Duyurular

The Spanish Data Protection Authority Fined Securitas Direct EUR 100,000 for Making Mthe Exercise of Data Subject Rights More Difficult

Kişisel Verilerin Korunması Hukuku, Data Protection Law

 

On 22 September 2026, the European Data Protection Board ("EDPB") published a news item on a decision of the Spanish Data Protection Authority (Agencia Española de Protección de Datos, "AEPD"). In that decision, the AEPD fined SECURITAS DIRECT, S.A. ("Securitas Direct") EUR 100,000 for breaching the General Data Protection Regulation ("GDPR").

The proceedings began with a complaint from a consumer association. The association stated that Securitas Direct's video surveillance notices told individuals to use a chargeable "902" telephone number to exercise their rights of access and objection. Free channels for exercising these rights were available on the company's website, but the notices pointed specifically to the paid number.

In its decision dated 1 February 2023, the AEPD made the following findings:

  • Directing data subjects to a chargeable telephone number imposed a cost on them and could discourage them from exercising their rights.

  • Having free channels on the website did not cure the breach, because the notices themselves promoted the paid line.

  • This practice breached Article 12(2) GDPR, which requires controllers to facilitate the exercise of data subject rights.

  • The AEPD imposed an administrative fine of EUR 100,000 under Article 83(5)(b) GDPR.

  • Securitas Direct was also ordered to bring its video surveillance notices into compliance within 12 months.

The decision demonstrates that compliance with data subject rights extends beyond merely responding to requests. Controllers must also ensure that the means provided for exercising such rights do not create unnecessary barriers to their exercise.

In this regard, Article 12(2) GDPR requires controllers to facilitate the exercise of data subject rights and to provide the relevant communications in a concise, transparent, intelligible and easily accessible form. The AEPD's decision demonstrates that directing individuals to a chargeable telephone number may be considered contrary to this obligation where the cost associated with the channel may discourage individuals from exercising their rights, even where other free channels are available.

Controllers should therefore:

  • Review their privacy notices, video surveillance signs and other information materials to confirm that the channels offered for exercising data subject rights are free and easy to access;

  • Make sure that every channel they point to, not only some of them, meets the requirements of Article 12 GDPR; and

  • Keep their data subject request processes simple, consistent and free of unnecessary cost or effort.

The EDPB news item is available here, and the full text of the AEPD decision (in Spanish) is available here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr

All information and documents on our website have been prepared by Zümbül Law & Consultancy solely for general informational purposes, in accordance with the Attorneyship Law, other relevant legislation and the Professional Rules of the Union of Turkish Bar Associations. These publications serve no advertising or commercial purpose whatsoever. All information and documents on our website are general in nature, and no guarantee or undertaking is given that they are complete, accurate, up to date or reliable. No one should act on the information and documents in these publications without first consulting a lawyer or expert. The links in our publications are taken from publicly available sources and are provided only to help visitors reach other information and documents. These links do not in any way constitute a recommendation or endorsement of the persons, institutions or organisations linked to. The publications on our website do not constitute legal advice, and accessing our website in any way does not create an attorney-client relationship. All content on our website is the property of Zümbül Law & Consultancy and may not be copied, reproduced or used without attribution and prior written permission.