AEPD - PS/00333/2019
|AEPD - PS/00333/2019|
|Relevant Law:||Article 5 GDPR|
Article 58(2) GDPR
Article 83(5)(a) GDPR
|National Case Number/Name:||PS/00333/2019|
|European Case Law Identifier:||n/a|
|Original Source:||Agencia Española de Protección de Datos (in ES)|
Spanish DPA holds that the entity is not responsible for the facts reported, since the telephone number from which the infringement occurred was transferred in January 2018 to another company
Personal messages were sent by a telephone agent of a TELECOM company to a customer whose telephone number he had access to because he had previously called her to offer her the company's services
Does sending messages by a telephone agent to a customer's telephone number to which he has access because he had made a commercial call infringe Article 5 of the GDPR?
The DPA held that the entity who was the object of the complaint was not responsible because it had transferred the agent's number to another entity before the events took place
Share your comments here!
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
DECISION ON DISCIPLINARY PROCEEDINGS From the procedure instructed by the Spanish Data Protection Agency and on the basis of the following BACKGROUND FIRST: Mrs. A.A.A. (hereinafter, the complainant) on 29/05/2019 filed claim before the Spanish Data Protection Agency. The claim is directed against TECSIBLE, S.L. with NIF B97907992 (from now on, the claimed). The The grounds for the complaint are, in summary: That on Thursday 10/01/2019, even with one of VODAFONE's employees on the Robinson list, from name B.B.B., contacts the complainant on her personal phone to offer you a change of company and after informing you that you are not interested end the conversation. On Monday 01/14/2019 you receive a message via WhatsApp of that person with the following text: "Helloaa beautiful. I'm B.B.B. from Vodafone. I was really proud to contact you, I love your voice, your sympathy, and your kindness.. I'd really like to be your friend. At no time did the complainant give this person cause to contact with her, so I request that VODAFONE investigate and expedite this worker for violating his privacy. And attach the following documentation: - Copy of the DNI. On 21/01/2019 the same complaint was filed with this agency, but it provide more data: - With regard to the telephone call, the calling number is ***PHONE.1 - Regarding the Whatsapp message, the source number of the message is ***PHONE.2 And attach the following documentation: - Screenshots of the conversation via Whatsapp. - Copy of police report. SECOND: In view of the facts reported and the documents provided by the claimant of which this Agency has become aware, the Sub-Directorate The General Data Inspectorate proceeded to carry out actions for the clarification of the facts in question. On 13/02/2019, the complaint was transferred to VODAFONE in the reference actions, no response being received. On 29/05/2019, VODAFONE sent the reply to the transfer to this Agency of the complaint: C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/6 1. A copy of the letter sent to the complainant apologizing and informing you of the steps taken by VODAFONE. In this letter, the following demonstrations are held, among others: a. That these practices are totally forbidden at VODAFONE and also apply to your service providers. b. That, upon receipt of the complaint, an internal investigation was opened and they contacted their supplier. The supplier indicated that there is no record on your dialers no outgoing calls from the number indicated in the claim and from which you received the message through WhatsApp. In this sense, they understand that this contact was made at personal title by the agent. c. That, since this practice is not admissible, they have put him in knowledge of your provider so that, as an employer of said agent, take appropriate action. d. That they have asked their provider to remind all their employees that it is strictly forbidden to contact The campaigns are addressed to individuals. e. Who have included the mobile number of the complainant in their list Robinson in order to ensure that it is not included in future campaigns commercials managed by VODAFONE. 2. States that they have verified that the reported contact has been made by an agent of a company contracted by VODAFONE to provide recruitment services (ATTENTION), on a personal basis and using their number personal. 3. States that the number through which the agent contacted in a personal capacity the complainant does not belong to VODAFONE, i.e. it is not listed in the numbers assigned to the ATENTO platform for the provision of services of recruitment. 4. He states that, after contacting ATENTO, they have verified that the number ***TELÉFONO.3 was included in a database that was provided to ATENTO to make pickup calls but which, according to ATENTO, do not there are neither outgoing nor incoming calls associated with that number. In other words, that this number was never called as a result of the of the service by ATENTO. On 29/05/2019, VODAFONE sent the following information to this Agency in response to the request for information dated 10/05/2019: 1. States that its systems do not have any clients associated with the number ***PHONE.3 Provides screenshots of searches made by that number. 1. States that they do not have documentation proving consent of the complainant to be contacted for commercial reasons because the number ***TELÉFONO.3 has been randomly generated so that VODAFONE does not have it associated with any particular person. 2. States that the numbers ***TELÉFONO.1 and ***TELÉFONO.2 do not belong to VODAFONE. On 04/06/2019, ADIGITAL sent this Agency the following information: 1. States that the telephone number ***TELÉFONO.3 is registered under the Robinson List in the name of the complainant through the call channel since 09/10/2018. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/6 Provide a certificate. On 07/06/2019 ORANGE sends this Agency the following information: 1. It confirms the existence of a call from the originating number ***PHONE.1 to destination number ***PHONE.3 on 10/01/2019 to 18:37h. On 07/06/2019, LEAST COST ROUTING TELECOM, S.L. refers to this Agency the following information: 1. States that the end-user corresponding to the number ***TELEPHONE.1 is TECSIBLE whose data have been included in the section of entities investigated. Provide a copy of the invoice dated 30/04/2019. On 03/07/2019, a request for information is sent to TECSIBLE, not having received a reply. On 10/09/2019, it is verified in ***URL.1 that the telephone prefix ***PREFIJO.1 corresponds to ***PAIS.1 THIRD: On 20/12/2019, the Director of the Agency agreed to initiate sanctioning proceedings against TECSIBLE, for the alleged infringement of article 5.1(b), as defined in Article 83(5)(a) and considered for the purposes of the statute of limitations in Article 72(1)(a), a fine of EUR 5,000 FOURTH: Notified of the agreement to initiate the proceedings, the respondent submitted a written statement on 24/12/2019 of allegations, stating, in summary: that he had been notified of the agreement to start and pointed out that the telephone number ***PHONE.1, was given since January 2018 to the company COSMOS CALL CENTER, S.L., and that the second phone number on the sanctioning file as well as the owner we understand that he belongs to that society. FIFTH: From the actions carried out in the present procedure, the following have been The following are accredited, PROVEN FACTS 1. The 15/01/2019 has written entry of the complainant stating that the 10/01/2019, even though Robinson, one of the workers of the VODAFONE company, is on the list name Ricardo, has contacted the complainant on his personal phone to offer her a change of company, moving her that she wasn't interested in the change. On Monday 01/14/2019 you received a message through WhatsApp from that person with the following text: "Helloaa beautiful. I am C.C.C. from Vodafone. I was really proud to contact you, I love your voice, your sympathy, and your kindness.. I'd really like to be your friend. 2. The complainant provides a copy of her ID card number ***NIF.1 C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/6 3. A copy of the complaint made by the complainant to the Police Commissioner of ***DIRECCIÓN (Madrid) by the above facts. 4. On 21 January 2019, the complainant wrote to VODAFONE informing it of the events previously disclosed and to take action against the employee by violating his privacy. 5. VODAFONE has stated that "After analysing the complaint and carrying out timely investigations we have verified that the contact reporting the The complaint was made by an agent of a company hired by Vodafone for the provision of recruitment services (Atento) on a personal basis and using their personal number. As answered in file 4173/2018, the number through the which the agent contacting the claimant in a personal capacity does not belong to Vodafone is that is to say, it does not appear within the numbers assigned to the Atento platform for provision of recruitment services". 6. These are messages received by the complainant through whasapp of the phone ***PHONE.2, messages identifying the employee as Vodafone operator, name B.B.B. 7. The company Adigital in a letter dated 04/06/2019 has certified 'that the number of phone ***TELÉFONO.3 is registered in the Robinson List in the name of claimant, with ID number ***NIF.1,..." 8. The company LEAST COST ROUTIN TELECOM, S.L in writing of 07/06/2019 indicated that: "...proceeds to provide them with the information we have in our files from number ***TELÉFONO.1 End User: TECSIBLE, S.L. NIF B97907992 Address: ***ADDRESS ***LOCALITY 9. ORANGE ESPAGNE S.A.U., in a letter dated 06/06/2019 has indicated that "With regard to making a call dated January 10, 2019 between 5 and 8 p.m. from the calling number ***PHONE.1, we confirm that on that date and time an outgoing call was made to the ***PHONE.3 line;..." 10. TECSIBLE in writing of 24/12/2019 has pointed out that: "..., the telephone number ***TELÉFONO.1, is assigned since January 2018 to the company COSMOS CALL CENTER SL, with CIF 887708236, whose representative is C.C.C. with DNI ***NIF.2 and telephone number for contact ***TELÉFONO.4, para lo which we provide assignment and configuration emails for that terminal. Second, the second telephone number that appears in the sanctioning file as well as the owner we understand that belongs to that society (COSMOS CALL CENTER, S.L.) LEGAL FOUNDATIONS C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/6 I By virtue of the powers conferred on each authority in Article 58(2) of the GPRS, the control, and in accordance with the provisions of Articles 47 and 48 of the LOPDGDD, the of the Spanish Data Protection Agency is competent to initiate and to resolve this procedure. II The reported facts are materialized in the sending through the application WhatsApp gives a message to the claimant using their data in an inconsistent manner and without authorization, in violation of the principle of confidentiality. Article 5, Principles relating to processing, of the RGPD states that: "1. Personal data shall be: (…) (b) collected for specified, explicit and legitimate purposes and not processed subsequently in a manner incompatible with those purposes; in accordance with Article 89, paragraph 1, the further processing of personal data for archiving purposes in public interest, scientific and historical research or statistical purposes are not shall be deemed to be incompatible with the initial purposes ("purpose limitation"); (…)” III Law 40/2015 of 1 October on the Legal Regime of the Public Sector Article 28, Liability, provides as follows: . "1. The following may be punished only for acts constituting an infringement The administrative authorities of natural and legal persons and, where a law The Committee on Economic, Social and Cultural Rights (CESCR) has been working on a number of issues legal personality and independent or autonomous assets, which are responsible for them by way of malice or guilt. 2. The administrative responsibilities arising from the commission of a shall be compatible with the requirement that the offender be reinstated in the situation altered by it to its original state, as well as with the compensation for the damage caused, which shall be determined and required by the body at that the exercise of the sanctioning power corresponds. If the compensation within a period to be determined on the basis of its amount, shall be shall proceed in the manner provided for in Article 101 of the Law on Procedure Common Administration of Public Administrations. 3. When the fulfilment of an obligation established by a rule with The following are the main reasons why the status of the law corresponds to several persons together The Commission shall be jointly and severally liable for any infringements committed and any penalties imposed. impose. However, where the penalty is financial and it is possible to individualized in the resolution according to the degree of participation of each responsible. 4. The laws governing the various penalty regimes may to make it an offence to breach the obligation to prevent administrative offences by those who are subject to a dependency or attachment. They may also provide for cases in which certain persons shall be liable for payment of the financial penalties imposed to those who depend on them or are linked to them". In the present case, the agreement to initiate the procedure charged the claimed the alleged violation of Article 5(1)(b), as set out in Article 83(5)(a) and considered for the purposes of prescription in Article 72.1.a) of the LOPDGDD. However, once the investigative actions have been carried out It is clear from the above that the Commission is not in a position to make a decision on this matter. entity is not responsible for the facts reported, since the number of The telephone number from which the messages were sent was given in January 2018 to the company COSMOS CALL CENTER, S.L. Therefore, in accordance with the applicable legislation and having assessed the criteria of graduation of penalties whose existence has been established, The Director of the Spanish Data Protection Agency RESOLVES: FIRST: ARCHIVE to TECSIBLE, S.L., with NIF B97907992, for an alleged violation of Article 5 of the GPRS, as defined in Article 83.5(a) of the GPRS. SECOND: TO NOTIFY this resolution to TECSIBLE, S.L., with NIF B97907992. In accordance with Article 50 of the LOPDGDD, the This Resolution shall be made public after it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure according to art. 48.6 of the LOPDGDD, and in accordance with Article 123 of the LPACAP, the interested parties may, on an optional basis, file an appeal for replacement to the Director of the Spanish Data Protection Agency within a month from the day following notification of this resolution or directly contentious-administrative appeal before the Administrative Chamber of the Audiencia Nacional, in accordance with Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998 of 13 July 1998, regulating the Contentious-Administrative Jurisdiction, within two months from day following notification of this act, as provided for in Article 46(1) of referred to Law. Mar España Martí Director of the Spanish Data Protection Agency