Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Spanish DPA Fines Securitas Direct EUR 100,000 for Obstructing Data Subject Rights

The Spanish data protection authority (DPA) fined Securitas Direct 100 000 EUR on 1 February 2023 for making the exercise of data subject rights more difficult. This decision requires the company to replace notices directing individuals to a chargeable telephone number within 12 months to ensure compliance.

A consumer association lodged a complaint against Securitas Direct regarding video surveillance notices that directed data subjects to a chargeable 902 telephone number for exercising their rights of access and objection. The Spanish DPA found this practice imposed a cost on data subjects and hindered the exercise of their rights, contrary to the General Data Protection Regulation (GDPR) requirement that such rights be exercisable free of charge.

The availability of other free channels on the company website did not remedy the issue, as the specific notice referred data subjects to the 902 telephone number. The Spanish DPA therefore found an infringement of Article 12(2) GDPR, which requires controllers to facilitate the exercise by data subjects of their rights under Articles 15 to 22 GDPR. This infringement is subject to penalties laid down in Article 83(5)(b) GDPR. As a corrective measure, Securitas Direct must replace the notices referring to the 902 telephone number within 12 months to ensure GDPR compliance.

Organisations frequently face challenges in ensuring data subject rights are genuinely accessible and free of charge, as evidenced by this 100 000 EUR fine.

Original title: Sanctioning Procedure Decision – SECÚRITAS DIRECT ESPAÑA, S.A.U. (Spanish – ES)

Administrative fine and Compliance order by the Spanish DPA

Who this binds
Securitas Direct SA is legally bound by this administrative fine and compliance order under the GDPR in Spain.
What changed
Securitas Direct must replace notices referring to a chargeable 902 telephone number within 12 months, as ordered by the Spanish DPA.
What to check
Organisations should review their data subject rights request mechanisms to ensure they are genuinely free of charge and easily accessible, particularly for contact methods specified in privacy notices.
What this does not mean
This decision does not mean that all telephone contact numbers for data subjects must be free, but rather that the primary or specified channel for exercising GDPR rights must not impose a cost.

Send this to your team

The Spanish DPA fined Securitas Direct 100 000 EUR and ordered it to replace chargeable telephone numbers for data subject rights requests within 12 months, affecting all organisations processing personal data in the EU.

Today's question

A Spanish DPA fined a company for directing individuals to a chargeable telephone number to exercise their data subject rights. Which of the following GDPR requirements was infringed by this practice?

  1. Controllers must facilitate the exercise of data subject rights free of charge.
  2. Data subjects must be informed of the existence of their rights in a clear and concise manner.
  3. Controllers must respond to data subject requests within one month of receipt.
  4. Data subjects have the right to lodge a complaint with a supervisory authority.

Answer this question on the site

Worth knowing

  1. Dutch DPA Warns Against Filming Others with Camera Glasses

    Organisations should note the Dutch DPA's explicit warning that filming others with camera glasses is almost always prohibited, signalling a strict enforcement stance on wearable technology in public spaces.

  2. OAIC Review Identifies Opportunities to Enhance Transparency

    Organisations operating in Australia should review the OAIC's findings to proactively address transparency gaps and align their practices with the regulator's expectations, particularly concerning data handling and information provision.

  3. IAPP analysis of Brazil's TikTok fine offers insight into LGPD enforcement

    This analysis of the Brazilian ANPD's enforcement action against ByteDance Brazil provides privacy professionals with a deeper understanding of how the LGPD is being applied in practice, particularly regarding children's data.

  4. Data breach at translation vendor affects UnitedHealthcare plan members

    This incident involving United Language Group and UnitedHealthcare plan members demonstrates the critical importance for healthcare organisations of robust vendor risk management programs to protect patient data.

  5. EFF challenges drone flight restriction criminalising recording immigration agents

    The EFF's challenge to the drone flight restriction in the Arizona border zone signals ongoing tension between government surveillance capabilities and the public's right to record official actions.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.