You are here:

Spain / Spanish Supreme Court / 2031/2020


Deciding Body type:
National Court/Tribunal
Deciding Body:
The Spanish Supreme Court
Decision date:
Key facts of the case:

The facts refer to the sanctioning procedure PS/00315/2018, initiated by the Spanish Data Protection Agency against the entity MIRACLIA TELECOMUNICACIONES, S.L., in view of the complaint filed by A.A.A. The complainant, owner of a certain telephone line, denounced that between 14 and 19 March 2018 she had received calls on her mobile phone with the aim of playing a prank on her through the application called "JUASAPP" owned by MIRACLIA TELECOMUNCIACIONES SL, an application that can be downloaded through Google Play. The complainant sent e-mails to MIRACLIA on 16/03/2018 requesting to be provided with the person who, without a supermarket number, had used her mobile phone number to play tricks on her through the JUASSAP application. The accused replied that she had received the jokes because a friend or acquaintance with her number was a JUASAPP user. The complainant provided a printout of the telephone lines from which calls are made between these dates. As indicated in the terms and conditions of use of the service (TCU), JUASAPP is an application that allows the user who has downloaded it to send jokes to a third party, giving the mobile phone number to the application. Through a pre-recorded audio of the app the joke is sent to the line that was given. The user can select from a list of jokes and indicate the destination, and time you want the recipient to receive the joke. Once the joke has been played, the application can record the joke if the user so wishes, and the user can also share the audio file, as there is a link in the form of a URL that MIRACLIA's systems store and make it possible to share by clicking on the link that is generated. The TCU also states that "the user must have the express consent of the person who has received the joke in order to obtain it and subsequently use it", although it is perfectly possible to play the joke on people and mobile numbers that are known to each other, but not through a relationship of friendship, but through any other. "Privacy Policy Clause 4 indicates that the personal data provided is stored in automated files for which MIRACLIA is responsible" (page 30). Among other data stored is the user's telephone number if he or she uses APPLE's IOS system. There is no information about the person for whom the joke is played, including mobile phone numbers, voice, records or reproduction of their voice, at the time the joke was played. There is no evidence that the reported person offers the possibility, once the prank is made, that the affected person consents to the use of the prank (reproduction, recording, storage in a shared URL), nor is he/she informed at that time that a prank has been played on him/her or of the origin or person from whom his/her data are collected. The only possibility offered in the written form of the TCU is to enter your mobile line in an exclusion list or blacklist after playing the prank.

In its reply of 1 June 2018, the defendant indicated in previous proceedings that no information relating to the complainant's line appeared on the substitute form, not even on the list of blockages so as not to receive any more jokes. Ladenunciada indicated that this list makes it possible for a telephone number to be included so that users cannot send them jokes. If a mobile phone number that has been given before is included on the exclusion list, it cannot be pranked. Among all the numbers listed as those called to make the reported pranks, ORANGE ESPAGNE S.A.U., indicated on 30/05/2018 that the given telephone number in question is associated to the customer IMAGINE800 S.L., and its reference is included in the privacy policy of the JUASAPP application as one of the companies that assists MIRACLIA in the hosting and metrics service in Spain to be able to provide the technical service, although the company stated that it also provides services for others. The defendant indicated that since 25/05/2018 and with the analysis of previous complaints and sanctions by the AEPD, the information clause has changed. Among other measures, she indicated that once the joke has been recorded, if applicable, the URL is stored in the cloud so that it can be shared by the user, who can then send it to another person and listen to it. Having analysed the terms of condition and use extracted from the website of the accused on 19/07/2018, there is no mention of the rights of the person to whom the joke is played, specifically the right not to allow the joke to be reproduced, that it is not carried out, or, on the contrary, the right to information about the origin of their data. Nor is any legitimate basis established for the processing of the data of the person to whom the prank is played. Once these facts were considered proven and the legitimate interest analysed, the Spanish Data Protection Agency concluded that the company denounced had committed the data processing breach without consent or the concurrence of legitimate interest that Article 6.2 of the Organic Law on Data Protection presupposes. And resolved to impose on MIRACLIA TELECOMUNICACIONES, S.L. for that infringement, classified as serious in Article 44.3.b) of the same Law, a fine of 6 000 euros, in accordance with the provisions of Article 45.1), 2) 4 f) and j) and 5.a) of that Law. MIRACLIA TELECOMUNICACIONES, S.L. filed an administrative appeal against this decision and, subsequently, an appeal in cassation against the decision of the First Section of the Administrative Chamber of the National Court of Justice which rejected the aforementioned administrative appeal.

The cassation appeal in question, filed by the procedural representation of the commercial company MIRACLIA TELECOMUNICACIONES, S.L., is aimed at reversing the judgment of the First Section of the Contentious-Administrative Chamber of the National Court of April 4, 2019,

which dismissed the contentious-administrative appeal 423/2017 filed against the Director's decision of the Spanish Data Protection Agency of 29 May 2017, which imposed on the aforementioned company a fine of 6000 euros, as responsible for the infringement of article 6 of the Organic Law 15/1999, of December 13, Protection of Personal Data, classified as serious in Article 44.3 b) of the cited legal text.

Key legal question raised by the Court:
(i) What should be considered as exclusively personal or domestic data processing for the purpose of their exclusion from the scope of protection provided by the Organic Law 15/1999, of December 13, Protection of Personal Data in accordance with the provisions of Article 2 of this Law -current Article 2.2.a) Organic Law 3/2018 which refers to Article 2.2 of the General Regulations (EU)-. (ii) Under what circumstances (or with what scope) can a person's voice be considered as a personal nature, according to Article 3 the Organic Law 15/1999, in relation to Article 5 of the correspondent Regulation - currently Article 4.1 of the General Regulation (EU). (iii) In what terms should be carried out the weighting provided for in Article 7.f) of Directive 95/46/EC - currently Article 6.1.f) of the General Regulation (EU) - between the legitimate interest of the responsible for the data and the protection of personal data of the interested party.
Outcome of the case:
The Supreme Court rejected MIRACLIA's claim against the ruling of the First Section of the Contentious-Administrative Chamber of the National Court of Justice of 4 April 2019, handed down in contentious-administrative appeal number 423/2017, for the following reasons: 1.- The processing of data carried out by a company within the framework of its commercial activity should not be considered as falling under the exclusion of data protection because of the activities exclusively personal or domestic, although the service provided by the company consists of facilitating a relationship between individuals. 2.- The recording of the voice associated with other data such as the telephone number or making it available to others persons who can identify who it belongs to must be considered as personal data subject to the protection regulations of the automated treatment of the same. 3.- The commercial interests of a company responsible for a data file must yield to the legitimate of the owner of the data in the protection of the same.