BORJAMOTOR, S.A. received a complaint from a customer who expressed their objection to the company's processing of their personal data for direct marketing purposes via email. Despite this objection, the customer continued to receive emails with offers from the company, at a reduced frequency. BORJAMOTOR, S.A. was found to have used a deceptive pattern known as "hard to cancel", which made it difficult for customers to cancel their subscription to the company's marketing emails.
Excerpt
Our analysis
The hard to cancel deceptive pattern, used by BORJAMOTOR, S.A., made it difficult for the complainant to unsubscribe from their marketing emails. Even after the complainant contacted the company multiple times to stop receiving emails, they still received them. Despite this, the company continued to send emails, although at a reduced frequency. This behaviour is a clear violation of the complainant's right to privacy and control over their personal data, as they had explicitly objected to their data being used for direct marketing purposes. The company's contact form, which was used by the complainant to communicate with the company, was not GDPR-compliant as it did not provide a free and specific consent option. When the complainant used the form, they were forced to accept the privacy policy, which included the processing of their personal data for advertising purposes. This type of consent is not considered free or specific under Article 4(11) of the GDPR, as the data subject did not have a real choice in whether to provide consent or not. As a result, the AEPD found the company to have infringed the LSSI by sending commercial communications without the data subject's proper consent.
Outcome
Borjamotor, S.A. was fined by the Spanish DPA (AEPD) for violating Article 7 GDPR and Article 21(1) of the Spanish Law on Information Society Services (LSSI). The AEPD enforced a penalty of €4000 for each infringement against the defendant, resulting in a total fine of €8000. However, the defendant opted to take advantage of the reduction for voluntary payment offered by Spanish administrative law and ultimately paid a fine of €4800.
Parties
Borjamotor, S.A. and A.A.A (data subject)
Case number
PS/00332/2020
Decision
Related deceptive patterns
Hard to cancel (aka "Roach Motel") is a deceptive pattern where it is easy to sign up for a service or subscription, but very difficult to cancel it. This typically involves hiding the cancellation option, requiring users to call customer services to cancel, and making the cancellation process overly complex and time-consuming. This can cause users to give up trying to cancel, and continue paying for the service for a longer period.
Related laws
GDPR - Article 07
EU & UK
Valid consent conditions include being freely given, specific, informed, and unambiguous, and the data subject should be able to withdraw it anytime.
Prohibits the sending of commercial communications by email or other electronic means without the prior consent of the recipient.