Help us make the FRA website better for you!

Take part in a one-to-one session and help us improve the FRA website. It will take about 30 minutes of your time.

YES, I AM INTERESTED NO, I AM NOT INTERESTED

Spain / Spanish Supreme Court / 2031/2020

The commercial MIRACLIA TELECOMUNICACIONES, S.L. against the STATE ADMINISTRATION.
Deciding body type
National Court/Tribunal
Deciding body
The Spanish Supreme Court
Type
Decision
Decision date
22/06/2020

Handvest van de grondrechten van de Europese Unie

Title II: Freedoms

Article 7 - Respect for private and family life

Title II: Freedoms

Article 8 - Protection of personal data

VIEW FULL CASE
  • Spain / Spanish Supreme Court / 2031/2020
    Key facts of the case:

    The facts refer to the sanctioning procedure PS/00315/2018, initiated by the Spanish Data Protection Agency against the entity MIRACLIA TELECOMUNICACIONES, S.L., in view of the complaint filed by A.A.A. The complainant, owner of a certain telephone line, denounced that between 14 and 19 March 2018 she had received calls on her mobile phone with the aim of playing a prank on her through the application called "JUASAPP" owned by MIRACLIA TELECOMUNCIACIONES SL, an application that can be downloaded through Google Play. The complainant sent e-mails to MIRACLIA on 16/03/2018 requesting to be provided with the person who, without a supermarket number, had used her mobile phone number to play tricks on her through the JUASSAP application. The accused replied that she had received the jokes because a friend or acquaintance with her number was a JUASAPP user. The complainant provided a printout of the telephone lines from which calls are made between these dates. As indicated in the terms and conditions of use of the service (TCU), JUASAPP is an application that allows the user who has downloaded it to send jokes to a third party, giving the mobile phone number to the application. Through a pre-recorded audio of the app the joke is sent to the line that was given. The user can select from a list of jokes and indicate the destination, and time you want the recipient to receive the joke. Once the joke has been played, the application can record the joke if the user so wishes, and the user can also share the audio file, as there is a link in the form of a URL that MIRACLIA's systems store and make it possible to share by clicking on the link that is generated. The TCU also states that "the user must have the express consent of the person who has received the joke in order to obtain it and subsequently use it", although it is perfectly possible to play the joke on people and mobile numbers that are known to each other, but not through a relationship of friendship, but through any other. "Privacy Policy Clause 4 indicates that the personal data provided is stored in automated files for which MIRACLIA is responsible" (page 30). Among other data stored is the user's telephone number if he or she uses APPLE's IOS system. There is no information about the person for whom the joke is played, including mobile phone numbers, voice, records or reproduction of their voice, at the time the joke was played. There is no evidence that the reported person offers the possibility, once the prank is made, that the affected person consents to the use of the prank (reproduction, recording, storage in a shared URL), nor is he/she informed at that time that a prank has been played on him/her or of the origin or person from whom his/her data are collected. The only possibility offered in the written form of the TCU is to enter your mobile line in an exclusion list or blacklist after playing the prank.

    In its reply of 1 June 2018, the defendant indicated in previous proceedings that no information relating to the complainant's line appeared on the substitute form, not even on the list of blockages so as not to receive any more jokes. Ladenunciada indicated that this list makes it possible for a telephone number to be included so that users cannot send them jokes. If a mobile phone number that has been given before is included on the exclusion list, it cannot be pranked. Among all the numbers listed as those called to make the reported pranks, ORANGE ESPAGNE S.A.U., indicated on 30/05/2018 that the given telephone number in question is associated to the customer IMAGINE800 S.L., and its reference is included in the privacy policy of the JUASAPP application as one of the companies that assists MIRACLIA in the hosting and metrics service in Spain to be able to provide the technical service, although the company stated that it also provides services for others. The defendant indicated that since 25/05/2018 and with the analysis of previous complaints and sanctions by the AEPD, the information clause has changed. Among other measures, she indicated that once the joke has been recorded, if applicable, the URL is stored in the cloud so that it can be shared by the user, who can then send it to another person and listen to it. Having analysed the terms of condition and use extracted from the website of the accused on 19/07/2018, there is no mention of the rights of the person to whom the joke is played, specifically the right not to allow the joke to be reproduced, that it is not carried out, or, on the contrary, the right to information about the origin of their data. Nor is any legitimate basis established for the processing of the data of the person to whom the prank is played. Once these facts were considered proven and the legitimate interest analysed, the Spanish Data Protection Agency concluded that the company denounced had committed the data processing breach without consent or the concurrence of legitimate interest that Article 6.2 of the Organic Law on Data Protection presupposes. And resolved to impose on MIRACLIA TELECOMUNICACIONES, S.L. for that infringement, classified as serious in Article 44.3.b) of the same Law, a fine of 6 000 euros, in accordance with the provisions of Article 45.1), 2) 4 f) and j) and 5.a) of that Law. MIRACLIA TELECOMUNICACIONES, S.L. filed an administrative appeal against this decision and, subsequently, an appeal in cassation against the decision of the First Section of the Administrative Chamber of the National Court of Justice which rejected the aforementioned administrative appeal.

    The cassation appeal in question, filed by the procedural representation of the commercial company MIRACLIA TELECOMUNICACIONES, S.L., is aimed at reversing the judgment of the First Section of the Contentious-Administrative Chamber of the National Court of April 4, 2019,

    which dismissed the contentious-administrative appeal 423/2017 filed against the Director's decision of the Spanish Data Protection Agency of 29 May 2017, which imposed on the aforementioned company a fine of 6000 euros, as responsible for the infringement of article 6 of the Organic Law 15/1999, of December 13, Protection of Personal Data, classified as serious in Article 44.3 b) of the cited legal text.

     
    Key legal question raised by the Court:
    (i) What should be considered as exclusively personal or domestic data processing for the purpose of their exclusion from the scope of protection provided by the Organic Law 15/1999, of December 13, Protection of Personal Data in accordance with the provisions of Article 2 of this Law -current Article 2.2.a) Organic Law 3/2018 which refers to Article 2.2 of the General Regulations (EU)-. (ii) Under what circumstances (or with what scope) can a person's voice be considered as a personal nature, according to Article 3 the Organic Law 15/1999, in relation to Article 5 of the correspondent Regulation - currently Article 4.1 of the General Regulation (EU). (iii) In what terms should be carried out the weighting provided for in Article 7.f) of Directive 95/46/EC - currently Article 6.1.f) of the General Regulation (EU) - between the legitimate interest of the responsible for the data and the protection of personal data of the interested party.
     
    Outcome of the case:
    The Supreme Court rejected MIRACLIA's claim against the ruling of the First Section of the Contentious-Administrative Chamber of the National Court of Justice of 4 April 2019, handed down in contentious-administrative appeal number 423/2017, for the following reasons: 1.- The processing of data carried out by a company within the framework of its commercial activity should not be considered as falling under the exclusion of data protection because of the activities exclusively personal or domestic, although the service provided by the company consists of facilitating a relationship between individuals. 2.- The recording of the voice associated with other data such as the telephone number or making it available to others persons who can identify who it belongs to must be considered as personal data subject to the protection regulations of the automated treatment of the same. 3.- The commercial interests of a company responsible for a data file must yield to the legitimate of the owner of the data in the protection of the same.
     
     
  • Paragraphs referring to EU Charter

    In this regard, it should be noted that, according to settled case law, the protection of the fundamental right to privacy, which is guaranteed by Article 7 of the Charter of Fundamental Rights of the European Union, requires that exceptions to the protection of personal data and restrictions on such protection be established without exceeding the limits of what is strictly necessary (see IPI, C_473/12, EU C:2013:715, paragraph 39, as well as Digital Rights Ireland and others, C_293/12 and C_594/12 EU:C:2014:238, paragraph 52). Given that the provisions of Directive 95/46, insofar as they regulate the processing of personal data that may infringe fundamental freedoms and in particular the right to privacy or the protection of private life, must be interpreted in the light of the fundamental rights set out in the aforementioned Charter (see the Google Spain and Google judgment, EU:C:2014:317, paragraph 68), the exception provided for in the second indent of Article 3(2) of that Directive must be interpreted strictly. Article 8 of the Charter of Fundamental Rights of the European Union, under the heading "Protection of personal data", provides "Everyone has the right to the protection of personal data concerning him or her. Such data shall be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access

    to data which has been collected concerning him or her, and the right to have it rectified. Respect for these rules shall be subject to the control of an independent authority.” In the judgment of the Court of Justice of the European Union of December 11, 2014 (Case C-212/13), the commitments and obligations of the Member States of the European Union to effectively protect the right to privacy of citizens against the automated processing of their personal data, in the light of the Charter of Fundamental Rights and Directive 95/46/EC of the European Parliament and the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, are set out. However, it should be borne in mind that the second of these requirements requires a weighing of the rights and interests involved, which will depend, in principle, on the specific circumstances of the particular case in question, and in which context the person or institution carrying out the weighing must take into account the importance of the rights conferred on the data subject by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (hereinafter referred to as the "Charter"). In this connection, it should be noted that Article 8(1) of the Charter states that 'everyone has the right to the protection of personal data concerning him'. This fundamental right is closely linked to the right to respect for private life, which is enshrined in Article 7 of the Charter ( Joined Cases C-92/09 and C-93/09 Volker und Markus Schecke and Eifert [2010] ECR I-0000, paragraph 47). According to the case law of the Court of Justice, respect for the right to privacy with regard to the processing of personal data, as recognized by Articles 7 and 8 of the Charter, applies to any information about an identified or identifiable natural person (see Volker und Markus Schecke and Eifert, paragraph 52). However, it follows from Articles 8(2) and 52(1) of the Charter that, under certain conditions, limitations may be placed on that right. Unlike the processing of data contained in sources accessible to the public, the processing of data contained in sources not accessible to the public necessarily implies that the controller and, where appropriate, the third party or parties to whom the data are disclosed will

    henceforth have certain information on the private life of the data subject. This more serious violation of the rights of the data subject as set forth in Articles 7 and 8 of the Charter must be assessed at its fair value, counterbalancing it with the legitimate interest pursued by the data controller or by the third party or parties to whom the data are communicated.

  • Paragraphs referring to EU Charter (original language)

    A este respecto, procede hacer constar que, con arreglo a reiterada jurisprudencia, la protección del derecho fundamental a la vida privada, que garantiza el artículo 7 de la Carta de los Derechos Fundamentales de la Unión Europea, exige que las excepciones a la protección de los datos personales y las restricciones a dicha protección se establezcan sin sobrepasar los límites de lo estrictamente necesario (véanse las sentencias IPI, C_473/12, EU:C:2013:715, apartado 39, así como Digital Rights Ireland y otros, C_293/12 y C_594/12 EU:C:2014:238, apartado 52).

    Teniendo en cuenta que las disposiciones de la Directiva 95/46, en la medida en que regulan el tratamiento de datos personales que puede vulnerar las libertades fundamentales y, en particular, el derecho a la intimidad o la protección de la vida privada, deben ser interpretadas a la luz de los derechos fundamentales recogidos en la citada Carta (véase la sentencia Google Spain y Google, EU:C:2014:317, apartado 68), la excepción prevista en el artículo 3, apartado 2, segundo guión, dé dicha Directiva debe ser interpretada en sentido estricto. El artículo 8 de la Carta de los Derechos Fundamentales de la Unión Europea, bajo la rúbrica "Protección de datos de carácter personal", dispone: "1. Toda persona tiene derecho a la protección de los datos de carácter personal que la conciernan. 2. Estos datos se tratarán de modo leal, para fines concretos y sobre la base del consentimiento de la persona afectada o en virtud de otro fundamento legítimo previsto por la ley. Toda persona tiene derecho a acceder a los datos recogidos que la conciernan y a su rectificación. 3 .El respeto de estas normas quedar· sujeto al control de una autoridad independiente.". En la sentencia del Tribunal de Justicia de la Unión Europea de 11 de diciembre de 2014 (Asunto C-212/13), se expone cuáles son los compromisos y obligaciones que adquieren los Estados miembros de la Unión Europea para proteger de forma eficaz el derecho a la intimidad de los ciudadanos frente al tratamiento mecanizado de sus datos personales, a la luz de la Carta de Derechos Fundamentales y de la Directiva 95/46/CE del Parlamento Europeo y del Consejo, de 24 de octubre de 1995, relativa a la protección de las personas físicas en lo que respeta al tratamiento de datos personales y a la libre circulación de estos datos. No obstante, ha de tenerse en cuenta que el segundo de esos requisitos exige una ponderación de los derechos e intereses en conflicto, que dependerá, en principio, de las circunstancias concretas del caso particular de que se trate y en cuyo marco la persona o institución que efectúe la ponderación deberá tener en cuenta la importancia de los derechos que los artículos 7 y 8 de la Carta de los Derechos Fundamentales de la Unión Europea confieren al interesado (en lo sucesivo, "Carta"). A este respecto, procede señalar que el artículo 8, apartado 1, de la Carta declara que "toda persona tiene derecho a la protección de los datos de carácter personal que le conciernan". Este derecho fundamental se halla íntimamente ligado al derecho al respeto de la vida privada, consagrado en el artículo 7 de dicha Carta ( sentencia de 9 de noviembre de 2010, Volker und Markus Schecke y Eifert, C-92/09 y C-93/09, Rec. p. I-0000, apartado 47).

    Según la jurisprudencia del Tribunal de Justicia, el respeto del derecho a la vida privada en lo que respecta al tratamiento de los datos de carácter personal, reconocido por los artículos 7 y 8 de la Carta, se aplica a toda información sobre una persona física identificada o identificable (véase la sentencia Volker und Markus Schecke y Eifert, antes citada, apartado 52). No obstante, de los artículos 8, apartado 2, y 52, apartado 1, de la Carta se desprende que, bajo ciertas condiciones, pueden introducirse limitaciones a dicho derecho. En efecto, a diferencia de los tratamientos de datos que figuran en fuentes accesibles al público, los tratamientos de datos que figuran en fuentes no accesibles al público implican necesariamente que el responsable del tratamiento y, en su caso, el tercero o terceros a quienes se comuniquen los datos dispondrán en lo sucesivo de ciertas informaciones sobre la vida privada del interesado. Esta lesión, más grave, de los derechos del interesado consagrados en los artículos 7 y 8 de la Carta debe ser apreciada en su justo valor, contrapesándola con el interés legítimo perseguido por el responsable del tratamiento o por el tercero o terceros a los que se comuniquen los datos.