories of interested parties, and the obligations and rights of the person in charge. Said contract or legal act shall stipulate, in particular, that the person in charge: a) will process personal data only following documented instructions from the responsible, including with respect to transfers of personal data to a third country or an international organization, unless it is obliged to do so under of the law of the Union or the Member States that applies to the processor; in In this case, the person in charge will inform the person in charge of this legal requirement prior to treatment, unless such Law prohibits it for important reasons of interest public; b) will guarantee that the persons authorized to process personal data have committed to respecting confidentiality or subject to an obligation of confidentiality of a statutory nature; c) take all necessary measures in accordance with Article 32; d) will respect the conditions indicated in sections 2 and 4 to resort to another in charge of the treatment; e) will assist the controller, taking into account the nature of the treatment, through appropriate technical and organizational measures, whenever possible, so that this can fulfill its obligation to respond to requests that have as their object the exercise of the rights of the interested parties established in chapter III; f) will help the controller to ensure compliance with the obligations established in articles 32 to 36, taking into account the nature of the treatment and the information available to the person in charge; g) at the choice of the controller, delete or return all personal data once once the provision of treatment services ends, and will delete the copies existing unless the conservation of personal data is required under of the Law of the Union or of the Member States; h) will make available to the controller all the information necessary to demonstrate compliance with the obligations established in this article, as well as to enable and contribute to the performance of audits, including inspections, by part of the person in charge or another auditor authorized by said person in charge. In relation to the provisions of letter h) of the first paragraph, the person in charge will inform immediately to the person responsible if, in their opinion, an instruction violates this Regulation or other provisions on data protection of the Union or of Member States. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 9/16 4. When a processor uses another processor to carry out certain processing activities on behalf of the controller, will be imposed on this other person in charge, through a contract or other legal act established in accordance with Union or Member State law, the same obligations to data protection than those stipulated in the contract or other legal act between the responsible and the person in charge referred to in section 3, in particular the provision sufficient guarantees for the application of appropriate technical and organizational measures so that the treatment is in accordance with the provisions of this Regulation. If that other manager breaches their data protection obligations, The initial manager will remain fully accountable to the person responsible for the treatment with regard to the fulfillment of the obligations of the other in charge. 5. Adherence of the data controller to a code of conduct approved by pursuant to article 40 or to a certification mechanism approved pursuant to article 42 may be used as an element to demonstrate the existence of guarantees sufficient referred to in sections 1 and 4 of this article. 6. Without prejudice to the person in charge and the person in charge of the treatment holding a individual contract, the contract or other legal act referred to in sections 3 and 4 of this article may be based, totally or partially, on the clauses contractual type referred to in sections 7 and 8 of this article, inclusive when they form part of a certification granted to the person in charge of in accordance with articles 42 and 43. 7. The Commission may establish standard contractual clauses for the matters to which refer to sections 3 and 4 of this article, in accordance with the procedure for examination referred to in article 93, paragraph 2. 8. A supervisory authority may adopt standard contractual clauses for the matters referred to in sections 3 and 4 of this article, in accordance with the coherence mechanism referred to in article 63. 9. The contract or other legal act referred to in sections 3 and 4 shall consist of written, including in electronic format. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 10/16 10. Without prejudice to the provisions of articles 82, 83 and 84, if a person in charge of the treatment violates these Regulations by determining the purposes and means of the treatment, you will be considered responsible for the treatment with respect to said treatment> Article 83.4.a) of the RGPD establishes the following: <4. Violations of the following provisions will be sanctioned, in accordance with the section 2, with administrative fines of a maximum of EUR 10,000,000 or, in the case of a company, an amount equivalent to a maximum of 2% of the total annual global business volume of the previous financial year, opting for the highest amount: a) The obligations of the person in charge and the person in charge in accordance with articles 8, 11, 25 a 39, 42 and 43; …>. Article 74.k) of the LOPDGDD, establishes the following: <Infringements considered minor. They are considered mild and will prescribe the remaining infringements of a merely formal nature of the articles mentioned in paragraphs 4 and 5 of Article 83 of Regulation (EU) 2016/679 and, in particular, the following: k) Failure by the person in charge of the stipulations imposed in the contract or legal act that regulates the treatment or instructions of the person responsible for the treatment, unless legally obliged to do so in accordance with Regulation (EU) 2016/679 and the present organic law or in the cases in which it is necessary to avoid the infringement of data protection legislation and have notified the person in charge or the person in charge of the treatment.> IV In the present case, there are reasonable and sufficient indications to consider that the VAMAVI entity, as sub-manager of the treatment now imputed consisting of making commercial calls on behalf of and on behalf of Vodafone C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 11/16 Spain, S.A.U. to numbers included in the advertising exclusion lists Robinson and without having had the due diligence to which it is obliged by the hiring because of its content, and that has led to the violation of Claimant's rights. V In accordance with the evidence available at the present time of agreement to initiate the sanctioning procedure, and without prejudice to what results from the instruction, the known facts could constitute an infraction, attributable to the defendant, for violation of art. 28, offense typified in art. 83.4.a) of said rule considered mild for the purposes of prescription in article 74.k) of the LOPDGDD. SAW In an initial assessment, concurrent aggravating criteria are estimated following graduation: . The high link between the activity of the offender and the performance of treatment of personal information. It is established that VAMAVI is an entity specialized in treatments of personnel in a systematic way. . VAMAVI does not have adequate technical and organizational procedures in place for action in order to comply with the treatment subject to sub-commission in the terms of art 28 of the RGPD, so that the infringement is not the consequence of a punctual anomaly in the operation of these procedures but a defect persistent and continuous of the personal data management system. Considering the exposed factors, the initial assessment that reaches the amount of the The fine for the infringement of art 28 of the RGPD is € 20,000 (twenty thousand euros). Therefore, based on the foregoing, by the Director of the Agency Spanish Data Protection, C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 12/16 HE REMEMBERS: FIRST: INITIATE SANCTIONING PROCEDURE to VAMAVI PHONE S.L., with NIF B87914446, in accordance with the provisions of articles 63 and 64 of Law 39/2015, of 1 October, of the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged infringement of art. 48.1.b) in relation to the art. 21 of the RGPD and 23 of the LOPDGDD, classified as mild in article 78.11 of the mentioned LGT, without prejudice to what results from the instruction. INITIATE SANCTIONING PROCEDURE to VAMAVI PHONE S.L., with NIF B87914446, for the alleged violation of article 28 of the RGPD typified in accordance with Article 83.4.a) of the RGPD. SECOND: APPOINT B.B.B. as instructor. and, as secretary, to C.C.C., indicating that any of them may be challenged, if applicable, in accordance with the established in articles 23 and 24 of Law 40/2015, of October 1, on the Regime Public Sector Legal (LRJSP). THIRD: INCORPORATE to the sanctioning file, for evidentiary purposes, the claim filed by the claimant and its documentation; documents obtained and generated by the General Subdirectorate for Data Inspection during the investigations phase; as well as the report of previous Inspection actions; all of them are part of the file. FOURTH: THAT for the purposes provided for in art. 64.2 b) of the LPACAP, the sanction that could correspond would be 40,000 euros, without prejudice to what results from the instruction. FIFTH: NOTIFY this agreement VAMAVI PHONE S.L., with NIF B87914446, granting him a hearing period of ten business days to formulate the allegations and present the evidence that you consider appropriate. In his writing of C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 13/16 allegations, you must provide your NIF and the procedure number that appears in the heading of this document. If within the stipulated period it does not make allegations to this initiation agreement, the same It may be considered a resolution proposal, as established in article 64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of the Public Administrations (hereinafter, LPACAP). In accordance with the provisions of article 85 of the LPACAP, in the event that the penalty to be imposed would be a fine, you may recognize your responsibility within the term granted for the formulation of allegations to the present initiation agreement; the which will entail a reduction of 20% of the sanction to be imposed in this procedure. With the application of this reduction, the sanction would be established at 32,000 euros, resolving the procedure with the imposition of this sanction. In the same way, you may, at any time prior to the resolution of this procedure, carry out the voluntary payment of the proposed sanction, which will mean a reduction of 20% of its amount. With the application of this reduction, the penalty would be established at 32,000 euros and its payment will imply the termination of the process. The reduction for the voluntary payment of the penalty is cumulative to the corresponding apply for the recognition of responsibility, provided that this recognition of responsibility is made manifest within the period granted to formulate allegations at the opening of the procedure. The voluntary payment of the referred amount in the previous paragraph it may be done at any time prior to the resolution. In In this case, if both reductions should be applied, the amount of the penalty would be set at 24,000 euros. In any case, the effectiveness of either of the two mentioned reductions will be conditioned to the withdrawal or resignation of any action or remedy in administrative against the sanction. In case you choose to proceed to the voluntary payment of any of the amounts C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 14/16 mentioned above, you must make it effective by entering account no. ES00 0000 0000 0000 0000 0000 opened in the name of the Spanish Agency for Data Protection in the banking entity CAIXABANK, S.A., indicating in the concept the reference number of the procedure that appears in the heading of this document and the cause for the reduction of the amount to which it applies. Likewise, you must send proof of admission to the Subdirectorate General of Inspection to continue the procedure according to the quantity entered. The procedure will have a maximum duration of nine months from the date of date of the initiation agreement or, where appropriate, the draft initiation agreement. After this period, its expiration will occur and, consequently, the file of performances; in accordance with the provisions of article 64 of the LOPDGDD. Finally, it is pointed out that in accordance with the provisions of article 112.1 of the LPACAP, There is no administrative appeal against this act. 167-200320 Mar Spain Martí Director of the Spanish Agency for Data Protection >> SECOND: On February 5, 2021, the defendant has proceeded to pay the sanction in the amount of 24,000 euros making use of the two planned reductions in the Initiation Agreement transcribed above, which implies the recognition of the responsibility. THIRD: The payment made, within the period granted to formulate allegations to the opening of the procedure, entails the waiver of any action or appeal in the process administrative against the sanction and the recognition of responsibility in relation to the facts to which the Initiation Agreement refers. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 15/16 FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and as established in art. 47 of Organic Law 3/2018, of 5 December, Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection is competent to sanction the infractions that are committed against said Regulation; infractions of article 48 of Law 9/2014, of May 9, General of Telecommunications (hereinafter LGT), in accordance with the provisions of the article 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and 38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of the information and electronic commerce (hereinafter LSSI), as provided in article 43.1 of said Law. II Article 85 of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations (hereinafter, LPACAP), under the rubric "Termination of sanctioning procedures" provides the following: "one. Initiated a sanctioning procedure, if the offender acknowledges his responsibility, the procedure may be resolved with the imposition of the appropriate sanction. 2. When the sanction is solely of a pecuniary nature or it is possible to impose a pecuniary sanction and other non-pecuniary sanction, but the inadmissibility of the second, the voluntary payment by the presumed responsible, in any time prior to the resolution, will imply the termination of the procedure, except in relation to the replacement of the altered situation or the determination of the compensation for damages caused by the commission of the offense. 3. In both cases, when the sanction is solely of a pecuniary nature, the competent body to resolve the procedure will apply reductions of, at least, 20% of the amount of the proposed penalty, these being cumulative among themselves. The aforementioned reductions must be determined in the notice of initiation of the procedure and its effectiveness will be conditioned to the withdrawal or resignation of any action or appeal in administrative proceedings against the sanction. The percentage of reduction foreseen in this section may be increased regulations. In accordance with the above, the Director of the Spanish Agency for the Protection of Data RESOLVES: FIRST: DECLARE the termination of procedure PS / 00026/2021, of in accordance with the provisions of article 85 of the LPACAP. SECOND: NOTIFY this resolution to VAMAVI PHONE, S.L .. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 16/16 In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure as prescribed by the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations, interested parties may file an appeal administrative litigation before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following notification of this act, as provided in article 46.1 of the referred Law. 936-031219 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es