Spanish DPA fines Securitas Direct EUR 100,000 for charging data subjects to exercise rights
Original title: The Spanish DPA fined Securitas Direct EUR 100 000 for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number
The Spanish Data Protection Authority (AEPD) fined Securitas Direct EUR 100,000 for directing data subjects to a paid 902 telephone number to exercise their rights of access and objection, in violation of Article 12(2) GDPR. Controllers must ensure data subject rights are exercisable free of charge, and directing individuals to a chargeable phone line discourages the exercise of rights even when other free channels exist. Securitas Direct has 12 months to replace the non-compliant notices and bring them into alignment with GDPR requirements.
What changed
- Spanish DPA (AEPD) found Article 12(2) GDPR infringement: Securitas Direct directed data subjects to a chargeable 902 telephone number to exercise rights of access and objection under Articles 15-22 GDPR, contrary to the requirement that such rights be exercisable free of charge
- Administrative fine of EUR 100,000 imposed on Securitas Direct under Article 83(5)(b) GDPR penalties
- Compliance order issued: Securitas Direct must replace within 12 months all notices referring to the 902 chargeable telephone number to bring them into compliance with GDPR
Who is affected
Data protection authorities, controllers in all sectors (particularly those providing services), and data subjects seeking to exercise rights under GDPR—especially relevant to companies using third-party telecommunications channels for rights requests
Summary generated by a language model; the official text prevails. Not legal advice.