Spanish DPA fines Securitas Direct EUR 100,000 for directing data subjects to chargeable number for rights exercise
Original title: The Spanish DPA fined Securitas Direct EUR 100 000 for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number
The Spanish Data Protection Authority (AEPD) imposed a EUR 100,000 fine on Securitas Direct for directing data subjects to a chargeable 902 telephone number to exercise their rights of access and objection, contrary to GDPR requirements. The use of a paid number to access data subject rights violates Article 12(2) GDPR, which requires controllers to facilitate the free exercise of these rights and may discourage individuals from exercising them. The AEPD ordered Securitas Direct to replace the non-compliant notices within 12 months to ensure free access to these rights.
What changed
- Spanish DPA fined Securitas Direct EUR 100,000 for charging data subjects to exercise their rights via Article 12(2) GDPR violation
- Use of chargeable 902 telephone number for access and objection rights found to impose unlawful costs on data subjects despite free alternatives being available on website
- Corrective measure imposed requiring replacement of all notices referring to the chargeable number within 12 months to comply with GDPR
Who is affected
Controllers in the EU, particularly those directing data subjects to paid channels for exercising rights under Articles 15-22 GDPR (access, rectification, erasure, objection); any organization using phone-based access methods for data subject requests
Summary generated by a language model; the official text prevails. Not legal advice.