DECO PROTESTE Editores, Lda. – €107,000 Fine (Portugal, 2019)

A data subject received unsolicited direct marketing emails from Deco Proteste. Deco Proteste was the largest Portuguese Consumer Protection association, operating, in this matter, as Deco Proteste Edições Lda., a limited liability company. The data subject never provided their personal data to Deco Proteste and, as a result, never consented to receiving direct marketing emails from the organization. The data subject filed a complaint with the Portuguese DPA (CNPD). After the investigation, 45 other unsolicited direct marketing emails, between the dates of 11th of October 2011 and 5 of June 2013, were added to the complaint. Deco Proteste claimed that the personal data of the data subject was part of a database owned by a direct marketing company it had subcontracted to provide direct marketing services. As such, the claimed it was the direct marketing company that was the controller, not Deco Proteste. The DPA upheld the complaint and imposed a fine of €107,000. Deco Proteste was assigned a role of a data controller. The DPA did not accept the controller's arguments that the marketing agency who sent the marketing communications was acting as an independent controller.The fact that the controller used a third party to assist in direct marketing of its products did not exclude their status of controller, even if the database used was owned by that third-party. Hence, the marketing company was considered by the DPA as a processor. Also, the DPA explained the legitimate interest under Article 6(1)(f) GDPR was not the applicable legal basis to use the data subject's contact details for direct marketing purposes. The DPA considered that all direct marketing emails sent referred to products and services offered by controller. It also considered that controller freely, voluntarily and consciously decided to process personal data without any legal basis to promote its products and services, neglecting its legal obligations under the Personal Data Protection