| AEPD - PS/00031/2020 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 21 GDPR Article 48(1)(b) Ley 9/2014 General de Telecomunicaciones |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | 1200 EUR |
| Parties: | n/a |
| National Case Number/Name: | PS/00031/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | n/a |
The Spanish DPA (AEPD) fined a company €1200 for contacting a complainant via telephone for marketing, without the consent of the complainant.
English Summary
Facts
The company called the complainant offering them a deal on hotels; they claimed to have obtained the complainant's telephone number and consent to call the complainant by contacting a friend of the complainant via Whatsapp. The consent of the complainant themselves had not been obtained. The complainant then objected to the contact made by the company and no further contact was made.
Dispute
Was the company in breach of any data protection laws?
Holding
In its decision, the AEPD held that the company had violated a provision in Spanish law, Article 48(1)(b) of the 2014 Telecommunications Law (Ley 9/2014 General de Telecomunicaciones). The fine was issued on this basis. However, the AEPD also noted that the complainant had a right to object to processing for marketing purposes under Article 21 GDPR. Despite no further contact being made the company, the AEPD still fined the company for the initial establishment of contact, which took place without the complainant's consent. The fine was initially €1500, but was reduced €1200 of the basis of the company's voluntary early payment of a fine. Under Spanish law, such a payment entails the waiver of any action or appeal in administrative proceedings against the sanction.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Procedure No.: PS/00031/2020 RESOLUTION R/00314/2020 TO TERMINATE THE PROCEDURE FOR PAYMENT IN THE PS/00031/2020 sanctioning procedure, instructed by the Spanish Data Protection Agency to TOUR & PEOPLE MAX S.L, In view of the complaint submitted by A.A.A., and on the basis of the following, FIRST BACKGROUND: On 30 March 2020, the Director of the Spanish Data Protection Agency agreed to initiate disciplinary proceedings against TOUR & PEOPLEMAXS.L. (hereinafter, the claimed), by means of the Agreement that is transcribed: <Procedure Nº: PS/00031/2020AGREEMENT TO START PENALTIATION PROCEEDINGS On the actions carried out by the Spanish Data Protection Agency and based on the following FIRST: D. A.A.A. (hereinafter, the claimant) dated 23/10/2019 filed a complaint with the Spanish Data Protection Agency. The claim is against TOUR & PEOPLE MAX S.L., with NIF B93016707 (hereinafter, the claimant). The reasons on which the complaint is based are: that on 23/10/2019 he received a call from the telephone number ***TELÉFONO.1, in the name of the company Ocio Hoteles, stating that a friend had given them his telephone number in order to offer him a hotel voucher; that the operator quoted names of other friends, telling him/her that they have joined the promotion; that he/she subsequently contacts his/her friend through Whatsapp confirming his/her suspicion that he/she has not authorized them to contact him/her; that since he/she has not authorized the claimed person to contact him/her for advertising purposes, and being registered on the Robinson list, he/she considers such call an intrusion and a violation of his/her data privacy. SECOND: After receiving the complaint, the Subdirectorate General of Data Inspection proceeded to carry out the following actions: On 26/11/2019, reiterated on 10/12/2019, the complaint presented was transferred to the respondent for analysis. Likewise, it was required to send certain information to the Agency within a period of one month: - Copy of the decision adopted; - Report on the causes of the incident that gave rise to the complaint; - Report on the measures adopted to prevent similar incidents from occurring. Any other that you consider relevant. On 27/01/2020 the complainant stated that the claimant had not exercised his right to access his data; that the claimant had proceeded to delete the data from the claimant after his request not to be called again; that the claimant had not refused to provide the origin of the personal data of the claimant since these data had been provided by a friend of his; that in the message that the claimant receives from his friend at no time does he state that he has not provided the claimant's data to the claimant; that when the claimant receives the refusal not to contact the claimant again, he proceeds to delete it so that no further connection is made. It provides a description of the conversion with the claimant and his friend. On 04/02/2020, in accordance with article 65 of the LOPDGDD, the Director of the Spanish Data Protection Agency agreed to admit for processing the claim presented by the claimant against the claimed. FUNDAMENTOS DE DERECHO I In accordance with the provisions of article 84.3) of Law 9/2014, of 9 May, General of Telecommunications (LGT), the competence to resolve the present Sanctioning Procedure corresponds to the Director of the Spanish Data Protection Agency. In the present case, it has been verified that the interested party, being included in the Robinson List, was called by the company in question to make a commercial call. The facts set out (the violation of the right of opposition) could imply the commission by the entity in question of an infringement of Article 48.1.b) of the LGT, contained in its Title III, which states that: "With regard to the protection of personal data and privacy in relation to directories of subscribers, the end users of electronic communications services shall have the following rights: (... ) b) To object to receiving unwanted calls for commercial communication purposes which are made through systems other than those established in the previous paragraph and to be informed of this right": Article 21 of the RGPD, (Regulation (EU) 2016/679, of the European Parliament and the Council, of 27/04/2016, relating to the Protection of Individuals with regard to the Processing of Personal Data and the Free Movement of such Data) and Article 23 of the LOPDGDD (Organic Law 3/2018 of December 5, Protection of Personal Data and Guarantee of Digital Rights). This infraction is classified as "slight", in article 78.11), which considers as such: "The failure to comply with public service obligations, public obligations and the violation of the rights of consumers and end users as established in Title III of the Law and its implementing regulations", and may be sanctioned with a fine of up to 50. 000, in accordance with article 79.d) of the aforementioned GLT.IIIDe in accordance with the indicated precepts, and without prejudice to what may result from the instruction of the procedure, for the purposes of fixing the amount of the penalty to be imposed in the present case, it is considered that the penalty to be imposed should be graduated in accordance with the following criteria established in article 80 1) and 2) of the GLT: -The cessation of the offending activity, before or during the processing of the former offending party (section g). After the evidence obtained in the phase of previous investigations, it is considered that the sanction to be imposed should be graduated in the amount of 1,500 euros (one thousand five hundred euros). Therefore, in accordance with the above, By the Director of the Spanish Data Protection Agency, IT IS AGREED: TO INITIATE PENALTY PROCEEDINGS against the entity TOUR & PEOPLE MAXS.L., with NIF B93016707, for the alleged infringement of Article 48.1.b) of the Law LGT, classified as "minor" in Article 78.11) of the aforementioned Law LGT.2, NAME B.B.B. as instructor and C.C.C. as secretary, indicating that any of them may be challenged, if appropriate, in accordance with the provisions of Articles 23 and 24 of Law 40/2015, of 1 October, on the Legal System of the Public Sector (LRJSP).3. THAT for the purposes set forth in Article 64.2 b) of the LPACAP, the sanction that may correspond would be 1,500 euros (one thousand five hundred euros), without prejudice to the results of the investigation.5. TO NOTIFY this agreement to TOUR & PEOPLE MAX S.L., with NIFB93016707, granting it a period of ten working days to make allegations and present the evidence it deems appropriate. If you do not make any allegations about this agreement within the stipulated period, it may be considered a proposal for a resolution, as established in article 64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP). In accordance with Article 85 of the LPACAP, if the penalty to be imposed is a fine, it may acknowledge its liability within the time limit granted for the submission of arguments on the present agreement to initiate the proceedings; this will be accompanied by a reduction of 20% of the penalty to be imposed in the present proceedings. With the application of this reduction, the penalty would be 1,200 (one thousand two hundred euros), and the procedure will be resolved with the imposition of this sanction. Similarly, at any time prior to the resolution of this procedure, you may carry out the voluntary payment of the proposed sanction, which will involve a reduction of 20% of its amount. With the application of this reduction, the sanction would be established at 1,200 euros (one thousand two hundred euros), and its payment would imply the termination of the procedure. The voluntary payment of the amount referred to in the previous paragraph may be made at any time prior to the decision. In this case, if both reductions were to be applied, the amount of the sanction would be set at 900 (nine hundred euros). In any case, the effectiveness of either of the two reductions mentioned will be conditioned by the withdrawal or renunciation of any action or appeal in administrative proceedings against the sanction. In the event that you choose to proceed with the voluntary payment of any of the amounts indicated above (1,200 or 900 euros), you must make it effective by depositing it in the account nº ES00 0000 0000 0000 0000 opened in the name of the Spanish Data Protection Agency at the CAIXABANK,S.A. Bank, indicating in the concept the reference number of the procedure that appears in the heading of this document and the cause of the reduction of the amount to which it is given. Likewise, you must send the proof of payment to the Subdirectorate General of Inspection to continue with the procedure in accordance with the amount paid. Once this period has elapsed, it will expire and, consequently, the actions will be archived; in accordance with the provisions of Article 64 of the LOPDGDD. Finally, it is noted that in accordance with the provisions of Article 112.1 of the LPACAP, there is no administrative appeal against this act. Mar Spain Martí Director of the Spanish Data Protection Agency >> SECOND: On July 16, 2020, the claimant has proceeded to pay the penalty in the amount of 1,200 euros by making use of one of the two reductions provided for in the Agreement transcribed above. Therefore, the acknowledgement of liability has not been accredited. THIRD: The payment made entails the waiver of any action or appeal in administrative proceedings against the sanction, in relation to the facts referred to in the Agreement of Commencement. LAW FUNDAMENTS By virtue of the powers that article 58.2 of the RGPD recognises to each control authority, and in accordance with the provisions of art. 47 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter referred to as LOPDGDD), the Director of the Spanish Data Protection Agency is competent to sanction the infringements committed against the said Regulation; the infringements of Article 48 of Law 9/2014, of May 9, General of Telecommunications (hereinafter referred to as LGT), in accordance with the provisions of Article 84. 3 of the GLT, and the infringements defined in articles 38.3 c), d) and i) and 38.4 d), g) and h) of Law 34/2002, of 11 July, on information society and electronic commerce services (hereinafter LSSI), in accordance with article 43.1 of said Law. II Article 85 of Law 39/2015, of 1 October, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), under the heading "Termination in sanctioning proceedings", provides that: "1. When the sanction is only pecuniary in nature, or when a pecuniary and a non-pecuniary sanction can be imposed but it has been justified that the latter is not appropriate, the voluntary payment by the presumed responsible party at any time prior to the resolution will imply the termination of the procedure, except for the replacement of the altered situation or the determination of the compensation for damages caused by the commission of the infringement.3 In both cases, where the penalty is purely financial in nature, the body responsible for deciding the procedure shall apply reductions of at least 20% to the amount of the penalty proposed, which may be cumulative. These reductions shall be determined in the notification of initiation of the procedure and their effectiveness shall be conditional upon the withdrawal or renunciation of any action or appeal against the penalty in administrative proceedings. "In accordance with the above, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: TO DECLARE the termination of procedure PS/00031/2020, in accordance with the provisions of Article 85 of the LPACAP. SECOND: TO NOTIFY this resolution to TOUR & PEOPLE MAX S.L. In accordance with the provisions of Article 50 of the LOPDGDD, this resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure according to the provisions of article 114.1. c) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, the interested parties may file an administrative appeal with the Administrative Chamber of the National Court of Justice, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of 13 July, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following notification of this act, as provided for in Article 46. 1 of the aforementioned Act. Mar España Martí Director of the Spanish Data Protection Agency
