TS - 815/2020
From GDPRhub
| TS - 815/2020 | |
|---|---|
 | |
| Court: | TS (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | 6(1) of the Spanish Organic Law on Data Protection (national former law previous to GDPR, not applicable anymore) |
| Decided: | 18.06.2020 |
| Published: | 18.06.2020 |
| Parties: | Miraclia Telecomunicaciones, S.L. |
| National Case Number/Name: | 815/2020 |
| European Case Law Identifier: | ES:TS:2020:1771 |
| Appeal from: | AEPD (Spain) ECLI: ES:AN:2018:4709 |
| Appeal to: | Not appealed |
| Original Language(s): | Spanish Spanish |
| Original Source: | Spanish judiciary power website (in Spanish) Spanish judiciary documentation website (in Spanish) |
| Initial Contributor: | Miguel Garrido de Vega |
The Spanish Supreme Court (TS) confirmed a fine of 7,500 € imposed on the company Miraclia Telecomunicaciones S.L. (the defendant), as owner of the "on-demand-telephone-jokes" app Juasapp, for the breach of Article 6(1) of the Spanish Organic Law 15/1999 on Data Protection (LOPD, former national law previous to the application of the GDPR, not applicable anymore) in relation to four jokes made between April and May 2016.
English Summary
Facts
This sentence is the result of a cassation appeal submitted by the defendant against another sentence of the Spanish TS (ECLI: ES:AN:2018:4709, dated November 29, 2018) which, in turn, is the result of an administrative appeal submitted by the defendant against a decision of the Spanish Data Protection Agency (AEPD) dated November 3rd, 2017 imposing a fine of 7,500 € on the defendant due to the breach of Article 6(1) of the LOPD (the decision in Spanish can be downloaded here).
Dispute
In order to use the Juasapp app, it was necessary that a natural person entered the telephone number of another natural person in the app; then this last one received a pre-recorded voice call with different kind of jokes (some of then even referring to possible events happened to his/her family); the only data protection information the affected by such jokes received was at the end of the joke, when the voice message specified that "his/her telephone had been provided by a friend or acquaintance" of him/her and that, "unless he/she communicates his/her opposition, his/her personal data will be processed by the defendant". The AEPD received different complaints from natural persons affected by such jokes, and clearly understood that the defendant had not obtained the consent to process personal data belonging to such people. In the cassation appeal submitted before the Spanish TS, the defendant considered that: (i) its commercial activity only provides leisure services to natural persons under their domestic or personal activity; (ii) the data processed by the defendant cannot be considered as personal, so the data protection obligations would not be applicable, and (iii) even if this activity is considered under the data protection obligations, the legal basis for its processing would be the legitimate interest of the defendant.
Holding
The Spanish TS understood that: (i) the data processing activity carried out by a company in the framework of its commercial activity cannot be excluded from its data protection obligations on the basis of being considered an exclusively personal or domestic activity, even if the service provided by the company consists of providing a relationship between natural persons; (ii) the recording of the human voice, associated with other data such as the telephone number, must be considered personal data, and the fact of making it available to third parties who can identify who such voice belongs to, must be clearly considered an automated personal data processing activity; and (iii) the commercial interests of a data controller must yield to the legitimate data protection interests of the owner of such personal data. With basis on these understandings, the Spanish TS decides to dismiss the cassation appeal, and, consequently, the defendant must pay the 7,500 € fine imposed by the AEPD in November 3rd, 2017.
Comment
The following consideration contained in the sentence is particularly relevant:
- There is no possibility to understand that the natural persons affected by a recorded-voice-message-joke are giving a valid consent to their personal data processing activity: they would be only accepting such processing in a passive way (this is: not objecting to the same) after receiving a surprising voice message containing a joke.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Roj: STS 1771/2020 - ECLI: ES: TS: 2020: 1771Cendoj Id: 28079130032020100143Body: Supreme Court. Contentious ChamberHeadquarters: MadridSection: 3Date: 06/18/2020Resource Number: 1074/2019Resolution No.: 815/2020Procedure: AppealSpeaker: EDUARDO ESPIN TEMPLADOResolution Type: JudgmentSUPREME COURTContentious-Administrative ChamberThird SectionJudgment no. 815/2020Sentence date: 06/18/2020Type of procedure: R. CASACIONProcedure number: 1074/2019Judgment / Agreement:View Date: 06/09/2020Speaker: Excmo. Mr. D. Eduardo Espín TempladoOrigin: NATIONAL AUDIT ROOM C / A. SECTION 1Lawyer for the Administration of Justice: Ilmo. Mr. D. Luis Martín ContrerasTranscribed by: PJMNote:R. CASACIÓN no .: 1074/2019Speaker: Excmo. Mr. D. Eduardo Espín TempladoLawyer for the Administration of Justice: Ilmo. Mr. D. Luis Martín ContrerasSUPREME COURTContentious-Administrative ChamberThird SectionJudgment no. 815/2020Excmo. Messrs. And Excma. Mrs.Mr. Eduardo Espín Templado, PresidentMr. José Manuel Bandrés Sánchez-CruzatMr. Eduardo Calvo RojasDª. María Isabel Perelló DoménechMr. José María del Riego Valledorone Page 2 JURISPRUDENCEMr. Diego Córdoba CastroverdeMr. Ángel Ramón Arozamena LasoIn Madrid, June 18, 2020.This Chamber has seen, constituted in its Third Section by the magistrates indicated in the margin, the appealnumber 1074/2019, filed by DIRECTION001., represented by the attorney Maríadel Carmen Ortiz Cornago and under the legal direction of Ms. María Paz Martín Álvarez, against the sentencedictated by the First Section of the Contentious-Administrative Chamber of the National Court on the dateNovember 29, 2018 in contentious-administrative appeal number 554/2017. The appealed party is theGeneral State Administration, represented and defended by the State Attorney.The Excmo. Mr. Eduardo Espín Templado.FACTUAL BACKGROUNDFIRST .- In the contentious-administrative process referred to above, the Contentious-Administrative Chamber(First Section) of the National Court issued judgment dated November 29, 2018, dismissalof the resource promoted by DIRECCION001. against the resolution of the Director of the Spanish Agency ofData Protection dated July 11, 2017, by which the applicant was fined 7,500euros for infractions of article 6.1 of Organic Law 15/1999, of December 13, on Data Protectionof a Personal Nature.SECOND .- Once the judgment has been notified to the parties, the plaintiff submitted a brief preparing an appealCassation against the same, considering that said appeal was prepared by order of the Trial Chamber dated 8February 2019, at the same time that it ordered to refer the proceedings to the Supreme Court, prior noticeof the litigants.THIRD .- After receiving the proceedings and having filed the parts listed in theheading of this resolution, order of May 31, 2019 has been issued, admitting the appealappeal, appreciating that the question raised in the appeal that presents objective appealconsists in:«Interpret current personal data protection regulations in order to define:(i) What should be considered as an exclusively personal or domestic data treatment toeffects of its exclusion from the scope of protection provided by the LOPD in accordance with the provisions of article2 LOPD -current article 2.2.a) LO 3/2018 that refers to article 2.2 of the General Regulation (EU) -.(ii) In what circumstances (or to what extent) a person's voice can be considered as a data ofpersonal nature, in accordance with article 3 LOPD in relation to article 5 RLOPD -currently article 4.1of the General Regulation (EU) -.(iii) In what terms should the weighting provided for in Article 7.f) of Directive 95/46 / EC be carried out -current article 6.1.f) of the General Regulation (EU) - between the legitimate interest of the data controllerthe data and protection of the personal data of the interested party. "FOURTH.- Subsequently, a period has been granted to the appellant to file the appeal,developing in the corresponding writing the following reasons:1st violation of article 2.2 of Organic Law 15/1999 on the Protection of Personal Data and of theits interpretation by the National Court itself and the Court of Justice of the European Union;2nd violation of article 3 of the Organic Law on Protection of Personal Data in relation to theArticle 5 of Royal Decree 1720/2007 of December 21, development of the Organic Law for the Protection ofPersonal Data about what should be considered as personal data, and3rd violation of Article 7.f) of Directive 95/46 / EC.It seeks to annul the judgment under appeal in response to:«(1) That the activity carried out by DIRECCION001 is limited to providing a means of leisure forindividuals in the personal or domestic sphere.(2) That the data required and processed by DIRECCION001 and in particular the voice, do not allow in any caseidentify the interested parties who are the object of the joke and therefore we would not be in the legal concept of "datapersonal "which would exclude the application of data protection regulations.two Page 3 JURISPRUDENCE(3) If it is considered that personal data exists, that the fact of treating data in the context of the servicethe user of a means to play pranks, the legal basis of the treatment is justified by the interestlegitimacy of the person in charge DIRECTION 001 after a weighing test in relation to the rights of thesheltered and with the guarantees of opposition and suppression provided by the medium itself. "Lastly, it pleads that a sentence be passed whereby, by marrying and annulling the respondent,the resource.FIFTH .- Subsequently, the communication of interposition of the appeal has been transferred to the partyappealed, the State Attorney having submitted the corresponding brief in which she requests thatthe appeal is dismissed and the contested judgment is confirmed, in accordance with the interpretation thatadvocates in the same writing of the precepts identified in the order for admission of the appealcassation.SIXTH.- By order dated February 14, 2020, April 28, 2020 has been designated at 9:30 a.m.hours for the joint public hearing with the appeals 1745/2019 and 2134/2019.SEVENTH.- On May 12, 2020, an order was issued, annulling the agreed hearing,due to the COVID-19 health emergency, leaving the matter for deliberation and ruling.The appellant has appealed this decision in reinstatement, resolving said appeal after the correspondingtransfer to the opposite party by order of June 8, 2020, which dismisses it.EIGHTH .- The present matter was deliberated on June 9, 2020.FUNDAMENTALS OF LAWFIRST .- Purpose and approach of the resource.The mercantile company DIRECCION001., Challenges in this appeal the sentence passed on 29November 2018 by the Contentious-Administrative Chamber (First Section) of the National Courtregarding data protection. The contested judgment dismisses the administrative contentious appealthat the aforementioned company had filed against the resolution of July 11, 2017 of the Spanish Agencyof Data Protection (AEPD) that imposed a fine of 7,500 euros for various serious breachesconsisting of processing personal data without consent.The appeal was admitted by order of this Chamber of May 31, 2019, in which it is considered of interestCassational determine (a) the scope of personal and domestic data for the purposes of their exclusionof the application of the Organic Law on Protection of Personal Data (Organic Law 15/1999, of 13from December); (b) under what circumstances can the voice be considered a personal data; and (c) in whatterms the balance must be made between the legitimate interest of the data controller andthe protection of the data of the interested party.The appellant entity formulates in its appeal three reasons: a) the activity for which it has beensanctioned was an activity carried out in the personal or domestic sphere; b) the voice cannot be consideredin the present case, a personal data; and c) in the present case, the legitimate interest ofADDRESS001 on the protection of the data of the affected. She requests the cassation of the appealed sentence and.the nullity of the sanctioning resolution adopted by the Spanish Agency for Data Protection.SECOND .- The facts declared proved by the Instance Judgment.The appealed judgment welcomes the proven facts outlined by the administrative resolution in the followingterms:" SECOND.- The sanctioned resolution appealed is based on a detailed account of proven facts, of thewhich include the following:1.- Ms. Inés denounced on April 13, 2016 before the AEPD (PS / 00559/2016), that on October 22,2015 received a call on his phone by unknown person regarding a joke regarding his6-year-old son and an incident in the dining room of his school, made through the Juassapp app, whose headlinesthe company DIRECCION001. He indicated that when he saw that the man was not responding, he hung up and thought that a manUnknown, he had taken his son and filed a complaint with the Civil Guard of DIRECCION000 on 2 and 10November 2016, before the Secretary of State for Telecommunications and for the Information SocietyMarch 7, 2016, etc. Provided an email from DIRECCION001 dated November 11, 2015in which he was informed of the telephone number to which the joke was associated and that the number was blockedreceiver to receive more jokes, being stored encrypted in their systems.3 Page 4 JURISPRUDENCEADDRESS001 registered Rebeca's phone number to make the call in question and her voice,proceeding to record it when performing a multimedia content hosting service, for access throughGSM mobile devices, through the Juasapp APP, an application that allows a third party to sendpranks consisting of a pre-recorded audio file over the phone, to the destination number selected bysaid user, with the joke of content already detailed, called "Your son has bitten at school."2 D. Dionisio reported on July 29, 2016 to the AEPD (PS / 00560/2016), that he received a callon July 27, being the victim of a joke, specifically being accused of a thief, because "he was stealing thelight to Endesa ". Prank made through the Juassap App, whose owner is the company DIRECCION001. He insistedin the complaint in which his voice had been recorded without his consent, to later disseminate said recordingwithout your express authorization.The operational mechanics of DIRECCION001 is detailed in the previous assumption, being the joke of the contentdetailed called "The power outage".3.- Ms. Yolanda denounced on April 19, 2016 before the AEPD (PS / 00561/2016) that dated March 2016received a call on his phone from another in which they were posing as legal advice regardingwith a traffic ticket, in the case of a joke made through the Juassap App, whose owner is thecompany ADDRESS001., stating not having given consent for the recording made.The operative mechanics of DIRECCION001 is detailed previously, being the joke of the contentdetailed called "Fine for speeding".4.- Ms. María Antonieta denounced on May 1, 2016 before the AEPD (PS / 562/2016) that she had received acalled being the victim of a heavy joke, unspecified, made through the Juassap app, whoseThe owner is the company DIRECCION001., specifying the name of the complainant.The operating mechanics of DIRECCION001 is the same as in the previous cases.5.- The AEPD has verified that, in all these cases, the recipient of jokes is informed, but at the end of thelocution of the joke, of the procedure to exercise the rights of protection of personal data andof the origin of your phone number, in the following terms: " In accordance with the protection regulationsWe inform you that your phone has been provided by a friend or acquaintance of yours. Except that youcommunicate your opposition, your personal data will be part of a file owned by DIRECCION001 whosepurpose is the management of services and applications offered to users. You can also send an email toADDRESS 002 in case your friend or acquaintance can download and spread the recorded joke or in case ofwho does not want to receive more jokes. You can exercise your rights of access, rectification, cancellation and oppositionto ADDRESS001 at the address of PASEO000 NUM000 or through the email ADDRESS002,duly proving your identity . " (foundation of second law)THIRD .- On the exclusion of protection for dealing with personal or domestic activities.In its first plea, the applicant company maintains that the judgment under appeal has violated Article 2.2.of the Organic Law on Protection of Personal Data (Organic Law 15/1999, of December 5) andthe jurisprudence of the National Court itself, as well as that of the Court of Justice of the European Union inAs for what should be understood by data processing in the exclusively personal or domestic sphere.Regarding this allegation, the judgment of instance is pronounced in the following terms:" THIRD.- The plaintiff supports her contentious claim on three grounds: 1) DIRECCION001's activityit is excluded from the scope of protection of the LOPD as it takes place in the domestic sphere; 2) noperforms personal data processing; 3) the legitimacy for legitimate for the possible treatment of datamade by DIRECCION001 is based on its legitimate interest and the need to execute a contractbetween provider and user.Regarding the first reason, it is alleged that Article 2.2 of the LOPD excludes from the scope of protection ofthe aforementioned Law on files maintained in the exercise of exclusively personal or domestic activities.Playing a joke, he argues, is a personal activity, so he considers that mediating to play a jokebetween the "overwhelmed" and the person who wants to play the joke hired through that app, which is what according tothe plaintiff makes DIRECTION001, also enters that personal sphere. In this line, it reiterates that DIRECCION001is a "facilitator" of an activity carried out by the user in the strictly personal or domestic sphere,puts the means, does not use the information for any other purpose than to provide the service contracted by theclient and if the recording is broadcast, it is up to the user.The invoked article 2.2 of the LOPD effectively provides that the data protection regime ofpersonal character that is established in the mentioned Law will not be applicable: " a) To the files maintained by4 Page 5 JURISPRUDENCEphysical persons in the exercise of exclusively personal or domestic activities . "Exclusion that is faithfulReproduction of the last paragraph of Article 3 of Directive 95/46 / EC, which in its Recital 12 states asexample of a personal or domestic activity the correspondence and the carrying of a repertoire of addresses.The Court of Justice of the European Union has ruled on this matter in Judgment of 6November 2003 (Linqvist case) and more recently in the Judgment of December 11, 2014, caseC- 212/2013, in which we are going to stop.In the aforementioned Judgment of December 11, 2014, the CJEU carries out, for what interests us here, the followingconsiderations:" 27 As is clear from Article 1 and recital 10 of Directive 95/46, its purpose isguarantee a high level of protection of the freedoms and fundamental rights of natural personsand, in particular, of private life or privacy, in relation to the processing of personal data (seejudgment Google Spain and Google, C_131 / 12, EU: C: 2014: 317, paragraph 66).28 In this regard, it must be stated that, in accordance with settled case-law, the protection of the rightfundamental to private life, guaranteed by article 7 of the Charter of Fundamental Rights of the UnionEuropean, requires that the exceptions to the protection of personal data and the restrictions to such protectionare established without exceeding the limits of what is strictly necessary (see IPI, C_473 / 12,EU: C: 2013: 715, paragraph 39, as well as Digital Rights Ireland et al., C_293 / 12 and C_594 / 12, EU: C: 2014: 238, paragraph 52).29 Taking into account that the provisions of Directive 95/46, insofar as they regulate the treatmentof personal data that may violate fundamental freedoms and, in particular, the right to privacy orthe protection of private life, must be interpreted in light of the fundamental rights contained in theLetter cited (see Google Spain and Google, EU: C: 2014: 317, paragraph 68), the exception provided inthe second indent of Article 3 (2) of that directive must be interpreted strictly.30 Such a strict interpretation is also based on the text of the provision just cited,according to which Directive 95/46 does not limit itself to foreseeing that its provisions will not apply to the treatment ofpersonal data in the exercise of personal or domestic activities, but requires that it be the exerciseof "exclusively" personal or domestic activities.(...)32 Thus, with regard to natural persons, correspondence and the keeping of a repertoireof addresses constitute, in the light of recital 12 of Directive 95/46, 'activities exclusivelypersonal or domestic ", as much as they incidentally affect or may affect privacy and privacyfrom other persons.33 To the extent that video surveillance such as that at issue in the main proceedings is extended,albeit in part, to the public space, thus encompassing an area outside the private sphere of the person whoproceeds to data processing using this means, such surveillance by video camera cannot be consideredan exclusively 'personal or domestic' activity within the meaning of the second indent of Article 3 (2) ofDirective 95/46 "In view of the strict interpretation of said exception carried out by the CJEU, the exception invoked does notit is applicable to an assumption like the one in question. Thus, it must be taken into account, as the AEPD points outand thus it was verified in the data inspection carried out, that ADDRESS001. recorded the phone numbersof the complainants to make the call in question and their voice, proceeding to record it, when making a servicemultimedia content hosting, for access through GSM mobile devices, underthe Juasapp App. Application that allows a third party to choose the joke from a list, consisting of apre-recorded audio file by telephone, which you want to send to the destination number selected by saiduser. Once the joke is done, the application offers the possibility of generating the recording file of theprank, so that the user can later play, download and share the audio filecontaining the recording.And those personal details of the whistleblowers who received the jokes (their phone numberstogether with his voice), are incorporated into a file owned by the applicant, whose purpose is themanagement of services and applications offered to users, informing the recipient of the joke at the end ofthe phrase of the same: "in accordance with the data protection regulations", of the possibility of exercising theRights of access, rectification, cancellation and opposition.Thus, it is clear that the activity of DIRECCION001., Cannot be considered limited to a scopepersonal or domestic for the purposes of article 2.2.a) of the LOPD, nor is it excluded from the scope of5 Page 6 JURISPRUDENCEapplication of the LOPD, regulations that the party itself recognizes as applicable at the end of the speech ofthe joke." (foundation of third law)The Trial Chamber relies, as can be seen, on the jurisprudence of the Court of Justice, alleged bythe applicant herself. Being undoubtedly legally correct such reason for dismissal, in purity it is enoughto reject the complaint, the simple application of the invoked legal precept, which in its own literal wording excludesthat the sanctioned activity may be excluded from the application of the protection measures of the Law.In effect, section 2.a) of article 2 of the Personal Data Protection Act reads as follows:" Article 2. Scope of application.[...]2. The personal data protection regime established in this Organic Law does notwill apply:a) Files kept by natural persons in the exercise of exclusively personal activitiesor domestic.[...] »The argument of the sanctioned company is based on considering that it is a particular activityof a person who decides to play a joke on another (in Spanish teased, not "teased") and in whichthe company acts as a mere intermediary oblivious to the facts and that provides a service facilitating thatexercise. But it is obvious that the question does not lie in whether it can be classified as private or domesticthe activity of playing a joke (the activity of the individual who hires the service), but whether the treatment ofdata (activity of DIRECCION001 only and exclusively) is carried out in a particular or domestic environment.And there are two legal requirements for the exclusion clause to come into play, that the data processingIt is done by an individual and it is done within the framework of an exclusively private or domestic activity.Well, since it is obvious, neither of the two requirements is met. Who performs the data processing(activity causing the sanction, not that of playing the joke) is the sanctioned company, not the one who plays the joke,and it is idle to point out that ADDRESS001 is not a natural person, sufficient reason for it not to come into playthe aforementioned exclusion clause of data protection. And, moreover, neither the data processingcarried out by DIRECCION001 it is within the framework of a particular or domestic activity, character that couldascribe to the action of the individual who plays the joke, but in no case to the company DIRECCION001, which develops its service provider activity by providing the means for a person to teaseanother as a commercial activity that provides economic benefits. Therefore, the data processingwhich has been sanctioned by the Spanish Data Protection Agency and is not developed byan individual, because ADDRESS001 is not, nor has it been carried out in the context of an activity exclusivelypersonal or domestic, since it has been in the framework of a commercial activity of DIRECCION001 thatinvolved the computerized processing of personal data.FOURTH .- About the voice as personal data.In her second plea, the applicant claims that the judgment under appeal has violated Article 3 of the Law.Organic Data Protection (Organic Law 15/1999), in relation to article 5 of the Royal Decree1720/2007 of development of the Law, regarding what should be understood as personal data.The appealed judgment rejects the plaintiff's argument denying that the recorded voice is in the case ofthe personal data in the following legal basis:" FOURTH. The plaintiff holds, secondly, that it does not process personal data of the recipients of the jokes,Well, a phone number and the voice recorded for a few seconds because the call is short and unlessthe "overwhelmed" has decided to erase it at the moment, they do not allow to identify a person and therefore do notThey are personal data according to the diction of article 3 of the LOPD.The concept of "personal data" encompasses, by virtue of the definition contained in article 2, letter a),of Directive 95/46, which transposes the LOPD in its article 3.a) «all information about a natural personidentified or identifiable . ” (See in this regard, in particular, the CJEU's judgments of 20 May2003, Österreichischer Rundfunk et al., C-465/00 https://www3.poderjudicial.es/search/juez/index.jsp ,C-138/01 and C-139/01, Rec. P. I-4989, paragraph 64; of December 16, 2008, Huber, C- 524/06 https: //www3.poderjudicial.es/search/juez/index.jsp , Rec. p. I-9705, paragraph 43, and of May 7, 2009, Rijkeboer,C- 553/07 https://www3.poderjudicial.es/search/juez/index.jsp , Rec. P. I-3889, paragraph 42).Well, in the case at hand, apart from the telephone number of the complainants affected, althoughjust in case it could not be considered personal data according to the Judgment of this Chamber of September 176 Page 7 JURISPRUDENCE2008 (Rec. 353/2007), DIRECCION001 also registers the voice of the complainants through theTimely recording of the joke, likely to be broadcast. And in relation to the voice, we have said in the SANof March 19, 2014 (Rec. 176/2012) that " a person's voice constitutes personal data, suchas it is deduced from the definition that the same offers the article 3.a) of the LOPD, as "any informationconcerning identified or identifiable natural persons ", a question that is not controversial ".That is, the assumption at hand differs from that contemplated in the SAN of November 16, 2015 onrandom automatic calls, invoked as a comparison term on demand.On the other hand, as it has already been said in the previous Law Foundation, the entity itself informs at the endof the phrase of the joke: " according to the data protection regulations ", of the procedure to exercisethe rights of protection of personal data and the origin of your phone number toaffected, which shows that you are facing a record of personal data, from which access is providedby DIRECCION001., as responsible for the file, as it has been done when attending the right of accessexercised by D. María Antonieta.Article 6.1 LOPD, which regulates the principle of consent, provides " The treatment of character datapersonnel will require the unequivocal consent of the affected, unless the Law provides otherwise ".This principle implies the need for the unequivocal consent of the affected party so that they can be treatedyour personal data, consent thus allows the affected to exercise control over their datapersonal character (informative self-determination), since it is the interested party who has to grantyour consent so that the aforementioned data can be processed.It is a fundamental guarantee that only finds as exceptions to that consent of the affected party,those established in a law, collecting in section 2 of the aforementioned article 6 LOPD a series of exceptionsto the provision of the aforementioned consent.However, in the present case, DIRECCION001 has processed the personal data of the complainants withouttheir consent, as they have stated before the AEPD, being they empowered to grant theconsent to the treatment of your data, not the users of the App.[...] »(foundation of fourth law)The plaintiff's thesis is that in the present case the stored recordings cannot be consideredpersonal data, since they do not allow the identification of the person, not at least without deadlines or effortsdisproportionate. Thus, according to the recurring company, the voice recorded by DIRECCION001 cannotbe considered identifiable by said company, which only provides a tool for a userPerform private acts, such as playing a prank.The company claims that the JUASAPP application generates thousands of downloads that generate jokes daily,reason why the system makes thousands of calls originated by the user of the application, who is whohave the phone number of the recipient to whom the joke is played, and as many recordings are generatedwhich is available to the user on his own device, provided that he has decided to generate therecording. ADDRESS001 processes the calls - affirms the appellant - without storing the recipient's number,"It simply transmits them as if it were a booth, so that in no case can it identify therecipient by phone number ». When the user of the JUASAPP application plays the prankdecides to generate the recording of it, receives a link to the recording that is unique and private to him andthat only he knows. Although the audio file is stored in the cloud of DIRECCION001, it could neveridentify the recipient. It could only be done by the user who plays the joke and if he spreads it in his environment,also their acquaintances, although even then "such identification might not be easy."Nor can this claim prosper. As with the first reason, the plaintiff does not interpretcorrectly the scope of the legal provision. The precepts that it effectively invokes consider datapersonal only to those data that are identified or are identifiable. Thus, article 3.a) of the LawOrganic Protection of Personal Data (15/1999) established that it was to be understood by dataof a personal nature "any information concerning identified or identifiable natural persons".For its part, article 5 of the Regulation (Royal Decree 1720/2007, of December 21), which contains thedefinitions of the terms for the purposes of their application defines in its section 1.f) the character datapersonal as «any numerical, alphabetical, graphic, photographic, acoustic or any other informationtype concerning identified or identifiable natural persons ». Finally, section o) of theArticle 5 of the aforementioned Regulation defined an identifiable person7 Page 8 JURISPRUDENCE"... any person whose identity can be determined, directly or indirectly, by anyinformation referring to your physical, physiological, psychological, economic, cultural or social identity. A natural personit will not be considered identifiable if such identification requires disproportionate deadlines or activities. "This regulation applicable to the case of cars is included in similar terms in the now in force. HeGeneral Data Protection Regulation (Regulation 2016/679, of the Parliament and of the Council, of 27April 2016), whose transfer to the national system has been carried out by Organic Law 3/2018, of 5December, on Personal Data Protection and guarantee of digital rights, established in its paragraph26 the following:"(26) The principles of data protection should apply to all information relating to a personIdentified or identifiable physics. Pseudonymised personal data, which could be attributed to a personphysical by using additional information, should be considered information about a personidentifiable physics. To determine whether a natural person is identifiable, all themeans, such as singularization, that can reasonably be used by the controller or anyanother person to directly or indirectly identify the natural person. To determine if there is areasonable probability that means are used to identify a natural person, should be taken into accountall objective factors, such as costs and time required for identification, taking into accountboth the technology available at the time of treatment and technological advances. Therefore theData protection principles should not apply to anonymous information, that is, information that does notis related to an identified or identifiable natural person, or to the data made anonymousso that the interested party is not identifiable, or ceases to be so. Consequently, this Regulation does notaffects the processing of such anonymous information, including for statistical or research purposes. "This means that the data is only personal data subject to the protection regulations those whothey refer to identifiable natural persons, as claimed by the applicant company. Well, the argumenton the part is to affirm that the company itself does not store the phone of the teased person andthat therefore ADDRESS001 cannot identify all those who have been teased through theirJUASAPP application. However, such an argument must be rejected for several reasons, both of afactual and of a legal nature.Firstly, and as the Trial Chamber highlights, the defense adopted in these proceedingsIt is frontally contradictory with the conduct of the plaintiff, who after finishing the recording communicates to theteased that their phone has been provided by a friend or acquaintance and that except opposition by theirpart "your personal data will be part of a file owned by DIRECCION001" and provides you with theaddresses for the exercise of your rights of access, rectification, cancellation and opposition. It's hard to admitthat ADDRESS001 would proceed in this way if it were not storing personal data in the strictlegal concept of the same in the opinion of their own legal services and that, therefore, the treatment ofdata with the recording of the voice of the teased either included his phone or allowed the identification of therecorded subject through the rest of the stored data.Secondly, the judgment of instance admits as factual data, which is not reviewable on appeal, thatADDRESS001 keeps the telephone number of the individuals who are the object of the joke. So, on the foundationof fourth law (already reproduced), the Chamber affirms that “in the case at hand, apart from the number oftelephone number of the affected whistleblowers, which, by itself, may not be considered personal datapursuant to the Judgment of this Chamber of September 17, 2008 (Rec. 353/2007), DIRECTION001 proceedsto also register the voice of the complainants through the timely recording of the joke, subject tobe spread ». We must therefore conclude that ADDRESS001 stores and processes personal data of thekids that include telephone and voice, data that together undoubtedly make the person affectedbe perfectly identifiable. Furthermore, such statement by the Trial Chamber regarding the registration of boththe voice as of the telephone number of the affections of the Chamber of instance is supported by the collected factsin the sanctioning resolution of the Spanish Agency for Data Protection in which it is creditedstorage of both data.But it is also that the treatment of identifiable personal data is not projected only in front of theowner of the database, but also in front of third parties. That is, it would be an ad absurdum interpretationmaintain that data protection regulations are respected with a data treatment that would not beidentifiable by the person responsible for the file but which would be accessible to third parties who could identifyto the subjects to whom the data belongs, as is precisely the case here. Indeed, evenadmitting for purely argumentative purposes that ADDRESS001 did not store more than the recorded voiceof the teased and that he could not identify the subjects to whom the recordings belong, it turns outthat these recordings are accessible and even downloadable by third parties (users of the application ofADDRESS001 who play the jokes) who know the identity of the teased (in fact, they are the ones8 Page 9 JURISPRUDENCEThey have provided DIRECCION001 with their telephone number) in a totally unconscionable manner for those affected. Ofdone, DIRECTION001 communicates to the one who has played the joke and intends to download the recording that for itYou must have obtained the consent of the affected party. However, this is a telephone question that theUser can answer affirmatively without proving in any way that said consent has beenobtained. DIRECCION001 thus makes available to third parties personal data of persons identifiable bythey (the telephone that have provided the recorded voice) and stored by ADDRESS001 itself withoutthat the consent of those affected is recorded in any way. A recorded joke that may have beenwell received or, as in any of the reported cases, have caused concern, alarm or reactions -that they may have been recorded - and that the affected subject may prefer that they are not known.In this regard it is not idle to remember that the object of protection against storage and treatmentof personal data has as its ultimate objective the protection of the privacy of individuals, eitherconstitutionally protected that the phone jokes in question undoubtedly put at risk therecord them (without prior consent) and allow the recording to be downloaded and, therefore, to broadcast it onthird parties (without the consent of the affected party being recorded).Finally, it is also necessary to make some considerations regarding consent. Howwe have seen, the recording of the voice of the taxpayer of the joke is produced by a company to thethat they have provided their phone without prior consent, and it is only at the end of the recordingof the joke (with the prerecorded text of the joke and the possible responses or attempts at dialogue bythe teased) when the receiver of the call is interrogated if he authorizes the storage in a file ofdata owned by ADDRESS001. Well, the authorization request after listening to a recording that,only at the end, the subject understands that it was a joke and that it could have been funny, but alsocould have caused doubts, surprise or alarm, it can hardly be considered a consent that complieswith the requirements stipulated in the Data Protection Law. Thus, letter a) of Article 3 of the LawOrganic 15/1999 in force at the time of the facts defines consent as «all manifestationfree will, free, unequivocal, specific and informed, through which the interested party consents to the treatmentof personal data that concerns you ». The aforementioned Community General Regulation defines consentof the affected in analogous terms, such as «any manifestation of free will, specific, informed andunequivocally by which the interested party accepts, either by means of a declaration or a clear affirmative action, theprocessing of personal data concerning you »(article 4.11).Well, it does not seem that such features of a passive "consent" grantednegative, that is, as no opposition to a question asked by phone after a recordingsurprising as it is a joke in the circumstances of the case.In conclusion, we must reject the second claim since, contrary to what theapplicant, there is personal data processing, regarding which it is extremely doubtful that it canadmit that there was consent.FIFTH .- On the weighting of interests.In her third plea, the plaintiff alleges that the judgment under appeal has violated Article 7.f) of Directive 95/46 /CE (today repealed by the aforementioned General Regulation of April 27, 2016), when weighing between thelegitimate interest of the person responsible for data processing and protection of personal dataOf the interested. He maintains that it is a question of the hypothesis -that the party denies- that there is a treatmentdata, said treatment derives from an application that provides a means of leisure in the personal sphereor domestic of the people, which constitutes a legitimate interest on the part of DIRECCION001. It statesfurthermore, such treatment "could never be based on consent (as stated in the resolutionof the AEPD of which this procedure brings) because the very fact of spending thejoke".The contested judgment dealt with this allegation in the instance in the following terms:"... On the other hand, none of the assumptions that according to section 2 of the aforementioned precept exempts fromthe provision of consent, nor can such treatment be justified in article 7 letter f) of the Directive95/46, with which we link to the last ground of challenge.The aforementioned article 7 establishes that the Member States shall provide that the processing of personal datait can only be carried out if: " f) it is necessary for the satisfaction of the legitimate interest pursued by the person responsibleof the treatment or by the third party or third parties to whom the data is communicated, provided that the interest does not prevailor the fundamental rights and freedoms of the data subject that require protection in accordance with section 1 of theArticle 1 of this Directive ".9 Page 10 JURISPRUDENCEThe STJUE of November 24, 2011 invoked by the plaintiff effectively established that said preceptIt has a direct effect on our legal system, and precisely under the aforementioned precept, it considersthe Chamber that must prevail the fundamental right to data protection, referred to in article 1section 1 of the aforementioned Directive against the interest of the controller, which is reinforced by theConsiderations of the CJEU Judgment of December 11, 2014 transcribed in the Law Foundationpreceding.In short, there has been a violation of the principle of consent by the plaintiffresponsible for the file, which integrates the offense typified in article 44.3.b) of the LOPD appreciated bythe appealed resolution, which implies the dismissal of the appeal filed. " (foundation of lawfourth in fine )The allegation must be rejected. In no case could the performance of a leisure activity prevailagainst the protection of personal data in relation to their computer processing. I dont knowtry to compare the greater or lesser relevance of a leisure activity versus data protectionpersonal, but a leisure activity -like any other- must adhere to data protectionin the event that said activity involves the computerized treatment of such personal data. And if saidtreatment and the consent required makes a certain activity difficult (or unfeasible), it is not causeto suspend the effectiveness of the personal data of potentially affected individuals.But it is also that the appellant wrong the approach to the question. The private character is onlycan preach on the relationship between the joker and the teased, but not on the activity of the company thatIt facilitates the application and carries out the treatment of the data. The interest of this is not only or mainlyto provide a means of leisure, but the commercial benefit you get from it. Said commercial interestIt is undoubtedly legitimate, but it certainly cannot prevail over the protection of the data of theaffected persons, which requires their full and free informed consent for such data to besubjected to computer processing. Therefore, there has been no violation of the invoked precepts, butthat the weighing of interests made by the Trial Chamber is in accordance with law.SIXTH.- On the doctrine of casational interest.In accordance with the resolution of the process and in accordance with the considerations set forth in the previousfoundations of law we have to answer the questions of appeal raised in the order ofadmission of the resource in the following way:- the data processing carried out by a company in the framework of its commercial activity cannotconsider yourself included in the case of exclusion of data protection as they are activitiesexclusively personal or domestic, although the service provided by the company consists of providing arelationship between natural persons;- the recording of the voice associated with other data such as the telephone number or making it available to otherspeople who can identify who it belongs to must be considered a personal data subject tothe regulations for the protection of their automated treatment;- the commercial interests of a company responsible for a data file must yield to the interestlegitimate owner of the data in the protection of the same.SEVENTH .- Conclusion and costs.In accordance with them, the appeal filed by DIRECTION001 must be dismissed. againstjudgment of November 29, 2018 issued by the Contentious-Administrative Chamber (First Section)of the National Court.In accordance with the provisions of article 93.4 of the Jurisdiction Law, each party will pay the costs ofCassation caused at your request and the common ones by half.FAILUREFor all the foregoing, on behalf of the King and by the authority conferred on him by the Constitution, this Chamber has decided,in accordance with the interpretation of the norms established in the sixth legal basis:1. Declare that there is no place and, therefore, dismiss the appeal filed by DIRECCION001.against the judgment of November 29, 2018 of the Contentious-Administrative Chamber (First Section)of the National Court in contentious-administrative appeal 554/2017.2. Confirm the judgment object of the appeal.10 Page 11 JURISPRUDENCE3. Not to impose the costs caused in the appeal.Notify this resolution to the parties and insert it in the legislative collection.So it is agreed and signed.Eduardo Espín Templado.-José Manuel Bandrés Sánchez-Cruzat.-Eduardo Calvo Rojas.-María Isabel PerellóDoménech.-José María del Riego Valledor.- Diego Córdoba Castroverde.-Ángel Ramón Arozamena Laso.-Signed.-PUBLICATION.- The previous sentence was read and published by the Judge Speaker. Mr. D.EDUARDO ESPIN TEMPLADO, the Chamber being constituted in a public hearing of what, as Lawyer of theJustice Administration, I certify.-Signed.
