Published on · RedData Legal
Who imposes the penalties
Penalties for unsolicited commercial communications are imposed by the Spanish Data Protection Agency (AEPD). Article 43 of the LSSI-CE gives it competence over articles 21 and 22 (commercial communications and the right to object), and the GDPR and Organic Law 3/2018 give it competence over the processing of personal data. No private company, including claims-management firms, can impose penalties: what they do is file the complaint and provide the evidence.
LSSI-CE penalties
Article 38 classifies the infringements and article 39 sets the fines:
- Minor infringement (article 38.4.d): sending commercial communications by email or equivalent means where it does not amount to a serious infringement. Fine of up to €30,000.
- Serious infringement (article 38.3.c): massive sending of unsolicited commercial communications, or sending more than three communications to the same recipient within one year. Fine of €30,001 to €150,000.
- Very serious infringement (article 38.2): reserved for serious repeat offences, with fines of €150,001 to €600,000.
Article 40 sets the grading criteria: intent, the period during which the infringement was committed, repeat offences, the nature and amount of the damage, the profit obtained and turnover.
GDPR penalties
Where the email is sent to an address that identifies a person, processing without a lawful basis and failing to inform the data subject are infringements under article 83(5) of the GDPR, with fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher. Article 83(2) lists the grading criteria, including the nature and gravity of the infringement, intent, the measures taken to mitigate the damage and cooperation with the authority.
How a complaint is filed
The complaint is filed at the AEPD's electronic office, identifying the sender and providing the email with its headers. The AEPD may close the file, issue a requirement to the sender, open preliminary proceedings or open penalty proceedings. The complainant is not a party to the proceedings, but is notified of the decision.
AEPD practice
The AEPD publishes its decisions on its website. In the field of commercial email, the decisions frequently penalise sending to addresses obtained from websites, directories or purchased databases without consent, and the absence of an effective means to object. The actual fines are graded in each case according to the criteria above.
Other consequences
Beyond the administrative penalty, the sender is exposed to the damages claim under article 82 of the GDPR, to abuse reports before its sending, hosting and registrar providers, and to inclusion on anti-spam blocklists, with the loss of deliverability that entails.