Spanish DPA Fines Securitas Direct €100,000 for Chargeable GDPR Hotline
The Spanish Data Protection Agency (AEPD) fined Securitas Direct €100,000 for making it more difficult for individuals to exercise their data protection rights. The case concerned video surveillance notices that directed people to a chargeable 902 telephone number when they wanted to exercise their rights of access or objection.
Under the General Data Protection Regulation (GDPR), individuals must be able to exercise their data subject rights free of charge, subject only to limited exceptions. Controllers must also provide clear information and take practical steps to make these rights easy to use.
The AEPD found that directing individuals to a chargeable telephone number could discourage them from submitting a request. The fact that Securitas Direct also offered free contact methods on its website did not resolve the issue. The notices specifically directed individuals to the 902 number, which meant that the information provided at the point of data collection was not sufficiently compliant with the GDPR.
The authority determined that Securitas Direct had infringed Article 12(2) GDPR. This provision requires controllers to facilitate the exercise of rights under Articles 15 to 22, including the rights of access, rectification, erasure, restriction, data portability, objection, and rights related to automated decision-making.
Alongside the €100,000 administrative fine, the AEPD ordered Securitas Direct to replace the notices that referred to the chargeable number. The company was given 12 months to bring those notices into compliance with the GDPR.
The decision is a useful reminder that organizations should review the actual wording and contact details included in privacy notices, signs, forms, and customer communications. Providing a free channel somewhere on a website may not be enough if another communication directs people to a paid service for exercising their rights.
