Spanish DPA fines Securitas Direct €100,000 for directing data subjects to chargeable phone number for rights exercise

Original title: The Spanish DPA fined Securitas Direct €100,000 for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number

The Spanish Data Protection Authority (AEPD) imposed a €100,000 fine on Securitas Direct for violating Article 12 GDPR by directing data subjects to a chargeable 902 telephone number to exercise their rights of access and objection. The use of a paid phone number to exercise data subject rights is contrary to GDPR requirements that such rights be exercisable free of charge and can discourage individuals from exercising them. The existence of free channels on the website did not remedy the violation, as the surveillance notice specifically referred data subjects to the paid number. Securitas Direct was also ordered to replace the non-compliant notices within 12 months.

What changed

• Securitas Direct is required to cease directing data subjects to chargeable telephone numbers (902 number) in video surveillance notices for exercising rights of access and objection under Articles 15-22 GDPR
• Controllers must ensure that notices and communication directing data subjects to exercise their rights clearly reference free channels only, as charging for the exercise of rights violates Article 12(2) GDPR requirements
• The provision of free alternative channels on a website does not satisfy GDPR compliance if official notices or primary communications still direct individuals to paid contact methods

Who is affected

Data controllers in the EU, particularly those in security and surveillance sectors, who direct data subjects to exercise their rights (access, objection, etc.). The ruling applies broadly to any organization subject to GDPR in the EU.

Summary generated by a language model; the official text prevails. Not legal advice.