AEPD - PS/00502/2020
|AEPD - PS/00502/2020|
|Relevant Law:||Article 21 GDPR|
Article 48(1)(b) LGT
Article 23(4) LOPDGDD
|Parties:||Avilon Center 2016, SL|
|National Case Number/Name:||PS/00502/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish DPA (AEPD) imposed a fine on Avilon Center SL for making a commercial call to a individual registered on the Robinson List in breach of Article 48(1)(b) LGT and Article 21 GDPR in conjunction with Article 23(4) LOPDGDD. Avilon Center SL made an voluntary, early and guilty payment of €12,000.
English Summary[edit | edit source]
Facts[edit | edit source]
The complainant filed a complaint against Avilon Center 2016 SL. The complainant received commercial calls from Avilon Center on their private number, despite being listed on the Robinson List (opt-out list of people who do not wish to receive marketing transmissions).
The Spanish DPA (AEPD) investigated these facts. In its investigation, it found that the telephone number which called the claimant was operated by Sewan Comunicaciones SL.
The AEPD also asked Avilon Center about where they go the claimant's telephone number, the object of the call, the legitimacy of the call, and information provided to the claimant about the origin of the claimant's personal data . Avilon Center responded that information on the origin of the data could not be provided to the data subject during the call as the data subject interrupted the call by stating that they were registered on the Robinson List and hung up. Avilon also mentioned that it is registered in Adigital as a provider of services that has access to the Robinson List and that on the data of the call, there was a software error that blocked the table with the persons included on the Robinson List. This error was solved after 30 minutes, but Avilon Cneter has already made the call to the claimant during that time.
Dispute[edit | edit source]
Does making a commercial call to a data subject registered on the Robinson List violate Article 48(1)(b) LGT and Article 21 GDPR in conjunction with Article 23(4) LOPDGDD?
Holding[edit | edit source]
The Spanish DPA (AEPD) held that the facts of the case point to the fact that Avilon Center breached Article 48(1)(b) of the Spanish Law on Telecommunications (LGT) as well as Article 21 GDPR in conjunction with Article 23(4) of the Spanish Law on Protection of Personal Data and guarantee of digital rights (LOPDGDD).
The defendant argued that the reason why a call was made to the claimant despite them being on the Robinson List was because Adigital had a software error so the Robinson List was no accessible to be checked by Avilon Center prior to making the call. However, the AEPD stated that an analysis of the risk prior to processing any person data should be performed. Additionally, necessary controls must be put in place to avoid making calls when such system errors occur.
The AEPD stated that strict liability does not apply in the present case, but that the defendant lacked due diligence in the technical and organisational measures that they applied to the processing of personal data linked to telephone lines. As this lead to a violation of the claimant's rights (notably: right to object by registering themselves on the Robinson List), the AEPD concluded that Avilon Center was responsible for the processing of personal data.
The Spanish DPA therefore imposed a fine of €20,000 on Avilon Center. In accordance to Spanish Administrative Law, this fine was reduced to €12,000 as Avilon Center made a voluntary, early and guilty payment of the fine.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/10 Procedure No.: PS / 00502/2020 RESOLUTION R / 00134/2021 OF TERMINATION OF THE PROCEDURE FOR PAYMENT VOLUNTARY In the sanctioning procedure PS / 00502/2020, instructed by the Spanish Agency for Protection of Data to AVILON CENTER 2016, S.L., considering the complaint presented by A.A.A., and based on the following, BACKGROUND FIRST: On January 25, 2021, the Director of the Spanish Agency for Data Protection agreed to initiate disciplinary proceedings against AVILON CENTER 2016, S.L. (hereinafter, the claimed), through the Agreement that is transcribed: << Procedure Nº: PS / 00502/2020 AGREEMENT TO INITIATE THE SANCTIONING PROCEDURE Of the actions carried out by the Spanish Agency for Data Protection and in based on the following: ACTS FIRST: D. A.A.A. (hereinafter, the claimant) dated August 23, 2019 filed a claim with the Spanish Agency for Data Protection. The The claim is directed against AVILON CENTER 2016 S.L. with NIF B05254859 (in forward, the claimed). The reasons on which you base the claim are that you receive commercial calls from claimed on your mobile phone *** PHONE. 1 that is inscribed on the Robinson list since last September 24, 2018, and that the last call was received on last August 21, 2019 at 7:08 p.m. from the calling line *** PHONE. 2. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/10 Documentation provided by the claimant: - Certificate of ADIGITAL of the inscription in the Robinson list of the telephone in which they receive the calls. SECOND: In view of the facts reported in the claim and the documents provided by the claimant and the facts and documents of which he has this Agency, the Subdirectorate General for Data Inspection proceeded to carry out preliminary investigation actions for the clarification of the facts in question, by virtue of the powers of investigation granted to the control authorities in article 57.1 of the Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD), and in accordance with the provisions of Title VII, Chapter I, Second Section, of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). As a result of the investigative actions carried out, it is verified that the responsible for the treatment is the one claimed. Likewise, the following points are found: Transfer the claim to ORANGE, owner of the Jazztel trademark, with date of October 23, 2019 is received at this Agency, with registration number 050582/2019, brief of allegations sent by this entity stating, between other aspects, which have been able to verify that the numbering *** TELEPHONE. 2 from the one that indicates having received advertising calls does not belong to that company, nor It is associated with any ORANGE distribution channel. They communicate to claimant using burofax this end. They add indicating that this number of phone is operated by Sewan Comunicaciones S.L. (hereinafter SEWAN) Information requested on the owner of the telephone number from which the call indicated in the claim to SEWAN, operator of this number, with date of June 11, 2020 is received at this Agency, with registration number 019517/2020, answering letter indicating that the holder of this number is the reclaimed. Information requested from AVILON on the origin of the claimant's telephone number, the object of this call, legitimacy to receive this type of calls, and the information provided to the claimant about the origin of their personal data, dated 16 de July 2020 is received at this Agency, with registration numbers 021697/2020 and 025226/2020, written response stating the following aspects: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/10 - Regarding the information provided by this entity to the claimant about the origin of their data, declare that after initiating the agent who called on behalf of Jazztel, the claimant interrupted him stating that he was registered on the Robinson list and that would make a claim. He then interrupted the communication, which is why the agent was unable to provide further information to the claimant. - AVILON adds that it is registered in ADIGITAL as a provider of services so you have access to the Robinson list whose data is updated in their systems monthly. However, on the aforementioned date, it indicates that produced an error in the software used, momentarily blocking the table in which all the numbers included in the Robinson File are registered. This incident was solved in 30 minutes, this call was produced in the table lock period. FOUNDATIONS OF LAW I In accordance with the provisions of article 84.3) of Law 9/2014, of 9 May, General of Telecommunications (LGT), the competition to resolve the This Penalty Procedure corresponds to the Director of the Agency Spanish Data Protection. II In the present case, it has been proven that the claimant is included in the Robinson List. In accordance with the evidence available at the present time of agreement to initiate the sanctioning procedure, and without prejudice to what results from the instruction, it is considered that the defendant has contravened article 48.1 b) of the LGT, in relation to article 21 of the RGPD, and article 23.4 of the LOPDGDD, already that the claimant received on August 21, 2019 at 7:08 p.m. from C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/10 the calling line *** PHONE. 2. business call on your personal mobile phone from one of the claimed telesales collaborators, such as recognizes the claimed in his statements to this Agency on July 16 last, "in the referred date, indicates that there was an error in the software used, leaving the table in which all numbers are registered is momentarily locked included in the Robinson File. This incident was resolved in 30 minutes, this call taking place in the table lock period ”. In the present case, the defendant argues that the call to the claimant for marketing purposes, when the line was included previously in Adigital's Robinson Listing, was caused by an error in the software used when the pre-check was momentarily inoperative with the Robinson Listing. However, this deficiency should have been taken into account in the analysis of risks prior to any processing of personal data and having incorporated the controls necessary to avoid that in the event of a system error such as the one now analyzed calls are prevented while the incident lasts. Although strict liability is not applicable to the case, if it is true that there was a lack of due diligence on the part of the respondent in the organization and technical means applied to the processing of personal data linked to the receiving telephone lines that have caused the commission of the offense now charged when the rights of the affected party were violated, even when he had previously expressed their right to object by incorporating their line into the Róbinson advertising exclusion. Consequently, the claimed entity is responsible for the treatment. The facts presented (the violation of the right to object) could suppose the commission by the claimed party of an infraction of article 48.1.b) of the LGT Law, contained in its Title III, which states that: “Regarding the protection of personal data and privacy in relation to subscriber directories, users end of electronic communications services will have the following rights: (…) b) To oppose receiving unwanted calls for the purposes of commercial communication carried out through systems other than those established in the previous letter and to be informed of this right ”, Although the aforementioned article does not configure such a right, so we must go to the data protection regulations in which the right of opposition is regulated: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/10 Article 21 of the RGPD, (Regulation (EU) 2016/679, of the European Parliament and of the Council, of 04/27/2016, regarding the Protection of Individuals in what Regarding the Processing of Personal Data and the Free Circulation of this Data) and Article 23 of the LOPDGDD (Organic Law 3/2018, of December 5, on Protection of Personal Data and Guarantee of Digital Rights). This offense is classified as "minor", in article 78.11) of said norm, which considers as such: “The breach of the obligations of public service, public obligations and violation of the rights of consumers and end users as established in Title III of the Law and its implementing regulations ”, which may be sanctioned with a fine of up to € 50,000, in accordance with article 79.1.d) of the aforementioned LGT. III In accordance with the indicated precepts, and without prejudice to what results from the instruction of the procedure, in order to fix the amount of the sanction to be imposed in In the present case, it is considered that the sanction to be imposed should be adjusted according to with the following criteria established in article 80.1) and 2) of the LGT: - The consideration of the economic situation of the offender, (point 2). After the evidence obtained in the preliminary investigation phase, it is considered that the penalty to be imposed should be graduated in the amount of € 20,000 (twenty thousand euros). Therefore, based on the foregoing, By the Director of the Spanish Agency for Data Protection, C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/10 HE REMEMBERS: FIRST: INITIATE SANCTIONING PROCEDURE for AVILON CENTER 2016 S.L. with NIF B05254859, for the alleged violation of article 48.1.b) of the LGT Law classified as “mild” in article 78.11) of the aforementioned LGT Law in relation to article 21 of the RGPD, and article 23.4 of the LOPDGDD. SECOND: APPOINT D. R.R.R. as instructor. and, as secretary, Ms. S.S.S., indicating that any of them may be challenged, if applicable, in accordance with the established in articles 23 and 24 of Law 40/2015, of October 1, on the Regime Public Sector Legal (LRJSP). THIRD: INCORPORATE to the sanctioning file, for evidentiary purposes, the claim filed by the claimant and his documentation, the documents obtained and generated, which are part of the file. FOURTH: THAT for the purposes provided for in art. 64.2 b) of Law 39/2015, of 1 October, of the Common Administrative Procedure of Public Administrations, the The corresponding penalty would be € 20,000 (twenty thousand euros), without prejudice to what results from the instruction. FIFTH: NOTIFY this agreement to AVILON CENTER 2016 S.L. with NIF B05254859, granting a hearing period of ten business days to formulate the allegations and present the evidence that it deems appropriate. In his writing of allegations, you must provide your NIF and the procedure number that appears in the heading of this document. If, within the stipulated period, no allegations are made to this initiation agreement, the It may be considered a resolution proposal, as established in the Article 64.2.f) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations (hereinafter, LPACAP). In accordance with the provisions of article 85 of the LPACAP, in the event of that the sanction to impose was a fine, you may recognize your responsibility within C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/10 of the term granted for the formulation of allegations to this initiation agreement; it which will entail a reduction of 20% of the sanction to be imposed in this procedure. With the application of this reduction, the sanction would be established at € 16,000 (sixteen thousand euros), resolving the procedure with the imposition of this sanction. In the same way, you may, at any time prior to the resolution of the present procedure, carry out the voluntary payment of the proposed sanction, which will mean a reduction of 20% of its amount. With the application of this reduction, the penalty would be established € 16,000 (sixteen thousand euros), and its payment will imply the termination of the procedure. The reduction for the voluntary payment of the penalty is cumulative to that corresponds to apply for the recognition of responsibility, provided that this acknowledgment of responsibility is revealed within the term granted to formulate allegations at the opening of the procedure. The pay Voluntary amount of the amount referred to in the previous paragraph may be done at any time before resolution. In this case, if applicable, apply both reductions, the amount of the penalty would be set at € 12,000 (twelve thousand euros). In any case, the effectiveness of either of the two mentioned reductions It will be conditioned to the withdrawal or resignation of any action or remedy in progress. administrative against the sanction. In the event that you choose to proceed to the voluntary payment of any of the amounts indicated above (16,000 or 12,000 euros), you must make it effective by entering the account number ES00 0000 0000 0000 0000 0000 open to name of the Spanish Data Protection Agency in Banco CAIXABANK, S.A., indicating in the concept the reference number of the procedure that appears in the heading of this document and the cause of reduction of the amount to which welcomes. Likewise, you must send proof of admission to the Subdirectorate General of Inspection to continue the procedure according to the quantity entered. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 8/10 The procedure will have a maximum duration of nine months from the date of the initiation agreement or, where appropriate, the draft initiation agreement. After this period, its expiration will occur and, consequently, the file of performances; in accordance with the provisions of article 64 of the LOPDGDD. Finally, it is pointed out that in accordance with the provisions of article 112.1 of the LPACAP, against this act there is no administrative appeal. Mar Spain Martí Director of the Spanish Agency for Data Protection >> SECOND: On February 17, 2021, the defendant has proceeded to pay the sanction in the amount of 12,000 euros making use of the two planned reductions in the Initiation Agreement transcribed above, which implies the recognition of the responsibility. THIRD: The payment made, within the period granted to formulate allegations to the opening of the procedure, entails the waiver of any action or appeal in the process administrative against the sanction and the recognition of responsibility in relation to the facts to which the Initiation Agreement refers. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and as established in art. 47 of Organic Law 3/2018, of 5 December, Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection is competent to sanction the infractions that are committed against said Regulation; infractions of article 48 of Law 9/2014, of May 9, General of Telecommunications (hereinafter LGT), in accordance with the provisions of the article 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 9/10 38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of the information and electronic commerce (hereinafter LSSI), as provided in article 43.1 of said Law. II Article 85 of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations (hereinafter, LPACAP), under the rubric "Termination of sanctioning procedures" provides the following: "1. Initiated a sanctioning procedure, if the offender acknowledges his responsibility, the procedure may be resolved with the imposition of the appropriate sanction. 2. When the sanction is solely of a pecuniary nature or it is possible to impose a pecuniary sanction and other non-pecuniary sanction, but the inadmissibility of the second, the voluntary payment by the presumed responsible, in any time prior to the resolution, will imply the termination of the procedure, except in relation to the replacement of the altered situation or the determination of the compensation for damages caused by the commission of the offense. 3. In both cases, when the sanction is solely of a pecuniary nature, the competent body to resolve the procedure will apply reductions of, at least, 20% of the amount of the proposed penalty, these being cumulative among themselves. The aforementioned reductions must be determined in the notice of initiation of the procedure and its effectiveness will be conditioned to the withdrawal or resignation of any action or appeal in administrative proceedings against the sanction. The percentage of reduction foreseen in this section may be increased regulations. In accordance with the above, the Director of the Spanish Agency for the Protection of Data RESOLVES: FIRST: DECLARE the termination of procedure PS / 00502/2020, of in accordance with the provisions of article 85 of the LPACAP. SECOND: NOTIFY this resolution to AVILON CENTER 2016, S.L .. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure as prescribed by the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations, interested parties may file an appeal administrative litigation before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following notification of this act, as provided in article 46.1 of the referred Law. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 10/10 936-031219 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es