Published on · RedData Legal
What article 21 says
Article 21.1 of Spanish Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE) prohibits sending advertising or promotional communications by email or any equivalent electronic means that were not previously requested or expressly authorised by their recipients. It is the Spanish rule that transposes article 13 of Directive 2002/58/EC (the ePrivacy Directive).
The rule is prior consent ("opt-in"): save for the exception in paragraph 2, whoever sends commercial email needs the recipient to have requested or expressly authorised it before sending. Offering an unsubscribe link ("opt-out") in the email itself is not enough.
What a commercial communication is
The LSSI-CE defines a commercial communication as any form of communication aimed at promoting, directly or indirectly, the image or the goods or services of a company, organisation or person carrying out a commercial, industrial, artisanal or professional activity. It therefore covers prospecting emails ("cold email"), service presentations, invitations to sales meetings and promotional newsletters, even when they contain no specific offer.
The exception in paragraph 2
Article 21.2 allows sending without prior consent when three conditions are met at the same time:
- There is a prior contractual relationship between sender and recipient.
- The contact details were lawfully obtained in the context of that relationship.
- The communication concerns the sender's own products or services similar to those that were contracted.
In addition, the sender must offer in every communication a simple, free means to object. A first commercial contact with a company that has never contracted anything does not fall within this exception.
Who it protects
The LSSI-CE defines the recipient as the natural or legal person who uses an information society service. The prohibition in article 21 therefore protects both individuals and companies: unsolicited commercial email sent to a corporate mailbox is also prohibited. Where the address identifies a person (firstname.lastname@company.com), the protection of the General Data Protection Regulation applies as well.
Related obligations
- Article 20: commercial communications must be clearly identifiable as such and identify the natural or legal person on whose behalf they are made.
- Article 22: the recipient may revoke consent at any time, and the sender must provide simple, free procedures to do so.
What happens on breach
Sending unsolicited commercial communications is a minor infringement (article 38.4.d), punishable with a fine of up to €30,000, and a serious infringement (article 38.3.c) where the sending is massive or more than three communications are sent to the same recipient within a year, with a fine of €30,001 to €150,000. The Spanish Data Protection Agency (AEPD) is the authority competent to investigate and impose penalties (article 43). Independently of the administrative penalty, the recipient may claim out of court against the sender and, where appropriate, go to the civil courts.