A company was sanctioned for sending a commercial communication to the professional email address of a former contact at a client company, the authority having rejected the legal basis of legitimate interest in the absence of a prior direct contractual relationship with the data subject.

Facts and context

The Spanish Data Protection Agency (AEPD) today published a decision closing a sanction procedure against VERNE INFORMATION TECHNOLOGY, S.L., following the payment of a fine of €1,600 for sending unsolicited commercial communications.

The case originated from a complaint by a natural person who received a commercial communication from the company without having consented to it and in the absence of any contractual relationship.

Grounds for the decision

• Sending commercial communications without a legal basis (Article 21(1) of Spanish Law 34/2002 on Information Society Services and Electronic Commerce): The authority found that the company had sent a prospecting email to a natural person at their professional address. It recalled that such an address, being linked to an identifiable natural person, constitutes personal data. The company invoked its legitimate interest, arguing a previous professional relationship as the recipient had been its contact within a formerly client company. The authority rejected this argument, considering that such a situation does not constitute the "prior contractual relationship" required by Spanish legislation to justify sending prospecting without explicit consent. The fact that the complainant did not use the unsubscribe link is deemed irrelevant to the lawfulness of the initial sending.

Authority's decision

Consequently, the authority imposed a fine of €2,000 on VERNE INFORMATION TECHNOLOGY, S.L., which was reduced to €1,600 following its voluntary payment, thus ending the procedure.

Lessons learned

This decision reminds that:

• A nominative professional email address constitutes personal data, the processing of which for prospecting purposes must be based on a valid legal basis.
• The invocation of legitimate interest for commercial prospecting by email is excluded when specific legislation (transposing the "privacy and electronic communications" directive) requires prior consent or a pre-existing contractual relationship.
• A past professional relationship with a person as a contact within a client company does not constitute the "prior contractual relationship" required to justify sending commercial prospecting to that same person, even at a new professional address.