AEPD - PS/00197/2020
|AEPD - PS/00197/2020|
|Relevant Law:||Article 5(1)(b) GDPR|
Article 5(1)(c) GDPR
Article 6(1)(f) GDPR
Article 6(1)(b) GDPR
Article 58(2) GDPR
Article 3(2) Royal Decree 1435/2002
Article 3(3) Royal Decree 1435/2002
Article 4(4) Royal Decree 1164/2001
Article 47 LOPDGDD
|Parties:||Energia y Servicios Aby 2018 SL|
I-DE, Redes Eléctricas Inteligentes SAU
|National Case Number/Name:||PS/00197/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish DPA (AEPD) imposed a fine of €200,000 on the energy supplier, I-DE, Redes Eléctricas Inteligentes SAU. I-DE had sent a letter to end consumers requiring them to get in touch with regards to unpaid invoices despite a contractual arrangement providing for an intermediary to communicate with end users (breach of Articles 6(1)(b), 5(1)(b) and 5(1)(c) GDPR).
English Summary[edit | edit source]
Facts[edit | edit source]
Energia y Servicios Aby 2018 SL (ESA 2018) and Watium SL filed a complaint against I-DE, Redes Eléctricas Inteligentes SAU (I-DE, previously Iberdrola Distribución Eléctrica) before the Spanish DPA (AEPD).
Watium is an electric power trading company which is subscribed with the energy distribution company I-DE by way of a network access contract (ATR). This contract is refers to Articles 3(2) and 3(3) of the Royal Decree 1435/2002. The contract included the identification and contact of the end consumer, the logo of Iberdrola Distribución Eléctrica (now i-DE) and the identification of Watium. Although signed by the two entities, there is no place for the end consumer's signature in the contract.
In the letters sent by Iberdrola/I-DE to Watium end consumers in 2018, Iberdrola/I-DE stated that the were forced to send Watium (according to the law) a request for payment for unpaid invoices. They requires that the end consumer get in contact with their provider company.
Watium informed these facts to the Spanish Competition Authority (Comisión Nacional de los Mercados y la Competencia - CNMC) and the Spanish DPA (AEPD) in January 2018.
At the time, the AEPD issued a report stating that it could be concluded that processing of personal data carried out by I-DE violated data protection law (legal basis and data protection principles). The report highlighted that the appropriate legal basis would have been contractual necessity (Article 6(1)(c)) but the processing of personal data of the consumer (who acts by way of an intermediary) is not necessary for the fulfillment of that contract as the intermediary is precisely there to deal with the communication with these types of communications. The AEPD at the time added that I-DE violated the principles of purpose limitation and data minimisation (Article 5(1)(b) and (c)).
In January 2020, Energia y Servicios Aby 2018 SL (ESA 2018), another electric power trading company subscribed to I-DE complained to the AEPD about identical letters of non-payment sent directly to end consumers.
The CNMC outlined that it could not be concluded that I-DE had not acted anti-competitively in breach of Competition Law.
Dispute[edit | edit source]
Did sending a letter to require an end consumer of an energy distributor to get in touch with regards to a unpaid invoice when an intermediary was set up communicate with the end user breach Articles 6(1)(b), 5(1)(b) and 5(1)(c) GDPR?
Holding[edit | edit source]
The Spanish DPA (AEPD) deemed itself competent under Article 58(2) GDPR in conjunction with Article 47 of the Spanish Data Protection Law (LOPDGDD) despite the Competition Law aspect of the case.
The DPA went on to outline that the contract between the two complainants and I-DE were network access contracts (ATR) which refer to Articles 3(2) and 3(3) of the Royal Decree 1435/2002 (which regulates the conditions for contract for the acquisition of energy and access to low voltage network). The DPA analysed the wording of the contract against Article 3(2) Royal Decree 1435/2002 and outlined that this provision refers to data protection law in relation to processing of personal data. The DPA specified that the principle of purpose limitation (Article 5(1)(b) GDPR) was relevant. In this ATR contract, reference to Article 3(2) of the Royal Decree established that the purpose for transferring personal data to I-DE would be exclusively so it provides the end consumer with electricity. Therefore, the letters of non-payment that I-DE sent to end consumers directly breached the contract terms and were incompatible with the purpose stated in Article 3(2) of the Royal Decree. Similarly, the principle of data minimisation (Article 5(1)(c) GDPR) was infringed as a result.
In relation to the reference to Article 3(3) of the Royal Decree, the Spanish DPA outlined that this meant that if the distributor (I-DE) wishes to address the end consumer, it should only do so through the "marketer" acting as an intermediary (i.e. Watium or ESA 2018). Therefore, the distributor should not directly communicate with the end consumer since there is an intermediary for this.
The DPA conceded that Article 4(4) of the Royal Decree 1164/2001 provides that the distributor can suspend the electricity supply as a result of non-payment and can contact the end user with the sole aim of requiring payment. Therefore, communication between the distributor and the end consumer is limited. However, the Spanish DPA held that in this context, I-DE sent an informational letter, to request them to get in touch to comply with the contractual obligations. Therefore it cannot be said that I-DE's action fell within the permission granted under with Article 4(4) of the Royal Decree 1164/2001.
The DPA went on to address the intervention of the Spanish Competition Authority. It clarified that the Competition Authority notified the Spanish DPA that it did not consider I-DE's actions to be anti-competitive in breach of competition law. It also accepted the fact that the Competition Authority had been aware that I-DE sent letters. However, it was not information received from I-DE directly.
In relation to the legal basis for processing data, the Spanish DPA clarified that I-DE claimed to rely on Article 6(1)(f) GDPR. However, the DPA held that I-DE provided no reasoning nor evidence of balancing the interests at stake. There was therefore nearly no justifications for relying on Article 6(1)(f) in ID-E's submissions. The DPA outlined that I-DE would have had to demonstrate, after a balancing of factors, that there was a legitimate interest pursued by the distributor or marketer that outweigh the end consumer's rights and freedoms. According to the DPA, the nature of the letter by I-DE appeared almost like a threat or pressure to contact the distributor. Therefore, it did not count as a legitimate interest that outweighed the rights and freedoms of the end consumer even if the ultimate end interest for the distributor was getting the payment owed. The DPA concluded that the distributor would have a right to recover the money owed, but this should not be confused with an illegal processing of personal data.
As such, the Spanish DPA imposed a fine of € 200000 on I-DE for the violation of Article 6(1)(b), Articles 5(1)(b) and Article 5(1)(c) GDPR.
Comment[edit | edit source]
This decision is interesting given the ongoing discussion on cooperation between national data protection authorities and national competition authorities. It is clear that the two legal fields are increasingly interacting with one another.
It is interesting that there was interactions between the Spanish DPA and Spanish Competition Authority in the assessment of facts.
Additionally, the DPA investigated the wording of the legislation on network access contracts in light of data protection law.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Page 1 1/37 Procedure No.: PS / 00197/2020 938-0419 RESOLUTION OF SANCTIONING PROCEDURE In the sanctioning procedure PS / 00197/2020, instructed by the Spanish Agency for Data Protection, to the entity, I-DE REDES ELÉCTRICAS INTELIGENTES, SAU (I-DE), previously known as IBERDROLA SA, with CIF: A95075578, (hereinafter above, “the claimed entity”), by virtue of the complaints filed by the entity WATIUM, SL, with CIF .: B86459260 and by the entity ENERGIA Y SERVICIOS ABY 2018, SL, with CIF .: B85114098, (hereinafter, “the complaining entities”), and in based on the following: BACKGROUND FIRST: On 03/11/19, you had a written entry in this Agency, presented by the complaining entity, WATIUM SL, in which he filed a claim against the entity I-DE, for, among others, the sending of a series of letters to its clients by the claimed entity distracting the purpose for which the data was transferred and lacking the legal basis to contact them, in breach of formal reiterated the principles of limitation of the purpose and the principle of minimization of data. Said complaint is fully reproduced, both in the opening brief of file, dated 07/24/20, as well as in the draft resolution proposal, of date 11/25/20. SECOND: In view of the facts set forth in the claim and the documents provided by the claimant, the Subdirectorate General for Data Inspection proceeded to carry out actions for its clarification, under the powers of investigation granted to the control authorities in article 57.1 of the Regulation (EU) 2016/679 (RGPD). Thus, dated 06/25/19, informative requirements were addressed to the claimed entity. THIRD: On 06/25/19, the claimed entity sent this Agency a written of allegations to the complaint presented by the complaining entity, reproduced, both in the brief initiating the file, dated 07/24/20, as well as in the Resolution, dated 11/25/20. FOURTH: On 01/08/20, he entered this Agency, written by the entity ENERGÍA Y SERVICIOS ABY 2018, SL., In which he filed a claim against the entity I-DE, for, among others, the illicit remittance of a series of letters to its clients by the claimed entity. Said complaint is fully reproduced, as- to in the brief of initiation of the file, dated 07/24/20, as in the brief of motion for a resolution, dated 11/25/20. FIFTH: On 02/20/20, and in view of the facts presented in the allegations submitted by the claimed entity, a request for a report is addressed to the COMMISSION NATIONAL OF MARKETS AND COMPETITION, (CNMC), Subdirectorate of Regulation of Electronic Communications. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 2 2/37 SIXTH: On 03/10/20, the CNMC sent an explanatory report to this Agency, including fully reproduced, both in the brief of initiation of the file, dated 07/24/20, as in the draft resolution proposal, dated 11/25/20. SEVENTH: In view of the denounced facts, of the documentation provided by the parties and in accordance with the evidence available, the Director of the Spanish Data Protection Agency, on 07/24/20, agreed to initiate procedures sanctioning the entity claimed, by virtue of the powers established, by alleged breach of the provisions of articles 5.1.b) and c) and 6.1.b) of the RGPD, punishable in accordance with the provisions of art. 58.2 of the aforementioned RGPD, proposing a initial penalty of 200,000 euros (two hundred thousand euros), without prejudice to what results I know of the instruction of the sanctioning procedure. EIGHTH: On 08/17/20, the claimed entity filed before this Agency in writing to of allegations at the initiation of the sanctioning file, reproduced in the brief resolution proposal, dated 11/25/20. NINTH: On 10/21/20, the test practice period began, agreeing- it is in the same: a) .- to consider reproduced for evidentiary purposes the complaint filed by the complainant and its documentation, the documents obtained and generated that are part of file E / 03624/2019 and b) .- consider reproduced for probable purposes. tories, the allegations to the agreement to initiate PS / 00197/2020, presented by the entity claimed dad. TENTH: On 11/25/20, the claimed entity is notified of the proposed resolution solution in which it was proposed that, by the Director of the Spanish Protection Agency tion of Data the claimed entity is sanctioned, for infringement of the articles 5.1.b) and c) and 6.1.b) of the RGPD, with a fine of 200,000 euros (two hundred thousand euros), in accordance with the provisions of article 58.2) of the aforementioned RGPD. ELEVENTH: After notification of the proposed resolution, dated 12/18/20, the claimed entity submitted a brief of allegations to the proposed resolution, in the which indicated the following: “As a preliminary question, this part considers it necessary to show that the same ma can only reiterate the totality of what was indicated in its brief of allegations to the Initiation Agreement relapsed in this file, since, in our opinion, the content of the Proposed Resolution hardly contains different arguments or additional to those expressed in the aforementioned Initiation Agreement. And it is that even when the Proposal for Resolution appears to lead to carry out a legal analysis of the question raised in the present proceeding, such a This is purely apparent, for nearly thirty of his forty-eight parents gines are limited to reproduce in their entirety the allegations made by this party to the Initiation Agreement. In turn, with regard to the fundamentals of law, under the guise of a alleged refutation of the arguments supported by this part, the Proposal for Re- solution does not even substantiate the reasons that lead to the rejection of the totality of the allegations made by my client in the Initiation Agreement, limiting itself to contradict what this party alleged in said brief through arguments that include are partially reproduced, and not in their entirety, the applicable legal provisions C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 3 3/37 with the sole purpose of reinforcing the sanctioning sense of the decision adopted even when the quotation of the precept on which they are apparently based is partial. In this way, in the opinion of my client, the Proposal for a Resolution even includes: Regarding the Initiation Agreement, less legal bases that allow this party to You adequately defend the legality of the treatment of your clients' data carried out carried out by sending the letters referred to in this procedure. suffering, despite his appearance, from a complete lack of motivation that prevents my client from making adequate use of his right to defense. All of this implies, in our opinion, a violation by the Proposed Resolution tion of the principle of legal certainty, as well as their right to judicial protection effective, enshrined respectively by articles 9.3 and 24 of the Constitution. Having made the above considerations, and even when this implies a certain reiteration Regarding the allegations already made by my client, they will try to expose, In short, the arguments that, in the opinion of my client, justify without any No doubt, the complete lawfulness of his conduct. To do this, even altering the systematic ca followed by the Proposal for Resolution, first reference will be made to the substantive issue that is the subject of this proceeding, that is, to the absolute legality of the conduct of my client in this case, to analyze later- the serious formal defects in which, in the opinion of my principal, the present procedure and, finally, the inadequate assessment made by the AEPD of the circumstances that concur in the case and that, in his opinion, aggravate the responsibility bility of I-DE. SECOND.- NON-EXISTENCE IN THE CONDUCT OF I-DE VIOLATION OF THE PERSONAL DATA PROTECTION REGULATIONS 1. On the full compliance of the action carried out by my client with the Civil Code and the regulatory regulations of the electricity sector My client, in the second of his allegations to the Initiation Agreement, fully produced in the Proposal for Resolution, explained in detail the legality of the treatment data collection carried out by the same as necessary for the proper performance return of the contractual relationship that links you with the final energy consumer with which you sign the corresponding network access contract (in addition, above, “ATR”), with the marketer acting as a mere representative representative of the representative of said consumer. Given the length of the aforementioned allegation and that, on the other hand, it has not been object of an effective contradiction in the Proposed Resolution, understands this part that now only proceeds to reiterate the summary of the aforementioned arguments which was included in section 7 of the aforementioned second claim, in the following terms: minos: "1. Consumers of electricity must sign, together with the supply contract, with a marketer, a contract for access to networks, with the distributor holding of the existing network in its geographic area (in this case I-DE), being parts of di- cho contract the distribution company and the final consumer. 2. The consumer may enter- commend the signing of said contract to the marketer with whom they had contracted supply, being able to sign the access contract with the distributor, but in in any case as agent or substitute for the consumer and acting in any case in name and on behalf of the former and by virtue of sufficient power of attorney. 3. In no In this case, they will apply to the contract entered into by the marketer as a mandate. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 4 4/37 the client's rules of the non-representative mandate, maintaining the relationship contractual, in any case, between the distributor and the customer who owns the supply point. another. 4. Consequently, there would not be properly an assignment to the distributor of the data. the consumer by the marketer, since these data would be obtained by the distributor primarily, by referring to the party with whom it has a relationship contractual, signed by a mere agent. 5. Within the different obligations contractual of the access contract is the payment of the access tolls, of which the mandatory marketer and the client would jointly and severally respond. He in- fulfillment of this obligation two months after the request for Payment of these tolls enables the distribution company to suspend supply electric. 6. In the present case, even though the clients had satisfied the co- marketing company the amount of access tolls, it had not paid I-DE the amount of these, for which my client required payment to the marketer, directed Giving the request to your home, as stated in the contract and in compliance with compliance with current legislation. 7. After the legally established period has elapsed without the request was attended, and thus showing my client the right to suspend the supply, I-DE communicates to its customers this circumstance and the consequences that This may be accompanied, expressly stating that said writing In no way does it imply a request for payment to customers. 8. Therefore, my man- dante is limited to communicate in the normal development of its contractual relationship with his clients, highlighting the breach by his agent of the obligations actions derived from the contract in order for the clients to adopt the measures that it deems appropriate. 9. The CNMC is aware of the sending of these communications nes, at least as a result of the complaint made by the marketer. However, said Commission agrees not to proceed with any proceeding against me. but to transfer the antecedents to the Directorate of Energy so that they can investigate tigue the possible violation of the sectoral regulations by the marketer. " 2. Regarding the legality of sending the communications as a consequence of the non-compliance payment of fees and suspension of supply that may lead to corporal I-DE The Proposal for a Resolution limits itself to stating that, even though it seems to be recognized expressly the existence of an ATR contract between my client and the consumers final authorities, only the acts of communication between the parties of this that are expressly included in the law, being forbidden any communication tion related to the contract itself that is not the subject of this express legal reflection. Indeed, the Proposal focuses the entirety of its argumentation on considering that, As indicated on page 43, after citing the acts of communication between the parties to the contract that are included in the electrical legislation, "between the detailed relationship exposed, no point is found or written about the sending of infor- explanations explaining to the final consumer, among other things, the alleged non-compliance contractual relationship between the marketing company and the distribution company, such as is the case that concerns us ”, adding later that“ the sending of infor- control to final consumers of the alleged contractual breaches of the marketer with the distributor does not fall within the range of communications tions necessary and pertinent for the performance of the contract by the entity distribution authority ”, since, it seems, these communications should be carried out carried out “only and exclusively through a marketer, as the latter has constituted do as a consumer agent before the distributor ”. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 5 5/37 Thus, the Proposal seems to consider that even when there is a relationship contractual agreement between the distribution company and the final consumer, even if the cializer signs the ATR contract as agent (with express power, that is, without act on their own behalf) of the consumer, the development of said relationship only allows limited communication between the parties, and it is not possible for them to are related not even for such an essential aspect within the framework of the relation such as the suspension of the provision of one of the parties as a conse- of the contractual breach attributable to the other, even though said non-compliance compliance is committed by his agent, since the consumer responds solicitously daily with the marketer of the payment of the fees. And it is that, regarding the cause that, ultimately, justifies the remission of the communications tions that, in the opinion of the AEPD determines the illegality of the conduct of my client, The Proposed Resolution on pages 44 and 45 states the following: “If we enter into the content of the letters sent by the claimed entity to the final consumers (point 5 of the allegations), we must indicate that the article 52.3 of the LSE, refers to the possible suspension of the supply contract when it is the final consumer who defaults and this is established in the referred Article: “3.- (…) the supply of electricity to consumers may be suspended. meters under voluntary prices for the small consumer or last-minute rates appeal when at least two months have elapsed since they had been reliably required payment without it having been made effective. (…) " but in the present case, this does not happen, since, in the absence of evidence to the contrary, the final consumer if he complies with his obligation to pay the cost of the invoice when trading and apparently, it is he who fails to comply with his obligation vis-à-vis the distributor. dor: " Apart from the confusing wording of the paragraph reproduced, it causes at least per- plejidad to my client the fact that the Proposal for Resolution omits, in the production of article 52.3 of Law 24/2013, of December 26, on the Electricity Sector. co (hereinafter, “LSE”) the referral made expressly in its first subsection, se- according to which the possibility of suspension of supply will take place “[s] without prejudice to what is established in the fourth section of this article, under the conditions glamentarily determined ”. And said omission is essential in the present case, since article 4.4 of the Royal Decree 1164/2001, of October 26, which establishes access fees to the electricity transmission and distribution networks (hereinafter, “RD 1164/2001 ”), which is the one that determines the conditions to which the aforementioned article refers. Assignment 53.2, establishes the following: “The distribution company may suspend the access fee contract when it has- and at least two months have elapsed since he had reliably required the payment to the consumer or his agent, in accordance with the scope of the access raffles established in article 1, section 1, of this Royal Decree, without that it had become effective. For these purposes, the requirement is practiced It will be by referral, to the address that for communication purposes appears in the counter- access fee, by any means that allows proof of reception. tion by the interested party, as well as the date, identity and content of this, being the distribution company obliged to keep in its possession the accreditation of the notification cation made. In the event of rejection of the notification, the circumstances of the attempt to notify and the process will be considered completed. Bliss C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 6 6/37 Communication must include the process of disconnection of the consumer from the networks of distribution for non-payment, specifying the date from which the dis- connection, if the amounts owed are not paid on a prior date. " That is, article 4.4 of RD 1164/2001, which is the one that establishes the conditions in that the suspension of the electricity supply may take place as a result of the non-payment of the ATR contract rates, does not limit the communications of my client with the client, but only the possibility of requesting the same directly the payment of the fee (despite your status as a debtor and the joint and several liability that proclaims in the same normative body). And indeed, my client at no time ment has required the consumer to pay said fee which, on the other hand, he already has satisfied the marketer, but is limited to showing him that this marketer has not paid the fee, previously paid by him, and that this may entail for that consumer the consequence, which evidently It directly affects the suspension of the electricity supply. Because the consequence of the marketing company not paying the amount of said rates to the distributor, regardless of her condition as agent of the consumer at the signing of the contract, it will be the suspension of the electricity supply to said consumer. For this purpose, it is irrelevant with regard to the application of article 52.3 of the LSE that the consumer has or has not paid said rates to the marketer, given that the consequence in either case will be the aforementioned suspension, no matter how much The AEPD intends through the resolution that could fall into this procedure I wish to alter the effect derived from this default. And based on this indisputable conclusion, which is that in case of neglect of the complaint by the marketer may proceed to the suspension of supply electricity to the final consumer, my client understands that it is necessary for the When maintenance and development of the contract that it holds with its client, the end consumer, warn him of said suspension so that at least he can have co- anticipation of a suspension of supply that I-DE may, in accordance with I comply with the provisions of the legislation, carry out once two months have elapsed from the realization of the requirement to the consumer himself or to the marketer. In this sense, it is necessary to show that this behavior has occurred in all case in relation to the Claimant, Watium, SL, to the extent that my mandate as expressly communicated to WATIUM in burofax with a certificate of content of November 2, 2018 (which appears on folios 49 to 52 and is reproduced again on folios 87 to 89 of the administrative file), it has been forced, only in the period between the months of January and October 2018, according to the request Watium according to the aforementioned article 4.4 of RD 1164/2001 the payment of fees access on FOUR HUNDRED TWENTY-NINE (429) occasions. Each of those 429 requirements refer to remittances of unpaid invoices from many million of customers, with respect to whose supply contracts the procedure of suspension of supply. Finally, in 2018, my client had to reliably request the mercantile Watium on FIVE HUNDRED THIRTY-SIX (536) occasions, in the fiscal year 2019 on FIVE HUNDRED THIRTEEN OCCASIONS (513) and so far this year 2020 on ONE HUNDRED TWELVE (112) occasions, having initiated the procedure of sus- supply pension for tens of thousands of electricity supply contracts. Well, the AEPD understands that this communication cannot take place, even when where there is a contractual relationship between I-DE and the consumer, as it does not appear expressly C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 7 7/37 mind set in any standard. That is, according to the AEPD reason, my client does not it cannot only inform the consumer of the suspension of the electricity supply due to payment of ATR fees, but is obliged not to inform you, owing in all case proceed to the suspension of supply without prior notice to the consumer, as another This is a violation of the personal data protection regulations. The The consumer must thus see his supply suspended without prior notice and even after knowing diligently fulfilled its obligations derived from the ATR contract, given that in If this warning is carried out, the AEPD would deploy against the distributor all its coercive powers. In this sense, it is still clarifying that the claim that gave rise to the This procedure does not come from any of the I-DE clients, who are the lares of the fundamental right to the protection of your personal data, but of Wa- tium, and we also understand that this is not based on a will of said mercantile to protect the rights of the interested parties, but solely and exclusively to prevent my principal adopt the measures that may reveal the illegality of his pious conduct. That is to say, in this context it might be asked whether, in view of the facts concurrent, it is not surprising to the AEPD that no I-DE client considers violated their right, not having made a single claim before it. tion on the part of these and that, however, claims are only filed by part of those who put the proper development of supply contracts at risk. other of your customers. In the opinion of my client, the conclusions contained in the Proposal for Resolution are not may but be considered, at best, contrary to logic and sense. common practice, since contrary to them is not being able to warn the consumer of electrical energy from a possible suspension of supply. Moreover, following the reasoning contained in the Proposal for Resolution, it is possible to I would conclude, in the opinion of my principal, completely irrational, that consumers who have the status of natural persons would see their position adversely affected in the ATR contract, since I-DE could warn of the possible suspension of the supply to its clients legal entities, since in that case it would not be applicable tion of the personal data protection regulations, but such possibility would be prohibited in relation to their clients natural persons under penalty, in the opinion of the AEPD, of violating said regulation. Such a glaring conclusion could only lead to the filing of the present proceedings. inasmuch as, as indicated by the Advocate General of the Court of Justice, of the European Union, Mr. Michael Bobek, in §99 of his conclusions referring to the Case C-13/16 (Rīgas satiksme case), filed on January 26, 2017: "In summary, common sense is not a source of law, but, of course, it should serve as a guide for its interpretation. It would be most regrettable if protection of personal data will be degraded in the obstruction of personal data- them." In the present case, said conclusion could not be more evident, since the sub- protection of the consumer's personal data, to which the Pro- Implementation of Resolution leads in practice to an obstruction of these that can lead to a suspension, entirely surprising to the consumer, of the electricity supply, with the important damages, losses and other consequences that from this to be derived for the consumer. To this must also be added the fact that not a single I-DE client has considered my client's violent behavior in C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 8 8/37 in any way your right to the protection of personal data and that, paradoxically, the application of the rule would imply a more favorable treatment to clients who have the condition of legal persons, as these are not holders of the fundamental right. In short, there is a contractual relationship between my client and the consumers recipients of the letters sent in which a situation may arise that it is detrimental to them as a result of a breach by its agent, so that the normal and proper development of the contractual relationship This justifies my client making all the necessary efforts to implement knowledge of the principal of the breaches carried out by the agent in order to take the consequences that will only harm the consumer. 3. Regarding the intervention of the CNMC in the present case The Motion for a Resolution considers that the statement contained in the allegations of my principal to the Initiation Agreement, according to which it was indicated that the Commission National Markets and Competition (hereinafter, "CNMC" or "the Commission") was aware of the letters sent by the former to consumers. expressly stated by the aforementioned Commission, summarily concluding that: “It follows, therefore, that the distributor did NOT send the CNMC any letter to their prior review, sending the informative letters to the final consumers without "the review ”of the CNMC, and, therefore, being totally impossible,“ (…) ratify the legality of the conduct of my principal (…) ”by the CNMC, as stated by the entity claimed dad. " However, it is enough to contrast the content of the response provided by the CNMC to that AEPD to verify that the statement contained in the Proposal for Resolution does not sympathize with the reality of the facts Thus, in the first place, as already indicated in the allegations of my client to the Agreement Inception, the CNMC indicates with absolute clarity that it has full knowledge of the letters to which the request for information refers, despite the fact that the AEPD does not send that one copy some of the same even when they work in the administrative file tive. Thus, the third paragraph of the CNMC's response literally states: “Although the request received from the Spanish Data Protection Agency does not Attached sample of the information letter referred to, according to the data that are provided, it can be considered that it is a certain letter that would be I am aware of the existence of non-payment of network access tolls. " That is, although the AEPD does not provide a copy of the letter, its content was more than known to the CNMC. And it is that as it was already warned in the letter of Ale- In addition to the Initiation Agreement, my client informed the CNMC of the delo of letter that had made for these assumptions. It doesn't seem very difficult to understand that my client is not going to request authorization to send the letters every time a situation like the one we are dealing with occurs, as this would mean so much such as making it impossible for the CNMC to carry out any other action other than curl these types of letters. It should be remembered that, as already indicated, only in the case of the company WA- TIUM, my client has had to carry out since 2018 ONE THOUSAND ONE HUNDRED SE- SIXTY-TWO (1162) reliable payment requirements for the same number of income compliance with the obligation to pay access fees in. In this way, if the reasoning of the AEPD is followed, my client should have requested the C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 9 9/37 CNMC on 1162 occasions the authorization to send the letters to the mercantile Watium. The CNMC replied that what it did not know was the specific letter sent to customers of Watium, but that, nevertheless, he did know that these letters were sent to the I-DE clients whose marketing company did not pay access fees after have completed the voluntary payment period and after having been reliably required- To this end, as expressly provided by the applicable legislation, in avoidance of that the supply was suspended without the knowledge of the contract holder, or der have it, that his access contract was in default. Moreover, made by Watium a complaint against my client on the occasion of the letter to their clients, as expressly stated in the response offered by the CNMC (folio 132 of the administrative file), the aforementioned Commission not only considered sending of the same perfectly lawful and in accordance with the sectoral regulations, compared to what now seems to consider the AEPD, but also specifically agreed to give “tras- side of the information to the Directorate of Energy […] for different purposes (assessing tion of the possible breach by the marketer Watium, SL of the regulations applicable policy regarding the payment of the network access toll) ”. In conclusion: the CNMC was not only perfectly aware of the existence of the letters, Rather, when he became aware of them (years before that AEPD and with reason for a complaint such as the one at hand), his decision was, as it appears in the administrative file, analyze the possible initiation of a file sanctioning company Watium for breach of its legal obligations. laws and regulations and in defense, among others, of the rights of customers affected by tados. 4. On the legal basis of the treatment in the present case. It has already been amply analyzed in section 2 of this allegation that my command proceeded to the processing of the personal data of its clients for the sending of the mentioned letters as said sending is necessary for the normal development of the contractual relationship that binds both parties, since it can only consider- it is, according to all logic, necessary to warn customers of the suspension of the supply as a consequence of non-payment of ATR rates instead of proceeding to suspend hang it without notice. However, for the denied assumption that this AEPD, against the criterion supported even by the energy regulator, the CNMC, consider that the legal basis of the treatment ment cannot be considered the adequate development of the contractual relationship, There is no doubt that the communication to I-DE clients that said sus- pension is going to take place will be, at least, in their interest, who may adopt the measures they deem appropriate to avoid said suspension. Of this Thus, it would be applicable to the assumption, at least, and although the legal basis of the contractual relationship, the rule of the prevailing legitimate interest established cited in article 6.1 f) of the RGPD. It should be remembered that the first paragraph of recital 47 of the RGPD states that: “The legitimate interest of a person responsible for the treatment, including that of a person responsible for that personal data may be communicated, or that of a third party, may constitute a legal basis for the treatment, provided that the interests or rights do not prevail. rights and freedoms of the interested party, taking into account the reasonable expectations of the interested parties based on their relationship with the controller. Such legitimate interest could C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 10 10/37 occur, for example, when there is a relevant and appropriate relationship between the and the person in charge, as in situations in which the interested party is a at the service of the person in charge. " Note that the RGPD considers that the prevalence of legitimate interest can be seen reinforced in cases such as the one analyzed, given that the information provided to the sado would refer to the suspension of the contract concluded by him with my command. tea. In other words, there would not only be a legitimate interest for I-DE to put this knowledge of their customers, but even a legitimate interest of them in not seeing supply was suspended, to a greater extent, when said customers would have made the payment of the amount corresponding to said access toll to the distribution. And it should be emphasized that the aforementioned suspension may take place independently of pendency of the person who has materially signed the ATR contract, as expressly follows from article 4.4 of RD 1164/2001, which develops the provisions to in article 52.3 of the LSE and to which it refers literally. Even though the two legitimating bases referred to with previously, they could be considered, in light of what was indicated by my client, insufficient tes for the purposes of enabling and legitimizing the processing of personal data to which referred to in the present file, it should be remembered lastly that the origin of the mentioned cited letters is found in the fact that the trading companies do not have paid I-DE the amount of the ATR tariffs, that is, of the so-called pea- jes. At this point, it should be remembered that the payment to I-DE of the aforementioned rates will not be puts an income for it, but its mere collection as system income electricity, we reiterate not yours, with said funds being allocated to the maintenance and maintenance of said system in the terms established in the electrical legislation. In this sense, article 13.1 of the LSE provides that: "The actions of the Public Administrations and other subjects included in The scope of this law will be subject to the principle of economic sustainability. mica and financial of the electrical system. Economic sustainability and fi- financial system of the electricity system the ability to meet all the costs of this, in accordance with the provisions of this law and its implementing regulations. " And article 13.2 a) expressly establishes that “[t] he costs of the system will be finan- generated by the income from the electricity system that will comprise […] [t] he tolls access to transmission and distribution networks satisfied by consumers and producers and agents for energy exports to non-EU countries. rivers, destined to cover the remuneration of transport and distribution ”. In turn, as provided in article 18 of the LSE: Article 18. Collection and settlement of tolls, charges, prices and regulatory remuneration. you give. "The access tolls to the transmission and distribution networks and the prices or charges for other regulated services destined to the supply of electrical energy will be issued by the distribution companies and, where appropriate, by the system operator, having to give to the amounts entered the application that proceeds in accordance with the general liquidation procedure provided for in this law and its regulations developmental. For these purposes, the income from tolls or charges will be those that would have due to be invoiced by application of the regulations that establish them, regardless of C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 11 11/37 dence of its effective billing and collection by the subjects obliged to its re- caudation. " Legal obligation to collect that is reiterated in article 40.1. j) of the LSE when stating what following: “Article 40. Obligations and rights of the distribution companies. 1. The distributors Owners, as owners of the distribution networks, will have the following obligations: “J) Apply, invoice and collect the access tolls to the transport and distribution networks to marketers or consumers, as appropriate and where appropriate, ductors connected to their networks by breaking down the billing to the user in the form determined by regulation " And finally, article 14.1 establishes the following: “The activities destined to the supply of electrical energy will be rewarded in the form provided in the present law charged to the income of the electrical system defined nested in article 13, to those derived from the participation in the product market. tion, as well as the income from the application of the provisions of the Se law and its implementing regulations. The income from the electricity system will be to pay exclusively their own remuneration for activities aimed at electricity supply and the rest of the system costs defined in article 13, without that can be used for other purposes. " Therefore, the collection of access fees is a legal obligation that is imposed use distribution companies as a way to obtain the necessary income to defray the costs of the electrical system and thus allow users to electricity supply can have access to this service of economic interest ge- general. And to such an extent the collection of these access fees is so transcendental to the effects described, which is imposed on the distribution companies not only the obligation to to collect them but also to enter the electricity system tariffs. access that they bill, regardless of whether or not they are charged by those obliged to payment, ultimately, the holders of electricity supply contracts. For As a result, non-payment of access fees causes patrimonial damage to the company distributor, which has to enter the invoiced rates, even if they are not paid. To compensate for the pass-through of commercial risk of a tax collection activity legally put to someone who is not the beneficiary of the amounts collected, the LSE and its implementing regulations establish: a) In the event that the customer has contracted the supply through the company trading company (which acts against the distribution company as agent of the client, case that concerns us), the obligation to pay the access fees in men of solidarity by the contract holder and the marketing company, to whom Indistinctly, the distribution company can request and claim payment, solidarity that can only be broken by the holder of the supply contract with prior accreditation of to be up to date with the payment with the marketing company Arts. 40.2. j), 44.2.b) and 46 1.d) of the LSE and 4.2. of RD 1164/2001. b) The possibility of suspending the electricity supply in the event of non-payment of rates of access (regardless of whether the payment of these has been accredited by the of the contract to the trading companies). Arts. 52 of the LSE and 4.4 of the RD 1164/2001. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 12 12/37 c) The classification of the breach of the obligation to pay the access fees by the marketing company as a very serious, serious or minor infraction according to amount of non-payment (in this case very serious), which may also give rise to the disqualification of the marketing company for the exercise of the activity Arts. 47, 64.4., 65.3 and 66.1 of the LSE. For the aforementioned reasons, the collection of access fees, as soon as it has for the purpose of obtaining the amounts of said rates for their contribution to maintaining maintenance and proper operation of the electrical system is directly related with the fulfillment of a mission of public interest, which is also imposed on the distribution companies by legal mandate, which would even allow to substantiate the treatment in the provisions of article 6.1 e) of the RGPD. In conclusion, as indicated in this document, there is no doubt that I- DE is fully entitled to process data for the purpose to carry out the aforementioned communications to its clients as a consequence of the development of the contractual relationship maintained with them. But even in the denied assuming that said legal basis was again discarded by the AEPD, the treatment would also be based on the legitimate interest of the con- electrical sinks to maintain the contracted electricity supply and in the public interest derived from the fact that the income from the payment of the ATR tariffs is nothing but an act of collecting said income for its contribution to the maintenance of the electric system. And ultimately, the legitimate interest of the distribution company, legally obliged to carry out this collection activity and bear the risks of non-payment, in recovering amounts that it has been forced to enter for the electrical system despite not having charged them. Being sufficient the concurrence of a legitimizing base to determine the conformity to the right of a treatment, it turns out that, in the present case, there are elements enough to be able to assess the fit of the treatment carried out by my dante in four of the legal bases established in article 6.1 of the RGPD, therefore It is certainly surprising that Wade's complaint has not been shelved. tium. THIRD.- ON THE SETTING OF THE AMOUNT OF THE PENALTY IN THE AGREEMENT DO OF START My client already revealed in the first of his allegations to the Agreement of Initiation of this disciplinary proceedings that it incurred a substantive vice nullity, as the sanctioning body has established in audita part the im- size of the sanction to be imposed on I-DE. With this, the guarantees are broken of the sanctioning process and the right of my client to allege what his right proceeded prior to said determination, with the consequent causation to the same of a blatant defenselessness. In the same way, the obvious confusion between the phases of ins- resolution and resolution, by anticipating the sanctioning body the amount of the sanction that I would proceed to impose on my client. Something that in the present procedure has been made clear, when looking at the Proposal for Resolution by the order The instructor won an amount identical to the one that the sanctioning body had already proposed to him. nador in the Initiation Agreement. The Proposal for Resolution is limited to indicating that what was alleged by my client it can be taken for granted. However, and even when, as anticipated, it is practical C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 13 13/37 It is completely indecipherable to know for sure which are the arguments in which the Proposal bases such affirmation, my client understands it is necessary to make determinations. give considerations, delving into what was already indicated in their allegations to the Agreement Of start: 1. In the first place, contrary to what the Proposal for a Resol- tion, neither Article 64 nor Article 85 of the LPACAP establishes that in the At the beginning, the specific amount of the penalty to be applied must be expressly determined. da to impose the interested party in order, as it seems to be deduced from the Proposed Resolution tion, that the applicant can make use of the benefit of the reduction of the amount of the sanction for their acknowledgment of guilt or prompt payment. And it is that, contrary to what this part that the Proposal intends to indicate Resolution, the provisions of article 64.2 of the LPACAP do not imply any inno- variation of the legal system with respect to the norms that had been in force in the past. prior to its entry into force the administrative sanctioning procedure and, in particular, cular, the sanctioning procedure included in the data protection regulations personal. Indeed, this part fails to find the novel aspect of the aforementioned forecast legal regarding the sanctioning regime contained in Law 30/1992, of June 26, the Regulation of the Procedure for the Exercise of Sanctioning Power, approving by Royal Decree 1398/1993, of August 4 (hereinafter, “REPEPOS”) and the Regulation development of Organic Law 15/1999, of December 13, on the Protection of personal data, approved Royal Decree 1720/2007, of December 21 (in hereinafter, "RLOPD"), under which the AEPD did not establish the aforementioned amount in your startup agreements. In all these norms it was indicated that the Agreement to initiate the sanctioning procedure nador had to incorporate “the sanctions that may correspond, without prejudice to what results from the instruction ”. This was stated in article 13.1 b) of REPEPOS and it was reiterated by article 127.1 b) of the RLOPD. However, the AEPD considered that this did not mean more than indicating the maximum and minimum limits of the sanction that it would be appropriate to impose, if the actual commission of the aforementioned offense is appreciated, mentioned in the agreement without carrying out in the Initiation Agreement any valuation of the concurrent circumstances in the case or the mitigating or aggravating circumstances that should be taken into consideration to determine the final amount of the sanction to impose. The difference between the action just mentioned and the one carried out carried out in the present procedure is evident, since in the first case the act of situation of the sanctioning body when agreeing to start the file did not imply the realization of zation for its part of valuation activity any of the concurrent circumstances in the specific case, nor did he anticipate the examining body what was, in his opinion, the way in which the former had to act in setting the amount of the penalty within the limits legally established, which was limited to remembering by a direct application and without any statement of the rule regulating the sanction. However, in the present procedure, without modifying one iota, it is necessary to We reiterate it, the regulatory regime of the procedure, the sanctioning body is not not to remember which is the applicable sanctioning norm, but effectively assesses you, without paying attention at any time to what the insert could invoke, how concrete sanction, within the limits established by the norm, should be imposed. That is, the objectivity of the sanctioning body at the time of initiating the procedure remains C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 14 14/37 questioned by its assessment, in audita part, of the facts and circumstances and more necessarily influences the performance of the examining body, since it tends to It will be necessary to send him a proposal for a resolution that meets this pre-established criterion. do. 2. Secondly, reference should be made to what, despite its more than confusing wording seems to want to indicate the Proposed Resolution when on pages 41 and 42 of the same, the following is stated: “It is therefore not true, as the claimed entity affirms, that Article 85 establishes- ca: “(…) For this purpose, it should be recalled that, according to Article 85, the amount of the penalty pecuniary may be determined "initiated the sanctioning procedure (...)" ral of said article refers to the recognition of the responsibility of the offender and no to the decision of the amount of the sanction as it is literally established that: “1.- Initiated a sanctioning procedure, if the offender acknowledges his responsibility, may resolve the procedure with the imposition of the appropriate sanction ”and thus, must interpret, that is, according to the proper sense of the words, and not the discretion of the part. (…) Regarding the statement made by the claimed entity when indicating that, “in the present In this case, said amount is set in the act of initiation of said procedure and not when this is already "started", it could not be considered true, because in the "Agreement" to initiate the file is expressly indicated that, "for the purposes of the seen in art. 64.2 b) of the LPACAP, the corresponding sanction would be a fine of 200,000 euros (two hundred thousand euros), without prejudice to what results from the instruction"," Despite the less complex wording reproduced, he intuits this part that is wants to refute by the same what has already been alleged by my client in the sense of remembering that article 85.1 of the LPACAP provides that “[i] initiated a sanctioning procedure- dor, if the offender acknowledges his responsibility, the procedure may be resolved with the imposition of the appropriate sanction ”(the underlining is ours) and that the first ciso of article 85.3 of the LPACAP adds that “[i] n both cases, when the sanction is solely of a pecuniary nature, the competent body to resolve the procedure ment will apply reductions of at least 20% on the amount of the penalty provided put, these being cumulative with each other ”(emphasis added) As can be seen, from the literality of the precept to which the Pro- Resolution does not follow, as it seems to indicate, that the benefits seen in the same require the quantification of the sanction in the Initiation Agreement, for how much: First, Article 85.1 of the LPACAP does not require such a prior determination, since it does not refer to a pre-established sanction, but to the imposition of the sanction. tion as appropriate. That is, the norm, which in any case is applicable “initiated the proce- procedure ”, provides for the possible acknowledgment of responsibility that may determine the imposition of the sanction "that proceeds", so that this fixation seems to be foreseen with after the acknowledgment of responsibility itself. Second, Article 85.3 provides that reductions must be adopted on the basis of on the “proposed” sanction, which requires that it has actually been determined in procedure what is that amount, and the diction of the precept itself seems effective- refer to the motion for a resolution as the ideal place to determine the tion of said amount. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 15 15/37 In any case, as already indicated, the application of the precept, which supposes a Benefit for the accused cannot in any case imply a bankruptcy of his rights under the excuse of granting the aforementioned benefit. In short, the fact that the acknowledgment of guilt can be produce “once the procedure has started” (something that is obvious, given that the The accused cannot have prior knowledge of the existence of the accused. tion) in no way implies that the Initiation Agreement is the place where it should determine undermine the amount of the specific penalty "appropriate" to impose, so that sanction should be determined at a later time, that article 85.3 seems assimilate to the proposed resolution, since the sanctioning body could not, In accordance with the principles of the administrative sanctioning procedure, "propose" that sanction, as such power corresponds to the investigating body. And this conclusion is not contradicted by the fact that the initial agreement is the place where, according to the final paragraph of article 85.3 of the LPACAP, the of manifest to the insert the discounts that in his case would proceed to impose in case recognition of responsibility and advance payment of the penalty, whenever that both are benefits granted to the same who must know from the moment the very beginning of the procedure, even though the sanction cannot be found when tified, as said insert could not be heard in the processing of the file, that has not been started. It only remains to reiterate in this place that the very processing of this procedure This statement merely demonstrates the effects that the decision adopted by the sanctioner has produced in the performance of the investigating body, which mimetically reproduces in its Proposal for Resolution what was argued by the sanctioning body in its Initiation Agreement both in the quantification of the sanction and in the enumeration tion of the concurrent circumstances in the present case. 3. Third, the Proposed Resolution, again in terms that in the opinion from this part are respectfully completely confused, it seems to give tend that the setting of the amount of the sanction in the Initiation Agreement is clearly adequate, inasmuch as my client has had the opportunity to express himself about the concurrent circumstances in the case both before and after at the initiation of the sanctioning procedure. Thus, in relation to the activity prior to the aforementioned Agreement, the Proposal for Re- solution (the underlining is ours): "On the statement made by the claimed entity of:" IDE has not had occasion in no time to reveal to the aforementioned body which could be the circumstances that could be applicable in the present case ”, it should be remembered that, on 05/23/19, this Agency notified the claimed entity, the complaint presented by the complaining entity, in the reference file E / 3624/2020, requiring the entity, at that time called, IBERDROLA DISTRIBUCIÓN ELÉCTRICA, SAU, to proceed with its analysis, respond and submit to this Agency, within a period of one month from its notification, all the information deemed appropriate for this purpose. Information that the entity collects Claimed filed on 06/24/19, one day after the deadline granted for this purpose, through through the electronic registry of the General State Administration " The aforementioned transfer, under the heading "transfer of claim and request for information", was carried out, according to the document itself (folio 69 of the administrative file C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 16 16/37 vo) “[d] e in accordance with article 65.4 of Organic Law 3/2018, of December 5, on, Protection of Personal Data and guarantee of digital rights ”(in addition, lante, “LOPDGDD”), which refers to article 37.2 of the regulation itself in which it is state the following: “When the affected party files a claim with the Spanish Protection Agency tion of Data or, where appropriate, before the regional data protection authorities, They may refer the claim to the data protection officer so that this responds within a month. If after this period the delegate of data protection would not have communicated to the competent data protection authority tente the answer given to the claim, said authority will continue the procedure in accordance with the provisions of Title VIII of this organic law and its regulations for developing." From the provisions of said rule it is unequivocally inferred that the transfer carried out In the first place, it has a completely optional character, being carried out in In any case, prior to the processing of the procedure and without its purpose being, on the other hand, the making of any allegation as to the modified circumstances ficative of the responsibility of the entity to which it is addressed, since such responsibility bility has in no way been determined by opening the proceeding sanctioner. Regarding the fact, subsequently invoked in the Motion for Resolution that my client has had the opportunity to contest what was stated in the Initiation Agreement, by be granted a period for the issuance of allegations, which will effectively mind made at the appropriate procedural moment, such a circumstance in a high way One can remedy the helplessness caused to it as a consequence of the assessment carried out in audita part of the concurrent circumstances in the assumption or supposes an enervation of vice consisting of the confusion of the phases of instruction tion and resolution and the consequent "contamination" of the former as of the content of the initiation agreement. All this supposes a breach of the inspiring principles of the sanctioning law that cannot be corrected by the mere fact that it has been required by that AEPD to report the facts contained in the claim not because my The principal holds the right, as it could not be otherwise in accordance with the cido in article 53.1 e) of the LPACAP, to formulate allegations. Therefore, my client considers that by determining the amount of the sanction and establishment of aggravating and mitigating circumstances in the Agreement of Inception, their right to defense has been violated, with the consequent cause of inde- fension, proscribed by article 24 of the Constitution, also breaking the principle of impartiality of the sanctioning body. All this must derive the necessary- mind in the nullity of full right of the present procedure. FOURTH.- APPLICATION IN THE PRESENT CASE OF THE PRINCIPLE OF PROPORTION TIONALITY AND MODIFICATION CIRCUMSTANCES OF LIABILITY DAD CONCURRENT IN THE SAME Although reference has already been made to the absolute lack of motivation of the Proposal for Resolution, in which hardly any different or additional arguments are offered to the had in the Initiation Agreement compared to what was stated by my representative in his allegations to it, this lack is evidenced even more clearly when The Proposal appears to clarify what was indicated by my principal in relation to the C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 17 17/37 concurrent circumstances in this case. In effect, the Proposal for a Resolution repro- at this point, in an almost mimetic way, what is stated in the Initiation Agreement without carry out a minimum exercise of analysis of what is alleged by this party. This would justify a mere reference to said arguments, with the legitimate expectation that they are effectively analyzed by the Control Authority. Not obs- Therefore, in order to facilitate this task, reference will be made again, even in summary, in this writing, to the reasons why my client understands that he does not concur in this In the event of not a single aggravating circumstance mentioned by the AEPD in the Proposal: 1. Regarding the volume of the letters sent, the AEPD seems to continue without evaluating really if they refer to natural or legal persons, since it does not seem to be In another sense, the reference to the total number of letters sent to Wa- tium, even though it is recognized that in reality it would only be referring to It refers to just over half of those included in the Initiation Agreement. However, this circumstance seems irrelevant for the AEPD, given that the reduction The number of cards from 2,598 to 1,462 has no effect on the determination of tion of the degree to which the conduct would be aggravated, since the sanction continues being the same as that included in the Initiation Agreement. For this, the AEPD seems to hide behind the fact that “in addition, the other complaining entity, ENERGÍA Y SERVICIOS ABY 2018, SL., Reports that all its clients have received the informative letters of the complaining entity ”. Yet nowhere is it refers to what the aforementioned total amount may be or if said customers are personal physical or legal rights, being the AEPD which would be responsible for accrediting how many shipments could have taken place, which does not appear to have taken place given that nowhere in the Proposed Resolution, apart from in the room transferors of the same and in its sixth fact, reference is made to these shipments, which without However, they are taken into account to aggravate the sanctioning reproach to my client. In this sense, it is relevant to take into account that neither the inspection actions carried out listed (folios 187 to 189 of the administrative file), nor the request for information to the CNMC or any of the reasoning in the Initiation Agreement or the Proposal for Re- solution make any mention of Energía y Servicios ABY, SL, except for this mention concise aimed at maintaining the aggravation of the behavior of my client without provide any accreditation related to such shipments. 2. The AEPD affirms that in the present case the facts have been denounced by the interested parties, noting that “the claimed entity, by making an illicit use of the data personal data of the clients of the marketing entities, this Agency has had knowledge of the alleged infringement through the agents of the interested parties (sic.)". Although it is difficult to understand the actual content of such a statement, given the that the recipients are clients not only of the marketers, as seems to be indicated the AEPD, but also the distributors, the truth is that not even in its written claim or in the query made at the time to the Legal Office of the AEPD Nor in the complaint made at the time before the CNMC, Watium claims to act in representation of its clients (which are also my client), but only and ex- exclusively in his own name. And understand this part that the AEPD cannot take as true or assume in any way some a representation that not only is not accredited in any case, but also furthermore, he refuses, since Watium always claims to act on his own behalf. For C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 18 18/37 Therefore, there is no doubt that this entity holds the status of interested party for the purposes of the provisions of the data protection regulations, it is completely inadmissible to application of such an aggravating circumstance. 3. Thirdly, the AEPD says that I-DE acted “knowing that there were different complaints filed and reports issued by different public bodies who rejected said action, the entity continued to send information letters to the end customers, and, therefore, could constitute an illegal act ”. My client cannot but reiterate that he does not know what those reports are and that he tions that she was supposed to know when she carried out the treatment of the data. Indeed, since obviously they cannot be the ones that are the object of this procedure there are only two possibilities: that the AEPD refers to the Announcement filed by Watium with the CNMC or that it is the report requested by that entity to the Legal Office of the AEPD. Well, as a first consideration, both the complaint and the request for a report were after treatment, so it could hardly be done after knowing the "resolution" issued or the report issued. In addition, with respect to the claims made mentioned in the Proposal for Resolution, it is necessary to show that the complaint made by Watium before the CNMC (the only one to which reference could be made) was inadmissible for processing mite, as stated in the administrative file, starting on the contrary an investigation of Watium herself. Therefore, there was no reproach from the CNMC to the behavior of my client. It is true that this reproach is contained in the report of the Legal Cabinet in respect of put to the query raised by Watium, but it is that my client has not had knowledge of said report until the Agreement to initiate this procedure made mention of this. All this, without prejudice to the fact that, as we understand that given sufficiently accredited, said report lacks an admissible legal basis in right. That is, and paraphrasing what was stated in the Proposal, my client issued the letters without knowing that a claim would be made later that was inadmissible and would issue by that AEPD (not by different agencies) a single report, not communicating do to I-DE, who rejected said action. All this without prejudice to the fact that, as was carefully analyzed in the allegations to the Proposal for Resolution and it has been insisted in this writing, the criterion supported made by the Legal Cabinet in the aforementioned report not only is not coherent with the personal data protection regulations, but even contravenes the criteria that in relation to the interpretation of the precepts that it carries out adopted by the National Energy Commission. In any case, as can be contrasted, what is stated in the Proposal for a Resolution tion and the reality of the case as regards the intentionality of my principal or they keep the slightest relationship. 4. Regarding the categories of data being processed, the Proposed Resolution tion points out, in our view quite surprisingly, that “in this case, when the claimed entity makes use of the name, surname, address, etc., of the clients illegally, it is clear use of data protected by the RGPD and, by therefore, subject to aggravation in application of section g) of article 83.2 of the RGPD ”. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 19 19/37 In the first place, my client only tried to send the communications the name name, surname and address of your customers, so it is unknown what the Proposal with the inclusion of the term "etc.". But it is that, in addition, from what is literally stated in the Proposal it follows that The use of "data protected by the RGPD" necessarily implies the aggravation of the sanction. Well, if the data is not protected by the RGPD, it is not that it does not proceed. gives the aggravation of the sanction, is that the conduct would not be subject to the RGPD, as it is manifest and evident. Thus, what the Proposal indicates, and let us To say that this causes enormous perplexity to this part is that the use of personal data sonal, subject to the RGPD implies the aggravation of the sanction by application of the Article 83.2 g) of the RGPD, referring to the categories of data affected by the alleged infringement, since all categories of data are protected by the aforementioned text to legal. 5. In relation to the supposed economic benefit, the Proposal for Resolution is mite to reiterate what is indicated in the Initiation Agreement. Suffice it at this point to add that, As stated in section 4 of the third claim of this writing, the in- The revenues referred to in the Proposal are not typical of I-DE, but are collected by it for the maintenance and support of the electrical system, in accordance with the Articles 13, 14 and 18 of the LSE, so my client does not know what benefit was obtained vo with the sending of the communications. 6. And finally, regarding my client's relationship with the realization of treatment- data, the Proposal is limited to indicating the volume of customers and employees I-DE to indicate that such a relationship exists. We must first point out that, now, it seems that finally the AEPD, even with the intention of aggravating the sanction imposed, it recognizes that The clients to whom the communication was directed are, in effect, clients of I-DE and that it maintains a contractual relationship with them. But having said this, my client understands that the treatment object of this proceeding Marketing is not an essential part of their activity, which is none other than electrical distribution. trica in the terms established in the LSE and its implementing regulations. And it should be reiterated here that in the opinion of my client, the AEPD carries out an interpretation completely maximalist treatment of the aggravating factors established in the RGPD and the LOPDGDD, every time, as we already said in the allegations to the Initiation Agreement, “se- According to its criteria the treatment of any data, even if it is merely identifying, constitutes, by itself, an aggravating factor and, on the other hand, any entity that has As stable clients to individuals, their activity will be linked to the treatment to the personal data ”. Suffice it at this point to add that this conclusion applies equally to any entity that had employees. By virtue of all of which, REQUESTS THE SPANISH DATA PROTECTION AGENCY that, having By presenting this writing, please admit it, consider the allegations to the Proposal for a Resolution in Procedure PS / 00197/2020 and, after the formalities legally established, issue a resolution declaring the nullity of full right of the procedure for the reasons described in the second argument of this brief or, failing that, on the merits of what is manifested in the body thereof, the ar- goad of the aforementioned procedure or, failing that, the imposition of a warning C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 20 20/37 notice or warning or a significant reduction in the amount established in the Initiation Agreement, in view of the numerous attenuating circumstances tes in the case of fact prosecuted. Of the actions carried out in this procedure, of the information and documents documentation presented by the parties, the following facts have been accredited chos: PROVEN FACTS 1.- WATIUM, SL, an electric power trading company, has subscribed with the energy distribution company, I-DE REDES ELÉCTRICAS INTELIGENTES, SAU (I-DE), a network access contract (ATR), through which, it exercises functions of agent or substitute for end customers, as established in articles 3.2 and 3.3 of Royal Decree 1435/2002, of December 27, which regulates the basic conditions of contracts for the acquisition of energy and access to the low voltage networks. 2.- The entity WATIUM SL provides a copy of the "Network Access Contract" model between the trading company (WATIUM SL.) and the supplying company (I-DE). This contract includes, among other information, the identification and contact of the client end, the logo of (Iberdrola Distribución Eléctrica, current I-DE) and the identification of the company WATIUM, SL The contract is signed by, on the one hand, the trading entity, and on the other, the entity distributor. There is no place for the signature of the final consumer. Stands out in the text of the contract the following: "The undersigned acting as agent and substitute for the client for the purposes of the art. 3.2 and 3 of RD 1435/2002 of December 27, contracts with IBERDROLA DISTRIBUCIÓN ELÉCTRICA, SAU access to the network for the electricity supply in the supply point outlined, being obliged to keep the documentation that accredits him as agent and substitute for the client and to make it available to the distribution company if required, both parties being obliged to comply with the Specific, Special and General Conditions included in this policy, all of them in accordance with the legal prescriptions in force, being signed on the day of the date in duplicate and for a single effect. " In the "Payment Term" section It states: "The Client or his agent will pay this company the amounts of the electric power supplies within 30 days from the issuance of the bill." 3.- According to the complaint, in mid-January 2018, WATIUM, SL had knowledge of the referral, by I-DE, of a series of letters (more than 2,500, according to complaint), to the clients of WATIUM, SL These letters were of a informative and exposed the contractual breaches committed by WATIUM SL regarding I-DE, and invited them to contact WATIUM SL, to urge you to pay the amount of the contract for access to the distribution network, further indicating that the lack of payment by WATIUM, SL, to I-DE, could lead to the suspension of the power supply. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 21 21/37 3.- In the letters sent by IBERDROLA (current I-DE), to WATIUM clients SL, you can read the following text: "Dear Consumer: By means of this letter we inform you that, on February 8, 2018, we were forced to send your electric power marketer WATIUM, SL., in accordance with the regulations in force (art. 4.3 and 4.4 of Royal Decree 7764/2007, of October 26), a reliable request for payment, given that, after the voluntary payment period established by law, the amount of the invoice for third-party access to the network corresponding to the contract and supply point of which you are the owner that, It is detailed below, it is unpaid: (…) Non-payment of third party access fees to the network may give rise, according to with current regulations (art. 4.4. of RD 7764/2007, of October 26), to the suspension of power supply. For all these reasons, we ask that you urgently contact your company marketing company to remedy this situation without this letter informative suppose a request of payment towards you by this company distributor. Without any other particular, sincerely ”. 4.- As indicated by the entity WATIUM SL, on 01/22/18, informs, through of a complaint, the facts before the National Markets Commission and the Competition (CNMC) and before this Data Protection Agency, on 02/19/18. 5.- In the legal report issued by this AEPD, dated 07/23/18- N / REF 059338/2018, includes, among others, the following: "Consequently, without it corresponding to this AEPD to rule on these legal aspects that may emerge from the letter, it could be concluded that the processing of personal data carried out by the distribution company object of the query has violated data protection regulations both what it does reference to the legal basis of the treatment as in relation to the principles relating to treatment. Regarding the first, the appropriate legal basis for the treatment of these personal data of consumers would be the one that allows the execution of a contract in which the interested party is a party (art. 6.1. c) RGPD), but We will already have stated above that the treatment of the personal data of the Consumers acting through an agent are not necessary for fulfillment of said contract, since precisely the existence of the agent makes it necessary to address communications regarding compliance with the contract. Regarding the principles relating to the treatment, consequently, it could be concluded that the processing of said personal data would have been carried out in a manner incompatible with the determined, explicit and legitimate purposes, for which they were collected (limitation of the purpose), which, as has also been stated, was for the supply of electrical energy to the supply point for which the access. This also implies that the provisions of art. 5.1 letter c) RGPD. inasmuch as or said personal data processed are neither adequate C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 22 22/37 nor relevant in relation to the purposes for which they are processed (principle of data minimization ”. 6.- On 01/08/20, the entity ENERGIA Y SERVICIOS ABY 2018, SL, marketer of the electric energy supplied by IBERDROLA (I-DE), reported to this Agency the sending of identical letters, by IBERDROLA (I- DE), to their clients, informing them of the non-payment by the marketer, and inviting them to contact it to proceed with the correction of said problem. 7º.- For its part, the claimed entity, at the request of this Agency, reported what following points: a) That the access fees are charged by the distributors, but they are not in- own income, but rather the national electricity system. b) That the WATIUM client is the holder of the ATR contract signed with IBER- DROLA. c) That the client, as the holder of the ATR contract, is obliged to Narrow the access rates to the distribution company. d) That the distribution company issues the access invoices to the trading company cializadora who passes them on to customers in their supply invoices. What the customer must pay these invoices. e) That the distribution company cannot demand the payment of the direct access toll straight to the consumer. f) That both the client and the marketing company are obliged two jointly and severally to the payment of access fees to the distribution company. g) That the marketing company must pay the distribution company the access fees, even if these have not been satisfied by your client. h) That in the event that access fees are not paid within the deadlines established in current regulations, the distribution company may initiate the supply suspension procedure. (art. 52 LSE, 4.4 RD 1164/2001, art 85 RD 1955/2000.). i) That the causes that have motivated the incident are a consequence of non-compliance service by WATIUM within the payment period for each invoice remittance of ATR, for which they are forced to reliably require the payment of these rates, warning of the start of the procedure for suspending supplies tr electric. j) That since WATIUM collects these access fees from its customers, it trans- After certain days from the issuance of the reliable request by non-payment of access fees, IBERDROLA sends the contract holders of ATR an information letter to inform of the situation and to keep- is the same, the WATIUM client who has paid the access fees to the trading company may suffer the consequences of a suspension of supply. Also the object of the letter is that the holder of the ATR contract carry out the actions it deems appropriate and, where appropriate, accredit IBERDROLA, which has already paid these access fees to the trading company dora, assumption in which the client would avoid having the su- electrical minister. k) That the information letter is essential to protect the rights of the users and that have been subject to review by the regulatory body, the Commission C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 23 23/37 National Market and Competition sion and that comply with the regulations is in force. l) That they have been forced to send 1462 information letters to date. m) That the legal basis for the processing of personal data of WATIUM's clients is: Contractual. WATIUM customer has subscribed with IBERDROLA, ATR contract. That the trading company does not have the condition of part, but of mere representative. Consent of the holder of the data. That the ATR contract gives express authorization of the clients of WATIUM for the processing of personal data. What is authorized tion and express expression of consent is imposed by the regulations is in force. Legal. What is the legal obligation to process data by the company? sa distributor for the management of the contract. That such management includes the obligation tion to inform the ATR holders of the possibility that supply is suspended. d. Legitimate interest. The one to be able to comply to its legal and regulatory obligations such as informing the holders of ATR laws of the incidents that affect your contract, the management of this and the collection of access tariffs for the National Electric System. n) They conclude that the only solution to this dispute is that WATIUM comply with your obligations as this situation is causing important damages to its customers, the distributor and the National Electric System. 8.- For its part, the CNMC states, regarding the allegations made by the entity claimed: a) That IBERDROLA (I-DE) has not addressed the CNMC before sending the clients of WATIUM, SL the aforementioned letters. b) That the CNMC has not reported either favorably or unfavorably the rea- lization of such shipments. c) That on 01/22/18 a written complaint from WATIUM was received at the CNMC, SL for the reasons indicated above. d) That, after analyzing the complaint, the Competition Directorate of the CNMC considered that it could not be concluded that IBERDROLA (I-DE), incurred in fraction of art. 3 of Law 15/2007, of July 3, on the Defense of Competition cia for carrying out acts of unfair competition. e) That the information was transferred to the Energy Directorate for the assessment of the possible breach on the part of WATIUM, SL of the applicable regulations regarding payment of the network access toll. FOUNDATIONS OF LAW I- Competition. The Director of the Spanish Agency is competent to resolve this procedure of Data Protection, in accordance with the provisions of art. 58.2 of the GDPR in the art. 47 of LOPDGDD. II- Answer to the allegations to the Proposal for Resolution. The joint assessment of the documentary evidence in the procedure brings to knowledge of the AEPD, a vision of the denounced action that has been C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 24 24/37 strapped in the facts declared proven above related. However, on the allegations presented by the claimed entity must indicate: - On the non-existence in the conduct of I-DE of violation of the regulations of protection of personal data, (first and second points of the allegations) nes): The electric power trading companies (the complaining entities), have nen subscribed with the electric power distribution entity, (the claimed entity), an access contract to the network (ATR), by means of which, it exercises mandate functions river or substitute for end customers, as indicated in articles 3.2 and 3.3 of the Real Decree 1435/2002, of December 27, which regulates the basic conditions of contracts for the acquisition of energy and access to low voltage networks. In said contract, there is the following clause: "The undersigned, acting as agent and substitute for the client for the purposes of the art. 3.2 and 3.3 of the RD. 1435/2002 of December 27, contracts with IBERDROLA DIS- TRIBUCIÓN ELECTRICA, SAU access to the network for electricity supply in the supply point outlined, being obliged to keep the documentation that accredits as agent and substitute for the client and to make it available to the only one distributor if it is required, both parties being obliged to comply with the Conditions Specific, Special and General purposes included in this policy. All of them in accordance with current legal prescriptions, signed on the day of the date in duplicate and with a single effect ”. The signatories of the contract are, on the one hand, the trading company and, on the one hand, part of the supplying company, the contract administrator and the Head of Distribution zone tion. In article 3.2 of RD 1435/2002, cited in the contract, it is established, on the finalization of the processing of personal data, the following: “2. (…) The supply contract between the consumer and the marketer, it must be formalized in writing. In it you must include an authorization so that the marketer can act as agent of the consumer, contracting the access fee with the distributor and transferring the buidor the data necessary for the supply. The collection, treatment and transfer of These data must at all times observe the provisions established in the norm. policy on the protection of personal data that may be applicable ”. Well, according to the principle of "limitation of purpose", contained in article 5 of the RGPD, personal data will be processed only and exclusively for specific purposes. defined, explicit and legitimate, and will not be subsequently treated in an incompatible manner. ble for these purposes. This principle has two parts, on the one hand, it requires that the data be treated with one or more specific, explicit and legitimate purposes, that is, the purpose of the Treatment must be clearly defined, in such a way that allows the interested party or to the control authorities to know what type of activities are included in it and why On the other hand, it prohibits the data collected for specific, explicit and lawful purposes gitimos are subsequently processed in a manner incompatible with those purposes. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 25 25/37 Therefore, it is not possible to process the data initially collected for another purpose than are not compatible with the first. This means that the GDPR does not prevent data are processed for purposes other than the one that justified the original treatment. Rio, what it prohibits is a treatment for purposes not compatible with the initial one. Article 3.2 of RG 1435/2002 referred to in the contract signed between the commercial entity cializadora and the distribution entity establishes that the personal data that the entity marketing company will "transfer" to the "distributor" entity, they will be solely and exclusively so that it provides the final consumer with the electricity supply: “(…) transfer to the distributor the data necessary for the supply (…) ”, that is, the data necessary so that the electric power distribution entity can reach the final point the electricity supply (identification of the final consumer, supply address, contracted company, etc. This purpose or another compatible with it, are the only ones for the that the distribution entity can make a lawful treatment of personal data that the marketer has provided you. In the present case, the letters sent by the distribution entity to consumers final meters said verbatim: “March 13, 2018.- Dear consumer: By means of this letter I put- We know that, on February 8, 2018, we were forced to to be sent to your electric power marketer WATIUM, SL., in accordance with the current regulations (art. 4.3 and 4.4 of Royal Decree 7764/2007, of October 26), a reliable demand for payment, given that, once the voluntary payment period has elapsed, glamentarily established, the amount of the invoice for third-party access to the network corresponding to the contract and supply point of which you are the owner and that, Continuation, it is detailed, is unpaid: (….). Non-payment of third party access fees to the network may give rise, according to with current regulations (art. 4.4. of Royal Decree 7764/2007, of October 26), to the suspension of power supply. For all these reasons, we ask you to be urgent- keep in touch with your marketing company to remedy this situation without that in no case does this information letter imply a request for payment to you by this distribution company. Without other particular, sincerely. " Therefore, it is clear that the processing of personal data carried out by the distribution company, when sending informational letters of the alleged breaches contractual agreements of the trading company, to final consumers, in addition to "Beg" them to contact the marketing entity so that it "Proceed to correct the problem" is not compatible with the stated purpose in article 3.2 of RD 1435/2002. Moreover, this irregular data processing carried out by the distribution entity implies the breach of what is established in art. 5.1.c) of the RGPD, since the personal data Final treaties for sending the cited letters are neither adequate nor pertinent, in relation to the purpose and scope for which they were collected (principle of mini- data mization). What this principle establishes is that personal data must- They will be, in any case, limited to the purpose for which they were collected. Purpose established in the terms and conditions agreed in the signed contract. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 26 26/37 On the other hand, article 3.3 of the aforementioned Royal Decree 1435/2002, establishes that: “In the case in which the consumer chooses to contract energy and access to the networks through Through a marketer who acts as a substitute for the consumer, the marketer The buyer must have sufficient power granted by the consumer in favor of the merchant. cializer. In this case, the position of the marketer in the access contract sus- Credit with the distributor will be for all purposes that of the corresponding consumer. In any case, the distributor will maintain with the final consumer all the obligations tions relating to the access contract and in the event of termination of the contract between the merchant and consumer, this will be the holder of the guarantee deposit, as well as of any other right associated with the installation, without it being enforceable, for part of the distributor, any update due to the contractual renewal ”. According to this precept, if the distributor wishes to address the final consumer who has dealt with the supply of electrical energy through a marketer, it may only di- abide by it through the marketer, for having constituted itself as agent of the final consumer acting before the distributor as a " substitute for the consumer ". The cited article, therefore, does not contemplate direct action between the distributor and the final consumer, since he has appointed an agent for his relationship with that, not existing in any case, a direct contractual relationship between the distributor buyer and the final consumer but through marketing, whose position in the access subscribed with the distributor is, as established in the aforementioned article: “(…) to all the effects that of the final consumer ”. The claimed entity is accepted in article 4.4 of RD 1164/2001, where they are established the conditions for suspending the electricity supply, as a result of non-payment of the rates, to have sufficient power to address the final consumer with a different purpose than that established in article 3.2 of RD 1435/2020, this is, to send them informational letters with the "request" that they get in touch with the marketing entity so that it fulfills its contractual obligations. Well, the cited article establishes the following: “4. The distribution company may suspend the access fee contract when at least two have elapsed months since he had reliably required payment to the consumer or its maintenance date, in accordance with the scope of application of the access fees established in Article 1, paragraph 1, of this Royal Decree, without it having been made cho cash. For these purposes, the request will be made by means of a referral, to the address address that for communication purposes appears in the access fee contract, for any means that allows proof of receipt by the interested party, as well as well as the date, identity and content of this, leaving the distribution company obliged to keep in its possession the accreditation of the notification made. In the su- post of rejection of the notification, the circumstances of the attempt to notification and the procedure will be considered completed. Said communication must include the procedure of disconnection of the consumer from the distribution networks due to non-payment, Said the date from which the disconnection will take place, if the payment is not made on above the amounts owed (…) ”. Well, as this article establishes, when the distribution company is obliged to to suspend the electricity supply service to the final consumer due to non-payment, it is C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 27 27/37 when it can be directed to the final consumer, but to the sole effect of requirement of the payment of the electricity tariff, in accordance with the scope of application established in the Article 1.1 of the aforementioned Royal Decree. In addition, the requirement will be practiced in the Rection that for communication purposes appears in the signed contract and in it only It will include: “ the process of disconnection of the consumer from the distribution networks by non-payment, specifying the date from which the disconnection will take place, if no the amounts owed must be paid in advance ” . Therefore, the aforementioned article limits the communications of the distribution entity with the end customer for the sole purpose of requiring payment of the fee, when this is the direct debtor, and as the claimed entity indicates in its allegations: “in no way At one time the consumer has been required to pay said fee which, on the other hand, you, he has already satisfied the marketer ” , but merely informs him that his The merchant has not satisfied the payment of the electricity tariff, previously paid by he in addition to "begging" him to contact the marketing entity so that it can solve the problem of non-payment. Therefore, the conclusion reached by the claimed entity cannot be taken in consideration because it is not correct to apply this article to take over the power sufficient for the processing of personal data of end consumers and potential thus, send them informational letters with the “request” to contact the entity. marketing entity in order for it to comply with its contractual obligations with the distribution entity, without entering to assess this Agency the other allegations where the possible consequences of the marketing company not satisfying to its contractual obligations as these valuations are not the competence of this Organism. 3.- Regarding the intervention of the CNMC in the present case, the entity now recognizes claimed, changing its initial argument that: “The CNMC is aware of the sending these communications, at least as a result of the complaint formulated by the marketer (…). " Well, it must be remembered that, on 06/25/19, the claimed entity affirmed to this Agency verbatim that: “ These letters have already been subject to review by the Regulatory body, the National Commission of Markets and Competition and strictly comply with the aforementioned regulations in force (…) ”. Report requested from the Regulatory Body on the statements made by the claimed entity, on 02/26/20, the CNMC sent this Agency a report where these assertions were flatly denied: "Regarding this letter, the following must be reported according to the data working in the Directorates of instruction of this Commission: - Iberdrola Distribución Eléctrica, SAU has not approached the CNMC before sending Watium customers, SL the letters in question. The CNMC has not reported, either favorable or unfavorably, the making of said shipments. - On January 22, 2018 received at the CNMC a letter of complaint from Watium, SL due to the letters of that is (…). C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 28 28/37 As a conclusion to the report issued by the Competition Directorate of the CNMC, considers that: “(…) it could not be concluded that Iberdrola Distribución Eléctrica, SAU incurred in violation of article 3 of Law 15/2007, of July 3, on the Defense of the Competition, due to acts of unfair competition. Attached to In this regard, communication dated April 19, 2018 sent to the complainant by of the Directorate of Competition. It remains to clarify that, although the communication of 19 April 2018 mentioned refers at the end to a transfer of the information to the Directorate of Energy, this is produced for different purposes (valuation of the possible non-compliance on the part of the trading company Watium, SL of the applicable regulations regarding payment of the network access toll) ”. It is striking to see how the claimed entity, to justify the treatment of the data end customers' personals for sending informative letters, "begging them" also that they contact the marketing entity, excuse themselves initially in the approval made by the CNMC, indicating to this Agency that, the "Letter" conformed to current regulations as it had been endorsed by the Agency Regulator and that after he denied it by denying knowledge of the existence of the letters, the claimed entity will change its argumentation by trying Now, with these new allegations, justify that: (…) The CNMC did know that these letters were sent to I-DE clients whose marketing company did not pay the access fees after the end of the voluntary payment period and after having has been reliably required for this purpose, as expressly provided by law applicable, in order to avoid the supply being suspended without the knowledge of the holder of the contract, nor to be able to have it, that his access contract was in the of non-payment ”. It is true, as the claimed entity affirms, that the CNMC learned of the existence of the letters long after they were sent, but it was not through the distribution entity, if not through the complaint filed by the marketing entity before said Organism. In short, it is not true that the CNMC knew of the existence of the letters through of the distribution entity : “(…) Iberdrola Distribución Eléctrica, SAU has not addressed to the CNMC before sending Watium, SL clients the letters that are treats (…) ” . Nor is it true that said Agency reported favorably. Other Another thing is that said Agency had knowledge of the letters sent a long time later, through the complaint filed by the entity trading company before said Body but the fact that later the CNMC decided to inform the Directorate General of Energy the facts is an issue that this Agency cannot enter into to assess, as it falls outside the scope of competition, so it is still impossible to take into account the repeated allegations presented by the entity claimed in section 3 of the Point 2. On the legal basis of the treatment in the present case (section 4 of point 2 of the allegations). The claimed entity now welcomes the legitimate interest established in article 6.1 f) of the RGPD for the sending of the letters, without even justifying the reasons that lead to this, limiting themselves to indicating that: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 29 29/37 “(…) In this way, it would be applicable to the assumption, at least, and although considers sufficient the legal basis of the contractual relationship, the rule of interest legitimate prevailing established in article 6.1 f) of the RGPD (...) ”, not providing no legal basis that allows weighing, even minimally, the legality of the treatment of the data of the end consumers, by sending the letters to those referred to in this procedure, suffering from an absolute lack of motivation, since only recital 47 of the RGPD is transcribed at this point for your defense. Therefore, if the claimed entity now avails itself of the legitimate interest for the treatment of personal data of end customers, the rule requires you to carry out a balancing exercise between said legitimate interest and fundamental rights of those affected. In this sense, the Judgment of the Court of Justice declared expressly the direct effect of article 7 f) of Directive 95/46 / EC, according to which: “ The Member States shall provide that the processing of personal data may only be be carried out if (...) it is necessary to satisfy the legitimate interest pursued by the person responsible for the treatment or by the third party or third parties to whom the data, provided that the interest or fundamental rights and freedoms do not prevail of the interested party that require protection in accordance with article 1.1 of this Directive". Therefore, to determine if the application of the aforementioned precept is appropriate, it will be necessary to apply the rule of weighting provided in it; that is, it would be necessary assess whether in the specific case under analysis there will be a legitimate interest pursued by the data controller (marketing company) or by the third party or third parties to whom the data is communicated (distribution company), which prevails over the interest or the fundamental rights and freedoms of the interested party that require protection in accordance with the provisions of article 1 of the RGPD, or if, for on the contrary, the fundamental rights or interests of the interested parties to whom refers to the treatment of the data must prevail over the interest in which the entity claimed seeks to substantiate the processing of personal data. Thus, in order to carry out the necessary weighting required, you must consider whether, taking into account the specific circumstances that occur in the present case, the interest pursued by the distribution entity by sending the letters informative and "beg" to end consumers, treating their personal data It must prevail over the right to data protection of those affected. In the present case, from the reading of the letter sent to the final consumers, It follows that the purpose pursued by the distribution entity is, firstly, inform the end consumer of a presumed contractual breach of their entity marketer with the distribution entity to then "beg" the consumer final contact with the marketer with the ultimate goal of he pays what is allegedly owed, otherwise the continuity of electrical supply to your home may be in danger, observing a possible intimidating background towards the final consumer, although the distribution entity keep in stating that said letter is not, at all, a request for payment to the final consumer as he recognizes that he meets his obligation to pay billing of electricity consumption to the marketing entity. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 30 30/37 Therefore, it is evident that the ultimate interest, which moves the distribution entity to send the letters to the final consumers is that the marketer pays them the owed, even though, from the reading of the letter, the final consumers may feel "pressured" to contact the marketing entity, under the "Threat" of suspending the electricity supply if the marketing entity does not pay what is owed. Therefore, it is not possible to consider the processing of data as a legitimate interest personal data of the final consumers by the distribution entity to send them informational letters of the breaches of the marketing entity and "Begging" you to get in touch with it to remedy the problem, as in this case, the rights and freedoms must undoubtedly prevail fundamentals of the interested party. However, it is entirely correct that the distribution company has the right to "Recover some amounts that it has been forced to enter for the electrical system despite not having collected them ”, by the legal means it deems appropriate, but the claimed entity should not confuse this right with the presumed "interest legitimate ”which is used for the illicit treatment of the personal data of the final consumers - Regarding the setting of the amount of the sanction in the commencement agreement, (point three- ro of the allegations). Indicate, once again, that Law 39/2015, of October 1, on the Procedure Common Administration of Public Administrations, (LPACAP), establishes, in its article 53.2: "In addition to the rights provided in the previous section, in the case of administrative procedures of a sanctioning nature, the alleged Responsible parties will have the following rights: a) To be notified of the facts that are charged, of the infractions that such facts may constitute and of the sanctions that, if applicable, could be imposed (…) ”. For its part, article 64 of the aforementioned LPACAP establishes, with respect to the Agreement to initiate procedures of a sanctioning nature, which: 1. The initiation agreement will be communicated to the instructor of the procedure, with transfer of how many actions exist in this regard, and the interested parties will be notified, understanding in any case the accused as such. Likewise, the initiation will be communicated to the complainant when the rules governing the procedure so provide. 2. The initiation agreement must contain at least: a) Identification of the person or persons allegedly responsible. b) The facts that motivate the initiation of the procedure, its possible qualification and the penalties that may correspond, without detriment of what results from the instruction Therefore, that the sanctioning body anticipates the amount of the sanction that would proceed impose, and always depending on what ultimately results from the procedure and that, in the Proposed Resolution, is proposed, an amount identical to that indicated by the body C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 31 31/37 sanctioner in the Initiation Agreement, has nothing in particular, nor does it attempt against no established norm, so it is not appropriate to consider what is alleged by the entity claimed at this point, even more so when it only records the fact, without even supporting in the least the reasons that lead him to put in between said the legality of the sanctioning procedure carried out. On the other hand, it is not true, as the claimed entity affirms that: “(…) the body sanctioner is not limited to remembering which is the applicable sanctioning norm, but assesses effectively, without paying attention at any time to what the inserted, what concrete sanction, within the limits established by the norm, it is appropriate to impose (…) ” because in the document initiating the sanctioning proceedings, You can read verbatim, in your "agreement": " WHAT: for the purposes provided for in art. 64.2 b) of Law 39/2015, of October 1, on the Common Administrative Procedure of the Public Administrations, the corresponding sanction would be a fine of 200,000 euros (two hundred thousand euros), without prejudice to what results from the instruction ”, and therefore, the sanction to be imposed becomes conditional on the result of the instruction of the process. The fact of indicating a specific numerical data of the sanction in the commencement agreement is simply in application of the provisions of article 64.1.b) of LPACAP cited above and in application of the provisions of article 68 of the LOPDGDD, according to which it will be enough to specify the facts that motivate the opening, identify the person or entity against which the procedure is directed, the infraction that could have been committed and its possible sanction. Therefore, the statement made by the entity cannot be taken into account claimed when it indicates that the possible sanction that may correspond to the imputed infractions is a determining factor of defenselessness or that implies a rupture of the principle of separation of the investigation and resolution phases. On the contrary, with This is in compliance with one of the requirements set forth in the standards outlined. For its part, article 85 of the LPACAP contemplates the possibility of applying reductions on the amount of the penalty if the offender acknowledges his responsibility and in the event of voluntary payment of the penalty. This precept establishes the obligation to determine those reductions in the notice of initiation of the procedure, which entails the need to set the amount of the penalty corresponding to the facts accused and it is not true, as stated by the claimed entity that this article establish that the amount of the sanction is determined once the procedure, since the recognition of responsibility and voluntary payment of the sanction what has to occur after that moment, and not the fixation of the amount of the penalty. If this acknowledgment of responsibility or voluntary payment does not occur, which would determine the termination of the procedure, it is instructed and dictates later the resolution proposal, in which they have to be fixed in a reasoned way the facts that are considered proven and their exact legal qualification, will determine the infringement that, where appropriate, those constitute, the person or persons responsible and the sanction that is proposed, the evaluation of the tests carried out, especially those that constitute the basic foundations of the decision. This must be notified to the interested party, granting him a period to formulate allegations and present the documents and information deemed pertinent. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 32 32/37 In no case will a resolution be adopted without the interested party having the opportunity to manifest itself on all the extremes considered. Therefore, it is not true that the claimed entity has seen its rights and it cannot be said that the determination of the amount of the fine in the opening does not imply any reduction in said guarantees causing helplessness. Nor does this circumstance break the impartiality of the investigating body, which provides of all the powers conferred by the regulations in question and full freedom to dictate your motion for a resolution. You just have to go to the Agency's website, in the that all resolutions issued in sanctioning procedures are published, to check the large number of them ending with a file resolution of actions, following the proposal issued by the instructor of the procedure, as well such as those in which said proposal increased or decreased the amount of the sanction set in the opening agreement or even proposed the application of a power of attorney corrective other than the sanction of a fine. - On the application in the present case of the principle of proportionality and the modifying circumstances of the concurrent responsibility in the same (fourth point of the allegations): a) .- Regarding the number of letters sent to clients, indicate that, for this Agency there is the same rejection of an illicit treatment of 2,598 personal data as a illicit treatment of 1,462 personal data, so it is not appropriate to reconsider the aggravating point a) of article 83.2 of the RGPD. b) .- On the statement made by the claimed entity when it alleges that: “(…) Understands this part that the AEPD cannot take as true or assume in In no way a representation that not only is not in any case accredited, but also refuses, since Watium always claims to act on his own Name. Therefore, there is no doubt that this entity holds the status of interested party for the purposes provided in the data protection regulations, is the application of such an aggravating circumstance is completely inadmissible ”, It should be remembered that, for example, in the claim itself presented by the entity Watium SL., In this Agency, it was indicated verbatim: “A claim is filed against Iberdrola Distribución Eléctrica, SAU (company electricity distribution company) by sending a series of letters (we have proof of 2598 letters) to the clients of Watium, SL (trading company of electrical energy) distracting the purpose for which the data were transferred from the marketer to the distributor (purpose: supply) lacking legal basis to get in touch with the clients of Watium, SL c) .- On the statement made by the claimed entity when it indicates that: “3. He says, thirdly, the AEPD, that I-DE acted “knowing that there were different complaints filed and reports issued by different public bodies who rejected said action, the entity continued to send information letters to the end customers, and, therefore, could constitute an illegal act ”. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 33 33/37 My client cannot but reiterate that he does not know what those reports are and resolutions that she was supposed to know when she carried out the treatment of the data. Indeed, since obviously they cannot be what they are object of this procedure there are only two possibilities: that the AEPD refers to the complaint filed by Watium with the CNMC or that it is the requested report by that entity to the Legal Office of the AEPD. Well, as a first consideration, both the complaint and the request for a report were after treatment, so it could hardly be done after knowing the "resolution" issued or the report issued (...). Well, as stated in the sanctioning file, there is a certificate issued by the Electronic Notification Service and Electronic Address, dated acceptance 05/23/19 and being the receiver *** NIF. 1 AAA in representing IBERDROLA DISTRIBUCIÓN ELÉCTRICA SA, with NIF A95075578, this Agency sent to the claimed entity the complaint filed with this Agency by the entity Watium SL, including: - Model network access contract signed between the two entities. - Sample letter sent by Iberdrola to WATIUM SL clients. - Letter sent to the Markets and Competition Commission on 01/22/18. - Written sent to Iberdrola on 01/23/18. - Request for a legal report to the AEPD, dated 02/19/18. - Response of the legal office of the AEPD, dated 07/24/18 - Request from the DPD of WATIUM SL to the DPD of IBERDROLA, dated 10/24/18. - Burofax a IBERDROLA, to stop sending the letters, 10/24/18. - Service response IBERDROLA legal, dated 11/02/18. - Examples of letters sent by IBERDROLA, Q1 2018, Q3 2018 and Q1 2019. However, the foregoing, knowing that there were different claims filed and reports issued by different public bodies that put into doubt said action, dated 09/05/19, (3 months later), the claimed entity sends customers of the trading company ENERGÍA Y SERVICIOS ABY, SL the The same letters that I sent some time before to the clients of the marketer WATIUM SL. Therefore, it is not true, as the claimed entity tries to justify that it was unaware the reports and resolutions that questioned the processing of personal data of end customers, thereby evidencing the negligence of the entity's conduct claimed, since its action was carried out without the due level of due diligence. d) .- On the alleged seriousness derived from the treatment of categories of data limited only to those of a merely identifying nature, remember that the Article 1.2 of the RGPD establishes that: “This Regulation protects the rights and fundamental freedoms of natural persons and, in particular, their right to freedom protection of personal data ”, defining in its article 4.1, the“ personal data ” as: “all information about an identified or identifiable natural person, whose identity can be determined, directly or indirectly, in particular by means of a identifier, such as a name, an identification number, etc. ”, and by Therefore, in this case, when the claimed entity makes an illicit use of the name, surname or address, is sufficiently clear evidence of an illicit use of data personal protected by the RGPD and therefore, object of aggravation in application of the section g) of article 83.2 of the RGPD. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 34 34/37 d) .- Regarding the alleged illegal use of the data to avoid losses to I-DE, indicate that, From the letters sent to the end customers, it is clear that the objective The end of the claimed entity, as argued above, was to avoid the losses that the contractual breach of the marketers was producing in the distributor, so it is not appropriate to consider the allegations made at this point. e) .- Regarding the connection between I-DE and data processing, indicate that it is notorious that an entity like I-DE, handles personal data of more than 6 million direct and indirect customers, through marketers, in addition to having a staff of more than 35,000 employees, so that, an entity like her, is owed require a maximum level of due diligence in the processing of personal data and its management, both of the personal data of direct customers and the data personal data that the marketers provide you with in order to send them power supply. Therefore, the interpretation made by this Agency of the aggravating factors established in the RGPD and the LOPDGDD is totally in accordance with the infractions committed by the claimed entity. III Thus, the known facts constitute an infringement, attributable to the claimed entity, for violation of the articles: - Art. 6.1.b) of the RGPD, which establishes that: “the processing of data will only be lawful to if it is necessary for the execution of a contract in which the interested party is part or for the application at his request of pre-contractual measures ”. - Art. 5.1.b) of the RGPD which establishes that: “personal data will be collected for specific, explicit and legitimate purposes and will not be further processed in a manner incompatible with said purposes, (purpose limitation). - Art. 5.1.c) of the RGPD, which establishes that: “Personal data will be the ade- appropriate, relevant and limited to what is necessary in relation to the purposes for which that are treated, (data minimization). For its part, article 72.1.a and b) of the LOPDGDD considers as "very serious", Prescription purposes, the processing of personal data if, " violates the principles and guarantees established in article 5 of the RGPD "and if it is carried out," without any of the conditions of legality established in article 6 of the RGPD concur ”, respectively. IV These infractions can be sanctioned with a fine of € 20,000,000 maximum or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual global business volume of the previous financial year, opting for the of a higher amount, in accordance with article 83.5.a) of the RGPD. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 35 35/37 In accordance with the indicated precepts, and without prejudice to what results from the instruction of the procedure, in order to fix the amount of the sanction to be imposed in In this case, it is considered that the sanction to be imposed should be adjusted according to with the following aggravating criteria, established in article 83.2 of the RGPD: - The nature, severity and duration of the offense, taking into account the nature nature, scope or purpose of the treatment operation in question, as well as such as the number of interested parties affected and the level of damages who have suffered, when carrying out an improper treatment of personal data, (section a). - The intentionality or negligence in the infringement. In the present case we are before negligent action, because even having knowledge of the filing of claims before different public bodies, by the company Watium, Iberdrola continues to send letters to the clients of the claimed entities mantes, (section b). - The categories of personal data affected by the infringement, already that the data processed, in this case, are customer identification data end of the marketing entities and their location, (section g). - The way in which the supervisory authority learned of the infringement, since that the AEPD became aware of the infringement through the claim of the interested party, (section h). - The losses avoided, directly or indirectly, through the infringement, in In this case, trying to use the mediation of the clients of the co- mercializadoras, with the illicit treatment of your personal data to obtain guide that the trading entities pay the debt contracted with the company. distribution company, (section k). It is also considered that the sanction to be imposed should be adjusted in accordance with the following aggravating criteria, established in article 76.2 of the LOPDGDD: - The linking of the activity of the offender with the performance of treatment of personal data, (section b). The balance of the circumstances contemplated in article 83.2 of the RGPD, with regarding the offense committed by violating the provisions of its articles 5.1.b and c) and 6.1.b) allows setting a penalty of 200,000 euros (two hundred thousand euros), considered as “very serious”, for the purposes of this prescription, in article 71.1.a and b) respectively, of the LOPDGDD. In view of the above, the following is issued: RESOLVES : FIRST: IMPOSE on the entity, I-DE REDES ELECTRICAS INTELLIGENTES, SAU (I-DE), formerly known as IBERDROLA SA, with CIF: A95075578 a C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 36 36/37 sanción de 200.000 euros (doscientos mil euros), por infracción de los artículos, 5.1.b) y c) y artículo 6.1.b) del RGPD. SEGUNDO: NOTIFICAR la presente resolución a la entidad I-DE REDES ELÉCTRI- CAS INTELIGENTES, S.A.U e INFORMAR a los reclamantes sobre el resultado de la reclamación. TERCERO: Advertir al sancionado que la sanción impuesta deberá hacerla efectiva una vez sea ejecutiva la presente resolución, de conformidad con lo dispuesto en el ar- tículo 98.1.b) de la ley 39/2015, de 1 de octubre, del Procedimiento Administrativo Co- mún de las Administraciones Públicas (LPACAP), en el plazo de pago voluntario que señala el artículo 68 del Reglamento General de Recaudación, aprobado por Real De- creto 939/2005, de 29 de julio, en relación con el art. 62 de la Ley 58/2003, de 17 de diciembre, mediante su ingreso en la cuenta restringida nº ES00 0000 0000 0000 0000 0000, abierta a nombre de la Agencia Española de Protección de Datos en el Banco CAIXABANK, S.A. o en caso contrario, se procederá a su recaudación en período eje- cutivo. Recibida la notificación y una vez ejecutiva, si la fecha de ejecutividad se encuentra entre los días 1 y 15 de cada mes, ambos inclusive, el plazo para efectuar el pago vo- luntario será hasta el día 20 del mes siguiente o inmediato hábil posterior, y si se en- cuentra entre los días 16 y último de cada mes, ambos inclusive, el plazo del pago será hasta el 5 del segundo mes siguiente o inmediato hábil posterior. De conformidad con lo establecido el artículo 82 de la Ley 62/2003, de 30 de diciem- bre, de medidas fiscales, administrativas y del orden social, la presente Resolución se hará pública, una vez haya sido notificada a los interesados. La publicación se realiza- rá conforme a lo previsto en la Instrucción 1/2004, de 22 de diciembre, de la Agencia Española de Protección de Datos sobre publicación de sus Resoluciones. Contra esta resolución, que pone fin a la vía administrativa, y de conformidad con lo establecido en los artículos 112 y 123 de la LPACAP, los interesados podrán interpo- ner, potestativamente, recurso de reposición ante la Directora de la Agencia Española de Protección de Datos en el plazo de un mes a contar desde el día siguiente a la noti- ficación de esta resolución, o, directamente recurso contencioso administrativo ante la Sala de lo Contencioso-administrativo de la Audiencia Nacional, con arreglo a lo dis- puesto en el artículo 25 y en el apartado 5 de la disposición adicional cuarta de la Ley 29/1998, de 13/07, reguladora de la Jurisdicción Contencioso-administrativa, en el pla- zo de dos meses a contar desde el día siguiente a la notificación de este acto, según lo previsto en el artículo 46.1 del referido texto legal. Finalmente, se señala que conforme a lo previsto en el art. 90.3 a) de la LPACAP, se podrá suspender cautelarmente la resolución firme en vía administrativa si el interesa- do manifiesta su intención de interponer recurso contencioso-administrativo. De ser éste el caso, el interesado deberá comunicar formalmente este hecho mediante escrito dirigido a la Agencia Española de Protección de Datos, presentándolo a través del Re- gistro Electrónico de la Agencia [https://sedeagpd.gob.es/sede-electronicaweb/], o a través de alguno de los restantes registros previstos en el art. 16.4 de la citada Ley 39/2015, de 1 de octubre. También deberá trasladar a la Agencia la documentación que acredite la interposición efectiva del recurso contencioso-administrativo. Si la Agencia no tuviese conocimiento de la interposición del recurso contencioso-adminis- trativo en el plazo de dos meses desde el día siguiente a la notificación de la presente resolución, daría por finalizada la suspensión cautelar. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es Page 37 37/37 Mar España Martí Directora de la Agencia Española de Protección de Datos C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es