Avilon Center 2016, SL – €12,000 Fine (Spain, 2021)

The complainant filed a complaint against Avilon Center 2016 SL. The complainant received commercial calls from Avilon Center on their private number, despite being listed on the Robinson List (opt-out list of people who do not wish to receive marketing transmissions). The Spanish DPA (AEPD) investigated these facts. In its investigation, it found that the telephone number which called the claimant was operated by Sewan Comunicaciones SL. The AEPD also asked Avilon Center about where they go the claimant's telephone number, the object of the call, the legitimacy of the call, and information provided to the claimant about the origin of the claimant's personal data . Avilon Center responded that information on the origin of the data could not be provided to the data subject during the call as the data subject interrupted the call by stating that they were registered on the Robinson List and hung up. Avilon also mentioned that it is registered in Adigital as a provider of services that has access to the Robinson List and that on the data of the call, there was a software error that blocked the table with the persons included on the Robinson List. This error was solved after 30 minutes, but Avilon Cneter has already made the call to the claimant during that time. Does making a commercial call to a data subject registered on the Robinson List violate Article 48(1)(b) LGT and Article 21 GDPR in conjunction with Article 23(4) LOPDGDD? The Spanish DPA (AEPD) held that the facts of the case point to the fact that Avilon Center breached Article 48(1)(b) of the Spanish Law on Telecommunications (LGT) as well as Article 21 GDPR in conjunction with Article 23(4) of the Spanish Law on Protection of Personal Data and guarantee of digital rights (LOPDGDD). The defendant argued that the reason why a call was made to the claimant despite them being on the Robinson List was because Adigital had a software error so the Robinson List was no accessible to be checked by Avilon Center prior to making the call. However, the AEPD stated that an analysis of the risk prior to processing any person data should be performed. Additionally, necessary controls must be put in place to avoid making calls when such system errors occur. The AEPD stated that strict liability does not apply in the present case, but that the defendant lacked due diligence in the technical and organisational measures that they applied to the processing of personal data linked to telephone lines. As this lead to a violation of the claimant's rights (notably: right to object by registering themselves on the Robinson List), the AEPD concluded that Avilon Center was responsible for the processing of personal data. The Spanish DPA therefore imposed a fine of €20,000 on Avilon Center. In accordance to Spanish Administrative Law, this fine was reduced to €12,000 as Avilon Center made a voluntary, early and guilty payment of the fine.