| AEPD - PS/00475/2019 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 17 GDPR Article 21 GDPR 48(1)(b) of the Spanish Telecommunications General Law |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 02.07.2020 |
| Fine: | 4000 |
| Parties: | DE VERE SPAIN, S.L. |
| National Case Number/Name: | PS/00475/2019 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Spanish |
| Original Source: | AEPD decision (in ES) |
| Initial Contributor: | Miguel Garrido de Vega |
2 July 2020 - The Spanish Data Protection Agency (AEPD) decided to early finish the sanction procedure against De Vere Spain, S.L. (the defendant) for the infringement of the right to objection specified at Article 21 GDPR in connection with Article 48(1)(b) of the Spanish Telecommunications General Law, as the defendant agreed to an early voluntary payment of the corresponding part (4,000 €) of the fine suggested by the AEPD (5,000 €).
English Summary
Facts
The decision is the consequence of a sanction procedure started by the AEPD against the defendant due to a complaint submitted by a Spanish citizen stating that he/she had exercised his/her right to erasure over the personal data processed by the defendant, but he/she received a commercial phone call by the defendant afterwards.
Dispute
The defendant answered to the AEPD investigation requests stating that (i) it never received any exercise of the right by the complainant, (ii) the complainant was not its customer (and so there was no possibility of erasing his/her data), (iii) it answered the complainant by postal mail in that sense, and (iv) that there is no real evidence that it made such commercial phone call to the complainant. The AEPD started the corresponding sanction procedure.
Holding
Without prejudice to the results of the final investigations corresponding to the sanction procedure, the AEPD understood that the defendant could have infringed the right to erasure of the complainant as per Article 17 GDPR, as well as his/her right as a consumer to refuse unsolicited commercial phone calls, as per Article 21 GDPR in connection with Article 48(1)(b) of the Spanish Telecommunications General Law. Consequently, after considering some aggravating circumstances [(i) the absence of intentionality but the existence of significant negligence, and (ii) the disclosure of basic personal data], the AEPD understood that, in case the sanction procedure resulted in a successful decision, this infringement would be fined with 5,000 € to the defendant. In this sense, the AEPD offered the defendant the possibility to settle the issue before the decision takes place by agreeing to a voluntary payment of part of the fine with two possible discounts: (i) early voluntary payment (4,000 €) and acknowledging of its liability (3,000 €). The defendant only agreed to the early voluntary payment but it did not acknowledge its liability, so it paid 4,000 € and the sanction procedure was closed by the AEPD.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Page 1 1/12937-240719 Procedure Nº: PS / 00475/2019RESOLUTION R / 00252/2020 OF TERMINATION OF THE PAYMENT PROCEDUREVOLUNTARYIn the sanctioning procedure PS / 00475/2019, instructed by the AgencySpanish Data Protection to DE VERE SPAIN, SL , given the complaintpresented by AAA , and based on the following,BACKGROUNDFIRST: On February 17, 2020, the Director of the Spanish Agency forData Protection agreed to initiate a sanctioning procedure against DE VERE SPAIN,SL (hereinafter, the claimed), through the Agreement that is transcribed:<<Procedure Nº: PS / 00475/2019PENALTY PROCEDURE STARTING AGREEMENTOf the actions carried out by the Spanish Agency for Data Protection andbased on the followingBACKGROUNDFIRST: On February 21, 2018, AAA (hereinafter, the claimant) exercised theright of cancellation against the entity DE VERE SPAIN SL , (hereinafter, theclaimed) without your request having received the legally established reply.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 2 12/12He exercised the right of cancellation by email and provides a copy of thecertification of the email sent through the eGarante company.SECOND: Successively transferred the claim and the writings of discharges thatproduced in the processing of this file, and so for the purposes of theresolution of the present claim interests, in summary, the following were madeallegations: The legal manager of the entity manifests in the allegations madeDuring the processing of this procedure, not having received “ any emailat the following address *** EMAIL. 1 by the claimant requesting thecancellation of your personal data ”.However, they proceed to check their files and confirm that the claimant did notYou are a client of your company and therefore do not have any information about yourperson in your records.Likewise, they proceed to inform the interested party of the aforementioned " byPostcard". After examining the allegations presented by the person responsible for the file,transfer of the same to the claimant who, in synthesis, declares to have receivedA registered letter informing you that they do not have your personal datain your files.The claimant reiterates that he did send an email by digital signatureand seal, through the company eGarante. Once again granted a hearing to the responsible entity, it is reiterated in itsallegations set forth above.THIRD: All the facts are fully known to the parties,allegations and other documentation provided by the interested parties for their defense,have been transferred by the instruction of the file to each of those interested inC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 3 12/3this procedure and recorded all this in the file that works in this AgencySpanish Data Protection, proceed to open the protection of lawTD / 00580/2018.FOURTH: On July 12, 2018 the Director of the Spanish Agency for the Protection ofData dictates resolution estimating the aforementioned protection of law and so theinterested on August 2, 2018, noting that the issuance of a newcertificate having been accredited during the procedure of the guardianship procedureof law TD / 00580/2018, that the requested right has already been met.ACTSFIRST: The claimant, on July 9, 2019, again filed a claimbefore the Spanish Agency for Data Protection against the claimed.The reasons on which this claim is based are that on July 8, 2019,14:27 hours you receive a commercial call from the person claimed from the linetelephone number that appears as a contact on the website of the person claimed ( *** URL.1 ):*** TELEPHONE. 1 (Branch of *** LOCATION . 1).Along with the claim, he provides a letter dated April 13, 18, where the person responsibleconfirms that you do not have any personal information about the claimant.Provides screenshot of Robinson List and the received call.SECOND: Transfer of this claim to the requested on 08/29/2019,so that it adopts the appropriate measures to solve the reported incident and remita report to this Agency in this regard.In this sense, on October 10, 2019, the respondent responds to the requirement of thisAgency stating that they have no commercial relationship with the claimant andprovide a certificate dated November 12, 2019 from the Administrator of the Company (NigelDudley Smith), to prove that they do not have any information about the claimant as alreadymanifested in TD / 00580/2018C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 4 4/12It considers that there is no evidence of the so-called object of this claim, sincethe screenshot of the call is not enough to prove that your company has madethe same and indicates that the name that appears in the proof of inscription in ListRobinson does not agree with that of the claimant.FUNDAMENTALS OF LAWIBy virtue of the powers that article 58.2 of the RGPD recognizes to each authorityof control, and as established in articles 47 and 48 of the LOPDGDD, the Director ofthe Spanish Data Protection Agency is competent to initiate and resolvethis procedure.IIGeneral Telecommunications Law 9/2014, of May 9 (hereinafter,LGT) deals with Title III, Chapter V, the " Rights of end users" andgrants, among others, the right to oppose unwanted calls for purposescommercial.Thus, article 48 of the LGT, under the heading "Right to data protectionpersonal and privacy in relation to unsolicited communications ", provides, inits section 1, the following:"one. Regarding the protection of personal data and privacy in relation tounsolicited communications end users of communications servicesElectronic companies will have the following rights:to)To not receive automatic calls without human intervention or messages fromfax, for commercial communication purposes without having given your consentprior and informed for it.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 5 12/5to)To object to receiving unwanted calls for communication purposesthat are carried out through systems other than those established in the lawprior and to be informed of this right. ” (The underline is from the AgencySpanish Data Protection)In this sense, it should be noted that the content and conditions for exerciseof the right of opposition is regulated in article 21 of the RGPD that establishes that:"one. The interested party will have the right to object at any time, for reasonsrelated to your particular situation, to which personal data that concerns you areobject of a treatment based on the provisions of article 6, paragraph 1, letters e) or f),including profiling based on these provisions. The responsibleof the treatment will stop treating the personal data, unless it proves legitimate reasonsimperative for the treatment that prevails over the interests, rights and libertiesbertades of the interested party, or for the formulation, exercise or defense of claims.2. When the processing of personal data is for the purpose of marketingdirectly, the interested party will have the right to object at all times to the treatment ofpersonal data concerning you, including profiling to the extentthat is related to the aforementioned marketing.3. When the interested party objects to the treatment for marketing purposes di-straight, personal data will no longer be processed for such purposes.4. At the latest at the time of the first communication with the interested party, theright indicated in sections 1 and 2 will be explicitly mentioned to the interested party andIt will be presented clearly and apart from any other information.5. In the context of the use of information society services, andnotwithstanding the provisions of Directive 2002/58 / EC, the interested party may exercise their rightcho to oppose by automated means that apply technical specifications.6. When personal data is processed for scientific or historical research purposesFor statistical purposes or purposes in accordance with article 89, paragraph 1, the interested party hasC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 6 6/12You will have the right, for reasons related to your particular situation, to oppose the treatmentof personal data that concerns you, unless necessary for complianceof a mission carried out for reasons of public interest. ”IIIIn accordance with the evidence available at the present timeagree to initiate the sanctioning procedure, and without prejudice to what results from theinstruction, the respondent is considered to have contravened article 48.1 b) of the LGT inrelationship with article 21 of the RGPD, indicated in the Law Foundation III, since thecomplainant, on July 8, 2019 at 2:27 p.m. received a business callon your personal mobile phone from the person claimed from the telephone line thatappears as a contact on the website of the requested party ( *** URL.1 ) *** PHONE.1(Branch of *** LOCALIDAD.1 ) despite having exercised the claimant's right tocancellation against the claimed, and having been confirmed that it was attendedduring the processing of TD / 00580/2018, which dates from July 12, 2018.IVArticle 72.1.a) of the LOPDGDD states that “ depending on what theArticle 83.5 of Regulation (EU) 2016/679 are considered very serious and will prescribethree years infringements involving a substantial violation of articlesmentioned in that and, in particular, the following:(…)k) The impediment or the obstruction or the non-repeated attention of the exercise ofthe rights established in articles 15 to 22 of Regulation (EU) 2016/679. ”VArticle 58.2 of the RGPD provides the following: “Each supervisory authorityYou will have all the following corrective powers indicated below:C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 7 12/7b) sanction any person responsible or responsible for the treatment with warningwhen the processing operations have violated the provisions of thisRegulation;d) order the data controller or processor that the operations oftreatment comply with the provisions of this Regulation, where appropriate, ofin a certain way and within a specified time frame;i) impose an administrative fine pursuant to article 83, in addition to or instead ofthe measures mentioned in this section, according to the circumstances of each caseparticular;SAWThis infraction can be sanctioned with a fine of a maximum of € 20,000,000 or,In the case of a company, an amount equivalent to a maximum of 4% of the volumetotal global annual business for the previous financial year, opting for the highestamount, in accordance with article 83.5 of the RGPD.Likewise, it is considered that the sanction to be imposed should be graduated in accordance withthe following criteria established by article 83.2 of the RGPD:As aggravating the following:We are facing unintentional, but significant negligent action(article 83.2 b)Basic personal identifiers (name,surname, address, telephone), according to article 83.2 g)Therefore, according to what was stated,By the Director of the Spanish Agency for Data Protection,C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 8 12/8HE REMEMBERS:FIRST: INITIATE SANCTIONING PROCEDURE at DE VERE SPAIN, SL , withNIF B92881598 , in accordance with the provisions of articles 58 and 64 of Law 39/2015,of October 1, of the Common Administrative Procedure of the AdministrationsPublic (hereinafter LPACAP), for the alleged violation of article 48.1.b) of theLGT, in relation to article 21 of the RGPD, typified as very serious in article83.5 b) of the RGPD.SECOND: NAME BBB and, as secretary, CCC. , indicating thatany of them may be challenged, if applicable, in accordance with the provisions of theArticles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime of the SectorPublic (LRJSP).FOURTH: INCORPORATE into the sanctioning file, for evidentiary purposes, the claimfiled by the claimant and its documentation, the documents obtained and generatedby the General Sub-Directorate for Data Inspection during the investigation phase, as wellsuch as the report of previous Inspection actions.FIFTH: THAT for the purposes provided in art. 64.2 b) of law 39/2015, of October 1,of the Common Administrative Procedure of Public Administrations, the sanction thatcould correspond would be € 5,000 (five thousand euros) without prejudice to what results from theinstruction.SIXTH: NOTIFY this agreement to DE VERE SPAIN, SL , with NIF B92881598 ,granting him a hearing period of ten business days to formulate the allegations andpresent the evidence you consider appropriate. In your brief of allegations you mustprovide your NIF and the procedure number that appears in the heading of thisdocument.If, within the stipulated period, no allegations are made to this initial agreement, theit may be considered a resolution proposal, as established in the article64.2.f) of Law 39/2015, of October 1, of the Common Administrative Procedure of thePublic Administrations (hereinafter, LPACAP).C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 9 12/9In accordance with the provisions of article 85 of the LPACAP, in the case offine, you can acknowledge your responsibility within the period granted for the formulationof allegations to this initial agreement; which will entail a reduction of one20% of the sanction to be imposed in this procedure. With the appof this reduction, the sanction would be established at four thousand euros (€ 4000),resolving the procedure with the imposition of this sanction.In the same way, you may, at any time prior to the resolution of thisprocedure, carry out the voluntary payment of the proposed sanction, which willreduction of 20% of its amount. With the application of this reduction, the sanctionit would be established at four thousand euros (€ 4000), and its payment will imply the termination of theprocess.The reduction for the voluntary payment of the sanction is cumulative to the oneIt is appropriate to apply for the recognition of responsibility, provided that thisacknowledgment of responsibility is revealed within the period grantedto make allegations to the opening of the procedure. The voluntary payment of theamount referred to in the preceding paragraph may be made at any time prior to theresolution. In this case, if it were appropriate to apply both reductions, the amount of the penaltyit would be established at three thousand two hundred euros (€ 3,000).In any case, the effectiveness of any of the two mentioned reductionsit will be conditioned to the withdrawal or resignation of any action or resource in processadministrative against the sanction.In the event that you choose to proceed to the voluntary payment of any of theamounts previously indicated four thousand euros (€ 4,000), or three thousand euros (€ 3,000),You must make it effective by entering the account number ES00 0000 0000 0000 00000000 opened in the name of the Spanish Agency for Data Protection in the BankCAIXABANK, SA, indicating in the concept the reference number of the procedurethat appears in the heading of this document and the cause of reduction of the amount tothe one that welcomes.Likewise, you must send the proof of income to the General Subdirectorate ofInspection to continue the procedure in accordance with the quantityentered.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 10 12/10The procedure will have a maximum duration of nine months from thedate of the initiation agreement or, if applicable, the draft initiation agreement. Elapsedthis period will expire and, consequently, the filing of proceedings; ofin accordance with the provisions of article 64 of the LOPDGDD.Finally, it is pointed out that in accordance with the provisions of article 112.1 of theLPACAP, there is no administrative appeal against this act. Mar España Martí Director of the Spanish Agency for Data Protection >>SECOND: On February 22, 2020, the requested party has paid thesanction in the amount of 4000 euros using one of the two reductionsprovided for in the Start Agreement transcribed above. Therefore, there is noaccredited acknowledgment of responsibility.THIRD : The payment made entails the waiver of any action or remedy in progressadministrative against the sanction, in relation to the facts referred to in theHome Agreement.FUNDAMENTALS OF LAWIBy virtue of the powers that article 58.2 of the RGPD recognizes to each authority ofcontrol, and as established in art. 47 of Organic Law 3/2018, of 5 ofDecember, on Personal Data Protection and guarantee of digital rights (inhereinafter LOPDGDD), the Director of the Spanish Agency for Data Protectionis competent to sanction the infractions that are committed against saidRegulation; infractions of article 48 of Law 9/2014, of May 9, GeneralTelecommunications (hereinafter LGT), in accordance with the provisions of thearticle 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and38.4 d), g) and h) of Law 34/2002, of July 11, on services of the society of theinformation and electronic commerce (hereinafter LSSI), as provided in the article43.1 of said Law.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 11 12/11IIArticle 85 of Law 39/2015, of October 1, of the Administrative ProcedureCommon of Public Administrations (hereinafter LPACAP), under the heading" Termination in sanctioning procedures " provides the following:"one. Initiated a sanctioning procedure, if the offender acknowledges hisresponsibility, the procedure may be resolved with the imposition of the sanctionthat proceed.2. When the sanction is solely pecuniary or fitsimpose a pecuniary and a non-pecuniary sanction but it has been justifiedthe inadmissibility of the second, the voluntary payment by the alleged responsible, inany time prior to the resolution, will imply the termination of the procedure,except with regard to the replacement of the altered situation or the determination of thecompensation for the damages caused by the commission of the offense.3. In both cases, when the sanction is solely pecuniary in nature,the competent body to resolve the procedure will apply reductions of, toless, 20% on the amount of the proposed sanction, these being cumulativeeach. The aforementioned reductions must be determined in the notification ofinitiation of the procedure and its effectiveness will be conditioned to the withdrawal orwaiver of any administrative action or recourse against the sanction.The reduction percentage provided in this section may be increasedby regulation. ”According to what was stated,the Director of the Spanish Agency for Data Protection RESOLVES:FIRST: DECLARE the termination of the procedure PS / 00475/2019 , ofin accordance with the provisions of article 85 of the LPACAP.SECOND: NOTIFY this resolution to DE VERE SPAIN, SL .In accordance with the provisions of article 50 of the LOPDGDD, theThis Resolution will be made public once the interested parties have been notified.Against this resolution, which ends the administrative procedure as prescribed bythe art. 114.1.c) of Law 39/2015, of October 1, of the Administrative ProcedureCommon of Public Administrations, interested parties may file an appealadministrative litigation before the Contentious-administrative Chamber of theNational Court, in accordance with the provisions of article 25 and section 5 ofthe fourth additional provision of Law 29/1998, of July 13, regulating theContentious-Administrative Jurisdiction, within a period of two months fromday after notification of this act, as provided in article 46.1 of thereferred Law.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es Page 12 12/12 Mar España Martí Director of the Spanish Agency for Data Protection
