Spanish DPA fines Securitas Direct €100,000 for directing data subjects to chargeable telephone number to exercise right

Original title: The Spanish DPA fined Securitas Direct 100 000 EUR for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number

The Spanish Data Protection Authority (AEPD) fined Securitas Direct €100,000 for directing data subjects to a chargeable 902 telephone number to exercise their rights of access and objection. Article 12(2) GDPR requires controllers to facilitate the free exercise of data subject rights under Articles 15-22; Securitas Direct violated this requirement by making the primary channel for exercising these rights chargeable, potentially discouraging individuals from exercising their rights. The company must replace the non-compliant notices within 12 months to bring them into full GDPR compliance.

What changed

• Controllers must not direct data subjects to chargeable telephone numbers as the primary means of exercising rights of access and objection. The requirement under GDPR Article 12(2) that these rights be exercisable free of charge applies to all channels specified in notices, not just to alternative channels.
• Availability of free alternative channels on a website does not remedy an infringement if the notices specifically refer data subjects to a chargeable number for the same purpose, as this creates a barrier to rights exercise.
• Corrective measures may include removal or replacement of notices and communications that direct data subjects to chargeable contact methods within a specified timeframe (12 months in this case).

Who is affected

Controllers in the EU, particularly those operating in sectors like security services that rely on video surveillance notices, must ensure all contact methods specified for exercising data subject rights are provided free of charge. All sizes and types of organizations are affected, regardless of whether free channels exist elsewhere.

Summary generated by a language model; the official text prevails. Not legal advice.