The National Authority for the Protection of Personal Data ('ANPD') announced, on 14 December 2021, that it had issued, on 7 December 2021, a Directorial Resolution No. 3439-2021-JUS / DGTAIPD-DPDP, in which it imposed a fine of 28.13 tax units, which is the equivalent of PEN 120,959 (approx. € 26,370), to Oncosalud S.A.C., for committing the offence listed in Article 132.2(b) of the Supreme Decree No. 003-2013-JUS which Approves the Regulation of Law No. 29733 ('the Regulation') regarding unsolicited marketing calls, following a complaint regarding unsolicited marketing calls.

Background to the resolution

In particular, the ANPD noted that the resolution was issued as a result of the claim presented by a citizen regarding unsolicited marketing calls and their request of cancellation of their personal telephone number in the database of Oncosalud. Furthermore, the ANPD detailed that Oncosalud contracted a company, linked to its economic group, which provides sales services for its products, and subsequently, the latter subcontracted the service to a call centre which made the marketing calls to the complainant. 

Findings of the ANPD

In this context, the ANPD pointed out that this subcontracting does not exempt Oncosalud from its responsibilities towards its customers and their rights. In particular, the ANPD explained that Oncosalud is to be considered as the data controller and has the primary obligation to preserve the lawfulness of the processing of personal data, since processing is necessary to meet its interests, and must therefore diligently exercise control over it and be able to demonstrate such control at all times. Therefore, the ANPD stated that Oncosalud committed the infringement set out in Article 132.2(b) of the Regulation for processing personal data without the free, express, unambiguous, prior, and informed consent of the data subject.

Outcomes 

The ANPD imposed the aforementioned fine and ordered Oncosalud to:

• implement corrective measures regarding the activity of its subcontractors, especially regarding their marketing strategy; and
• strengthen the communication with its third-party subcontractors regarding their consumers' exercise of their rights, with the goal of demonstrating its compliance throughout the process according to the accountability principle.

Lastly, the ANPD conceded 55 days to comply with its orders and stated that an appeal may be lodged against the resolution within 15 days following its execution.

You can read the press release here and the resolution here, both only available in Spanish.