Miraclia Telecomunicaciones, S.L. – Court Ruling (Spain, 2020)

This sentence is the result of a cassation appeal submitted by the defendant against another sentence of the Spanish TS (ECLI: ES:AN:2018:4709, dated November 29, 2018) which, in turn, is the result of an administrative appeal submitted by the defendant against a decision of the Spanish Data Protection Agency (AEPD) dated November 3rd, 2017 imposing a fine of 7,500 € on the defendant due to the breach of Article 6(1) of the LOPD (the decision in Spanish can be downloaded [https://www.aepd.es/es/documento/ps-00559-2016.pdf here]). In order to use the Juasapp app, it was necessary that a natural person entered the telephone number of another natural person in the app; then this last one received a pre-recorded voice call with different kind of jokes (some of then even referring to possible events happened to his/her family); the only data protection information the affected by such jokes received was at the end of the joke, when the voice message specified that "his/her telephone had been provided by a friend or acquaintance" of him/her and that, "unless he/she communicates his/her opposition, his/her personal data will be processed by the defendant". The AEPD received different complaints from natural persons affected by such jokes, and clearly understood that the defendant had not obtained the consent to process personal data belonging to such people. In the cassation appeal submitted before the Spanish TS, the defendant considered that: (i) its commercial activity only provides leisure services to natural persons under their domestic or personal activity; (ii) the data processed by the defendant cannot be considered as personal, so the data protection obligations would not be applicable, and (iii) even if this activity is considered under the data protection obligations, the legal basis for its processing would be the legitimate interest of the defendant. The Spanish TS understood that: (i) the data processing activity carried out by a company in the framework of its commercial activity cannot be excluded from its data protection obligations on the basis of being considered an exclusively personal or domestic activity, even if the service provided by the company consists of providing a relationship between natural persons; (ii) the recording of the human voice, associated with other data such as the telephone number, must be considered personal data, and the fact of making it available to third parties who can identify who such voice belongs to, must be clearly considered an automated personal data processing activity; and (iii) the commercial interests of a data controller must yield to the legitimate data protection interests of the owner of such personal data. With basis on these understandings, the Spanish TS decides to dismiss the cassation appeal, and, consequently, the defendant must pay the 7,500 € fine imposed by the AEPD in November 3rd, 2017.