Sanctions in Spain for Unsolicited Electronic Commercial Communications

Clarification of the Conduct: Unsolicited Communications According to Spanish Law

Spanish law prohibits sending electronic commercial communications without express consent from the recipient. Article 21.1 of the Law on Information Society Services and Electronic Commerce, published in the Official State Bulletin of Spain on 12 July 2002, prohibits The sending of advertising or promotional communications by electronic mail or other equivalent means of electronic communication that have not been previously requested or expressly authorized by the recipient.

Therefore, it is necessary to clarify the concept of consent applied to these cases and refer to Article 3 h) of Law 15/1999 of 13 December 1999 on Personal Data Protection, which defines consent of the person as Any manifestation of the will, freely given, unequivocal, specific and informed, through which the person consents to the processing of personal data concerning him.

According to the wording of that article, any commercial information transmitted by electronic means to the recipient without a prior express request from the recipient is considered as lacking the recipient’s consent. This need to obtain the recipient’s prior consent for sending commercial electronic communications is widely known as the “opt-in” principle and is also the result of the transposition of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002.

Finally, it is also important to note an exception to this principle expressly incorporated in Article 21.2 on the Law of the Information Society Services and Electronic Commerce, which eliminates the need for the explicit request of the person concerned when three conditions are met: (i) the existence of a prior contractual relationship between the sender and receiver of the electronic commercial communications, (ii) the lawful obtainment of the recipient’s contact data and (iii) the commercial communication informs the recipient about products or services of the business that are similar to those which were initially contracted with the recipient.

Consequences: Sanctions in Spain for Sending Unsolicited Commercial Communications

Under Law 34/2002 on Information Society Services and Electronic Commerce (LSSI), the penalties for violation of the law vary depending on the severity of the offence.

Serious offences correspond to the massive sending of commercial communications or the insistent or systematic sending of over three commercial communications to one recipient within a year. In principle, the sanctions can reach fines between 150,001 and 600,000 euros, although generally various circumstances may reduce this amount.

Minor offences are electronic commercial communications that do not meet the requirements outlined in Article 21 of the LSSI and would not qualify as serious offences. In such cases, fines can reach 30.000 euros.

Finally, for purely illustrative purposes, it should be noted that the Spanish Data Protection Agency, the public body responsible for ensuring compliance with the legislation on data protection in Spain, has identified more than 10.600 claims for 2013 and established penalties of 22.39.440 euros for the same period.

If you need additional information,