What Changed
- The Spanish DPA established an infringement of Article 12 GDPR for making data subject rights exercise chargeable via a 902 phone number.
- A fine of 100,000 EUR was imposed under Article 83(5)(b) GDPR following a complaint by a consumer association.
- Securitas Direct was ordered to replace non-compliant video surveillance notices within 12 months.
Data controllers operating within the European Union must ensure that individuals can exercise their data subject rights free of charge, without being directed to fee-paying channels. The Spanish Data Protection Authority (AEPD) issued an administrative fine of 100,000 EUR against Securitas Direct (SECURITAS DIRECT, S.A. / SECÚRITAS DIRECT ESPAÑA, S.A.U.) for failing to comply with General Data Protection Regulation (GDPR) requirements regarding modalities for exercising data subject rights. In addition to the financial penalty, the authority issued a compliance order requiring the company to update its notices within 12 months.
The case originated from a complaint submitted by a consumer association regarding Securitas Direct's video surveillance notices. These notices directed individuals to a chargeable '902' telephone number if they wished to exercise their rights of access and objection under the GDPR. The AEPD determined that requiring data subjects to use a paid telephone line imposed a financial cost on individuals and created a barrier that hindered the exercise of their legal rights.
Under Article 12(2) of the GDPR, data controllers are obligated to facilitate the exercise of data subject rights under Articles 15 to 22, ensuring that requests can be made free of charge and without unnecessary obstacles. The Spanish DPA highlighted that providing a chargeable telephone number inherently contradicted the requirement for rights to be exercisable free of charge, as it risked discouraging individuals from asserting them. Furthermore, the AEPD clarified that the availability of alternative, free channels on the company's website did not remedy the issue, because the video surveillance notices explicitly directed individuals to the paid 902 phone number for this specific purpose.
Consequently, the AEPD established an infringement of Article 12 GDPR and applied penalties pursuant to Article 83(5)(b) GDPR. The decision underscores that all direct references provided to the public regarding data protection rights must offer cost-free access points. Controllers operating across Spain and the wider EU must review physical and digital information notices to verify that specified pathways for data subject requests contain no financial or procedural impediments.
Who May Be Affected
Data controllers, businesses displaying video surveillance notices, and data subjects seeking to exercise rights in Spain and the EU.
Cross-Border Context
Enforcement of EU General Data Protection Regulation (GDPR) standards regarding free-of-charge exercise of data subject rights by a national supervisory authority in an EU Member State.
What to check next
- Verify the original Spanish-language Sanctioning Procedure Decision regarding SECÚRITAS DIRECT ESPAÑA, S.A.U. on the AEPD website.
- Review internal data subject rights policies and physical notices to ensure designated contact methods involve no end-user costs.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.