AEPD - PS/00262/2020
|AEPD - PS/00262/2020|
|Relevant Law:||Article 5(2) GDPR|
Article 6(1) GDPR
|Parties:||XFERA MÓVILES, S.A.|
|National Case Number/Name:||PS/00262/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD decision (in ES)|
The Spanish DPA (AEPD) fined XFERA MÓVILES, S.A. €40000 for violating Article 6(1) GDPR by illegally processing personal data of the claimants in a fraudulent hiring. The defendant was not sufficiently diligent in verifying the identity of the persons hiring two telephone lines.
English Summary[edit | edit source]
Facts[edit | edit source]
The personal data of the claimants were used illegitimately to contract two telephone lines with the company XFERA MÓVILES, S.A. The decision does not provide a clear description of the facts. However, on the basis of the available information it seems that when the complainants learned what had happened, they reported it to the Guardia Civil (Spanish military police) and the AEPD.
Dispute[edit | edit source]
The key to this case was to determine whether or not the defendant applied adequate measures to verify the identity of the clients. The company claimed that when they learned that it was a fraudulent contract, they suspended the services and cancelled the debt generated. Likewise, they blocked the data of the data subjects and classified the contract as fraudulent.
Holding[edit | edit source]
The Spanish DPA concludes that the defendant has not been able to demonstrate that it adopted sufficient diligence measures to verify the identity of the clients before signing the contracts. Therefore, it breached Article 6(1) GDPR by processing personal data without a legitimate basis.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/7 Procedure No.: PS / 00262/2020 RESOLUTION OF SANCTIONING PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following: BACKGROUND FIRST: The General Directorate of the Civil Guard (Company of Manzanares, Bolaños Post) transferred to the Spanish Agency for Data Protection, dated May 13, 2019, the actions followed in relation to a usurpation of identity in the contracting of telecommunications services, which took place on February 26, 2019. The claim filed by D. A.A.A. and Ms. B.B.B. (hereinafter the claimants). The claim is directed against XFERA MÓVILES, S.A. with NIF A82528548 (hereinafter, the claimed). Providing the following documentation: Certificate number 2019-000593-00000110 dated February 26, 2019 in which the claimants state that according to company information they have been two telephone lines and internet with numbers *** TELEPHONE 1 and *** TELEPHONE. 2 and with a charge account that is not owned. The Tomorrow of February 25, 2019 the telephone company is in contact with one of his daughters informing her that, if they do not pay the amounts owed to said numbers, the service would be interrupted. Summary of the actions carried out by the Bolaños Civil Guard de Calatrava (Ciudad Real). MASMOVIL (XFERA MÓVILES, S.A.) contracts for the telephone lines reported. SECOND: In view of the facts denounced, the General Subdirectorate of Data Inspection proceeded to carry out preliminary investigation actions for the clarification of the facts in question, by virtue of the powers of investigation granted to the control authorities in article 57.1 of the Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD), and in accordance with the provisions of Title VII, Chapter I, Second Section, of the Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). As a result of the investigation actions carried out, it is verified that the person responsible for the treatment is the one claimed. Likewise, the following points are found: Examining the information provided by the Civil Guard, it is found that the Reported lines have been hired by people outside the claimants. No C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/7 outstanding debts were incurred by the claimants, since in the contracts contained the bank account of the people who had impersonated the identity of the claimants. These people, who used the ID of the claimants for both contracts, they lived in the same address of this and have been identified by the Civil Guard from the bank accounts provided in the hiring. Information requested from the respondent about the measures adopted after the receipt of the complaint before the Civil Guard of Bolaños of a possible impersonation of identity when contracting lines *** TELEPHONE.1 and *** TELEPHONE.2 and on the guarantees required for the accreditation of identity in the contracting of the referred phone lines. On January 16, 2020, the defendant states that according to his inquiries, the lines denounced have been classified as contracting fraudulent, and the debts associated with them have been forgiven. They provide a screenshot of the data that works in their systems of the reported lines. THIRD: On September 8, 2020, the Director of the Spanish Agency of Data Protection agreed to initiate a sanctioning procedure for the claimed party, with in accordance with the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged violation of Article 6.1 of the RGPD, typified in Article 83.5 a) of the RGPD. FOURTH: Once the aforementioned commencement agreement was notified, the defendant submitted a written allegations in which, in summary, he stated that he had knowledge of the usurpation of the claimant's identity on February 25, 2019, providing subsequently denounced on February 26, 2019 and dated March 4, 2019, proceeded to the suspension of services and the cancellation of the debt generated to date for fraudulent contracts. This led to data blocking of the interested parties and the cataloging of the registration as fraudulent. They add that the lack of diligence in the custody of the DNI cannot be transferred to reclaimed. On the other hand, they manifest the inexistence of the elements of the right sanctioner, do not appreciate the concrete existence of the principle of responsibility, since that no fraudulent or culpable action is revealed from which the herself. Therefore, by not appreciating fraud or guilt on the part of the defendant, nor so even as a mere non-observance, in relation to the facts that give rise to the sanctioning procedure, it can only lead to the file. FIFTH: On October 13, 2020, the instructor of the procedure agreed to the opening of a period of practical tests, taking as incorporated the preliminary investigation actions, E / 08518/2019, as well as the documents provided by the claimed. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/7 Of the actions carried out in this procedure and of the documentation Obrante in the file, the following have been accredited: PROVEN FACTS FIRST: Two telephone lines and internet are registered in the name of the claimants. The usurpation of identity in the contracting of services telecommunications, took place on February 26, 2019. SECOND: The defendant acknowledges said error and thus in his allegations he manifests that the reported lines have been classified as fraudulent hires, and the debts associated with them have been forgiven. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each control authority, and as established in articles 47 and 48 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and to solve this procedure. II The defendant is accused of committing an offense for violation of the Article 6.1 of the RGPD. Article 6, Legality of treatment, of the RGPD establishes that: "1. The treatment will only be lawful if at least one of the following is met terms: a) the interested party gave their consent for the processing of their data personal for one or more specific purposes; b) the treatment is necessary for the performance of a contract in which the interested is part or for the application at the request of this of measures pre-contractual; (…) " Article 4 of the RGPD, Definitions, in section 11, states that: "11)" consent of the interested party ": any manifestation of free will, specific, informed and unequivocal by which the interested party accepts, either through a statement or a clear affirmative action, the processing of personal data that they concern him ”. Also article 6, Treatment based on the consent of the affected, of the new Organic Law 3/2018, of December 5, on Data Protection Personal and guarantee of digital rights (hereinafter LOPDGDD), states what: "1. In accordance with the provisions of article 4.11 of the Regulation (EU) 2016/679, the consent of the affected party is understood to be any manifestation of will free, specific, informed and unequivocal for which it accepts, either through a C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/7 declaration or a clear affirmative action, the processing of personal data that concern. 2. When the data processing is intended to be based on consent of the affected party for a plurality of purposes, it will be necessary to record in a specific and unequivocal that said consent is granted for all of them. 3. The execution of the contract may not be subject to the consent of the affected party processing of personal data for purposes that are not related to the maintenance, development or control of the contractual relationship ”. Article 83.5 a) of the RGPD, considers that the infringement of “the principles basic for the treatment, including the conditions for consent in accordance with of articles 5, 6, 7 and 9 ”is punishable, in accordance with section 5 of the mentioned Article 83 of the aforementioned Regulation, “with administrative fines of € 20,000,000 maximum or, in the case of a company, of an equivalent amount at a maximum of 4% of the total global annual turnover of the financial year above, opting for the highest amount ”. On the other hand, the LOPDGDD in its article 72 indicates for the purposes of prescription: “Violations considered very serious: 1. In accordance with the provisions of article 83.5 of the Regulation (EU) 2016/679 are considered very serious and will prescribe after three years the infractions that suppose a substantial violation of the articles mentioned in that and, in in particular, the following: (…) b) The processing of personal data without the concurrence of any of the conditions of legality of the treatment established in article 6 of the Regulation (EU) 2016/679. (…) " III The documentation in the file provides evidence that the claimed, violated article 6.1 of the RGPD, since he processed the personal data without having any legitimacy for it. The personal data were incorporated into the company's information systems, without having accredited that he had legitimately hired, had his consent for the collection and subsequent processing of your personal data, or there is any other causes the treatment carried out to be legal. Well, with respect to the facts that are the subject of this claim, we must emphasize that the defendant has recognized this error and thus both in his writing dated January 16, 2019, as in the allegations to the Agreement to initiate the This sanctioning procedure has stated that the lines denounced have been classified as fraudulent contracts, and the debts associated with them have been forgiven. The lack of diligence displayed by the entity in complying with the Obligations imposed by the regulations for the protection of personal data It is thus obvious. A diligent compliance with the principle of legality in the treatment of third-party data requires that the person responsible for the treatment is in conditions to prove it (principle of proactive responsibility). IV C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/7 In order to establish the administrative fine to be imposed, they must observe the provisions contained in articles 83.1 and 83.2 of the RGPD, which point out: "1. Each supervisory authority shall ensure that the imposition of fines administrative under this article for the infractions of this Regulations indicated in paragraphs 4, 5 and 6 are in each individual case effective, proportionate and dissuasive. 2. Administrative fines will be imposed, depending on the circumstances of each individual case, as an additional or substitute for the measures contemplated in article 58, paragraph 2, letters a) to h) and j). When deciding to impose a fine administrative and its amount in each individual case will be duly taken into account: a) the nature, severity and duration of the offense, taking into account the nature, scope or purpose of the processing operation in question yes, as well as the number of interested parties affected and the level of damages who have suffered; b) intentionality or negligence in the infringement; c) any measure taken by the controller or processor to mitigate the damages suffered by the interested parties; d) the degree of responsibility of the person in charge of the treatment, taking into account the technical or organizational measures that have applied by virtue of articles 25 and 32; e) any previous infringement committed by the person in charge or the person in charge of the treatment; f) the degree of cooperation with the supervisory authority in order to remedy the violation and mitigate the possible adverse effects of the violation; g) the categories of personal data affected by the infringement; h) the way in which the supervisory authority learned of the infringement, in particular if the person in charge or the person in charge notified the infringement and, in such case, what extent; i) when the measures indicated in Article 58 (2) have been previously ordered against the person in charge or the person in charge in relation to the same matter, compliance with said measures; j) adherence to codes of conduct under Article 40 or to mechanisms certification approved in accordance with Article 42, and k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, direct or indirectly, through infringement. In relation to letter k) of article 83.2 of the RGPD, the LOPDGDD, in its Article 76, “Sanctions and corrective measures”, establishes that: “2. According to the provisions of article 83.2.k) of Regulation (EU) 2016/679 may also be taken into account: a) The continuing nature of the offense. b) The linking of the offender's activity with the performance of treatments of personal data. c) The benefits obtained as a result of the commission of the offense. d) The possibility that the affected person's conduct could have led to the commission of the offense. e) The existence of a merger process by absorption after the commission C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/7 of the infringement, which cannot be attributed to the absorbing entity. f) Affecting the rights of minors. g) To have, when not mandatory, a delegate for the protection of data. h) The submission by the person in charge or in charge, with character voluntary, to alternative dispute resolution mechanisms, in those cases in which there are controversies between those and any interested." V In accordance with the provisions transcribed in order to fix the amount of the sanction of a fine to be imposed in the present case for the offense typified in the Article 83.5 of the RGPD for which the claimed person is responsible are estimated concurrent the following factors: Extenuating: - Any measure taken by the person in charge or in charge of the treatment to palliate the damages suffered by the interested parties (art.83.2. c) of the RGPD). Aggravating factors: - The intentionality or negligence of the infringement (article 83.2. B) of the RGPD). - Basic personal identifiers are affected (personal data (art.83.2. g) of the RGPD). - The evident link between the business activity of the claimed and the processing of personal data of clients or third parties (article 83.2.k, of the RGPD in relation to article 76.2.b, of the LOPDGDD) Therefore, in accordance with the applicable legislation and the criteria of graduation of the sanctions whose existence has been accredited, the Director of the Spanish Agency for Data Protection RESOLVES: FIRST: IMPOSE XFERA MÓVILES, S.A., with NIF A82528548, for a violation of Article 6.1 of the RGPD, typified in Article 83.5 of the RGPD, a fine of 40,000 euros. SECOND: NOTIFY this resolution to XFERA MÓVILES, S.A .. THIRD: Warn the sanctioned person that the sanction imposed by a Once this resolution is enforceable, in accordance with the provisions of the art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations (hereinafter LPACAP), within the payment period voluntary established in art. 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17, by means of their entry, indicating the NIF of the sanctioned person and the number of procedure that appears in the heading of this document, in the account restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Agency C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/7 Spanish Data Protection in the bank CAIXABANK, S.A .. In case Otherwise, it will be collected in the executive period. Notification received and once executive, if the execution date is found Between the 1st and the 15th of each month, both inclusive, the deadline for making the payment volunteer will be until the 20th day of the following or immediately subsequent business month, and if between the 16th and the last day of each month, both inclusive, the payment term It will be until the 5th of the second following or immediate business month. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the Interested parties may file, optionally, an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month to count from the day after notification of this resolution or directly contentious-administrative appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within a period of two months from the day following notification of this act, as provided in article 46.1 of the referred Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, may provisionally suspend the final resolution through administrative channels if the interested party expresses his intention to file contentious-administrative appeal. If this is the case, the interested party must formally communicate this fact through letter addressed to the Spanish Agency for Data Protection, presenting it through of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica- web /], or through any of the other records provided for in art. 16.4 of the cited Law 39/2015, of October 1. You must also transfer to the Agency the documentation proving the effective filing of the contentious appeal- administrative. If the Agency was not aware of the filing of the appeal contentious-administrative within a period of two months from the day following the notification of this resolution would terminate the precautionary suspension. 938-131120 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es