TRANSLATION
PRESIDENT
OF THE PERSONAL DATA
PROTECTION OFFICE
Jan Nowak
Warsaw, 6 July 2021
Ref. No.: ZSPR.440.1070.2018.PT.BS
(previous Ref. No.: ZSPR.440.1070.2018.LS.I)
DECISION
On the basis of Article 104 § 1 of the Act of 14 June 1960 Code of Administrative
Procedure (consolidated text: Dz. U. [Journal of Laws] of 2021 item 735), Article 7 (1) of the
Act of 10 May 2018 on personal data protection (consolidated text: Dz. U. [Journal of Laws] of
2019 item 1781), Article 60 (8) of the Regulation (EU) 2016/679 of the European Parliament and
of the Council of 27 April 2016 on the protection of natural persons with regard to the processing
of personal data and on the free movement of such data, and repealing Directive 95/46/EC
(General Data Protection Regulation) (OJ EU L 119 of 04/05/2016, p. 1, OJ EU L 127 of
23/05/2018, p. 2 and OJ EU L 74 of 04/03/2021, p. 35), regarding the complaint of
, running a business under the name of
(address: ), on the irregularities in the
processing of his personal data by . based in Barcelona (
), consisting in the processing of personal data without
a legal basis, President of the Personal Data Protection Office
rejects a complaint.
JUSTIFICATION
On 3 August 2018, the Personal Data Protection Office received a complaint from
, running a business under the name of
(address: A ), hereinafter referred to as: the
Complainant, about irregularities in the processing of his personal data by
based in Barcelona ( ), hereinafter referred to
as: the Company, consisting in the processing of the complainant's personal data without a legal
basis.
The President of the Personal Data Protection Office identified the case as having a cross-
border nature in accordance with Article 4 (23) of Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard
to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119 of 04/05/2016, p. 1, OJ
EU L 127 of 23/05/2018, p. 2 and OJ EU L 74 of 04/03/2021, p. 35), hereinafter referred to as:
Regulation 2016/679, and referred the case to the Spanish supervisory authority (Spanish:
Agencia Española de Protección de Datos), hereinafter referred to as: AEPD, which took the
case as leading supervisory authority.
After conducting the proceedings on the submitted complaint, AEPD notified the
President of the Personal Data Protection Office about the findings made by it and presented
a proposal for resolving the matter by closing the case. The President of the Personal Data
Protection Office agreed with the factual findings made by AEPD.
In the course of administrative proceedings, the President of the Personal Data Office
Protection established the following facts:
1. On 18 June 2015, the Company concluded an agreement with .
The subject of the above-mentioned of the contract was to carry out the activity of
collecting personal data of certain natural persons who showed interest in receiving
advertising messages. The above contract specified the scope of personal data subject to
the order: name, surname, gender, date of birth, e-mail address, time stamp or registration
time and IP address. The contract also included the complementary service ‘COI’ (Opt-In
confirmation), thanks to which is obliged to apply the
mechanism of double verification of the registration of the interested person in the
database which is the subject of the contract, in order to guarantee the acquisition of data
and the correct understanding and willingness to provide it by the user. The contract
specifies the purpose of further data use by the Company – sending advertising messages
using e-mail marketing techniques. In addition, it states that V. is
obliged to provide the interested party with information about the recipient of their data
(which in this case was the Company), as well as about the methods of use / processing to
2
which the data will be subjected (in this case, for sending advertisements by electronic
means) (AEPD findings of 9 February 2021).
2. The Complainant’s personal data (including: name, surname, gender, date of birth, zip
code, e-mail address, time stamp and IP address) were obtained by the Company on
7 March 2015 at 19:02 via the Internet promotional campaign organized by
, run at the website: . In the
Company’s opinion, the Complainant’s consent to the processing of data for direct
marketing purposes was deliberate because additional confirmation was necessary by
clicking on the link in the e-mail received (AEPD findings of 9 February 2021).
3. The AEPD established that the Company had demonstrated that on 7 March 2015 the
Complainant consented to the processing of his data in order to receive marketing e-mails
(AEPD findings of 9 February 2021).
4. The findings of the AEPD show that the Company complied with the request and
informed the Complainant about the deletion of his personal data, after receiving the
Complainant’s request to be removed from the Company’s mailing list (AEPD findings
of 9 February 2021).
5. The Complainant, via the ‘Opt-Out’ link in each marketing message sent directly or on
behalf of the Company, on 22 June 2018 at 17:41, objected to the processing of his
personal data for direct marketing purposes. The company stopped processing the
Complainant’s personal data (AEPD findings of 9 February 2021).
After reviewing the entirety of the evidence collected in the case, the President of the
Office for Personal Data Protection considered the following.
It should be pointed out that Regulation 2016/679 defines the obligations of the data
controller, which include the processing of personal data in compliance with the conditions set
out in this regulation. The provision entitling data controllers to process ordinary data of natural
persons, including their disclosure, is Article 6 (1) of Regulation 2016/679, according to which
data processing is allowed only if one of the conditions indicated in this provision is met. The
catalog of premises listed in Article 6 (1) of Regulation 2016/679 is closed. Each of the premises
legalizing the processing of personal data is autonomous and independent. This means that these
conditions are, in principle, equal, and therefore meeting at least one of them determines the
lawful processing of personal data. As a consequence, the consent of the data subject is not the
only basis for the processing of personal data, because the data processing process will be
3
compliant with Regulation 2016/679 also when the data controller demonstrates that another of
the above-mentioned conditions is met. Regardless of the consent of the data subject (Article 6
(1) (a) of Regulation 2016/679), the processing of personal data is allowed, inter alia, when
processing is necessary for the performance of a contract to which the data subject is party or in
order to take steps at the request of the data subject prior to entering into a contract (letter b);
processing is necessary for compliance with a legal obligation to which the controller is subject
(letter c); processing is necessary in order to protect the vital interests of the data subject or of
another natural person (letter d); processing is necessary for the performance of a task carried out
in the public interest or in the exercise of official authority vested in the controller (letter e);
processing is necessary for the purposes of the legitimate interests pursued by the controller or
by a third party, except where such interests are overridden by the interests or fundamental rights
and freedoms of the data subject which require protection of personal data, in particular where
the data subject is a child (letter f).
At the outset, it should be noted that Article 21 of Regulation 2016/679 regulates the
issue of the party’s right to object to the processing of their personal data. In accordance with
paragraph 2 and 3 above of the provision, if personal data are processed for direct marketing
purposes, the data subject has the right to object at any time to the processing of his personal data
for the purposes of such marketing, including profiling, to the extent that the processing is
related to such marketing direct. If the data subject objects to processing for direct marketing
purposes, the personal data may no longer be processed for such purposes.
Referring the above to the process of processing his personal data for marketing purposes
questioned by the Complainant without a legal basis, it should be indicated that until the date of
the Complainant’s objection, i.e. until 22 June 2018, the Company processed his personal data
on the basis of the consent expressed by the Complainant on 7 March 2015, and therefore this
process was based on Article 6 (1) (a) of Regulation 2016/679, and during the period of the Act
of 29 August 1997 on the protection of personal data (Dz. U. [Journal of Laws] of 2016, item
922, as amended), it was legal pursuant to Article 23 (1) (1) of this act.
As follows from the evidence collected in this case, the questioned sending of the
information containing the marketing offer took place after the Complainant consented to the
processing of his personal data for marketing purposes on 7 March 2015, but before he submitted
an objection on 22 June 2018. The above means that the Company did not breach the provisions
on the protection of personal data, as this process was based on Article 6 (1) (a) of Regulation
2016/679.
4
It should be noted here that the administrative procedure conducted by the President of
the Personal Data Protection Office serves to control the compliance of data processing with the
provisions on the protection of personal data and is aimed at issuing an administrative decision
restoring the legal status pursuant to Article 58 (2) of Regulation 2016/679. The assessment
made by the President of the Personal Data Protection Office in each case serves to examine the
legitimacy of issuing an order to a specific subject corresponding to the disposition of
Article 58 (2) of Regulation 2016/679 to restore the lawful state in the data processing process –
so it is justified and necessary only insofar as there are irregularities in the processing of personal
data. In the opinion of the President of the Personal Data Protection Office, there are no grounds
to conclude that such irregularities exist in this case, because the processing of Complainant’s
personal data by the Company for marketing purposes questioned by him, was based on
Article 6 (1) (a) of Regulation 2016/679.
In this factual and legal background, the President of the Personal Data Protection Office
adjudicated as in the sentence.
Under the authority of the President
of the Personal Data Protection Office
This decision is a final decision. Based on Article 7 (2) of the Act of 10 May 2018 on the Protection of
Personal Data (consolidated text: Dz. U. [Journal of Laws] of 2019, item 1781) and in connection with Article 13 §
2, Article 53 § 1 and Article 54 of the Act of 30 August 2002 Law on proceedings before administrative courts
(consolidated text: Dz. U. [Journal of Laws] of 2019, item 2325), the party has the right to bring a complaint to the
Provincial Administrative Court in Warsaw against this decision, within 30 days from the date of delivery of this
decision, through the President of the Personal Data Protection Office (address: Urząd Ochrony Danych
Osobowych, ul. Stawki 2, 00 – 193 Warszawa [Personal Data Protection Office, Stawki 2, 00-193 Warsaw]). The
fee for the complaint is PLN 200. The party has the right to apply for the right of assistance, which includes
exemption from court costs and the appointment of an attorney, legal advisor, tax advisor or patent attorney. The
right of assistance may be granted upon application by a party submitted prior to the initiation of the proceedings or
in the course of the proceedings. This application is free of court fees.
5