A company was sanctioned for sending commercial communications by email to a person registered on an opposition list, without being able to demonstrate obtaining prior and valid consent.

Facts and context

The Spanish data protection authority (AEPD) published a sanction decision against the company AD735 DATA MEDIA ADVERTISING, S.L., including the imposition of a fine of €10,000, for breaches related to sending unsolicited commercial communications.

The case originated from a complaint by an individual who received commercial emails without their authorization, even though they were registered on the opposition list "Lista Robinson".

Reasons for the decision

• Prohibition of sending unsolicited commercial communications (Article 21 of Law 34/2002 - LSSI): The authority found that the company sent several commercial emails to the complainant, notably on April 28 and 29, 2024. The company was unable to prove that the complainant had previously and expressly consented to receive such communications. The documentation provided on the consent collection process was deemed insufficient to establish the specific purposes for which the agreement was given. Furthermore, the fact that the complainant had been registered on the "Lista Robinson" since 2020 and had requested deregistration on April 24 and 25, 2024, without preventing a new sending on April 29, reinforced the conclusion of a violation of the Spanish law on information society services and electronic commerce.

Authority's decision

Consequently, the authority imposed a fine of €10,000 on AD735 DATA MEDIA ADVERTISING, S.L.

Lessons learned

This decision reminds that:

• The burden of proof for obtaining valid consent for sending commercial communications lies entirely with the data controller.
• Prior consultation of national opposition lists, such as the "Lista Robinson" in Spain, is an essential step before any prospecting campaign.
• Requests for deregistration or opposition to prospecting must be processed without delay and effectively to ensure the immediate cessation of sending.
• Consent collection processes must be documented precisely to demonstrate, for each person, the specific purposes for which they gave their agreement.