Background information

• Date of final decision: 1 February 2023
• National case
• Controller: SECURITAS DIRECT, S.A.
• Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject)
• Decision: Administrative fine, Compliance order
• Key words: Data subject rights

Summary of the Decision

Origin of the case  

A consumer association lodged a complaint against Securitas Direct concerning video surveillance notices that directed data subjects to a chargeable 902 telephone number to exercise their rights of access and objection. This was considered to impose a cost on data subjects and to hinder the exercise of their rights.

Key Findings

The use of a chargeable telephone number for the exercise of data subject rights was contrary to the GDPR requirement that such rights be exercisable free of charge and could discourage data subjects from exercising them. The availability of other free channels on the website did not remedy the issue, as the notice specifically referred data subjects to the 902 telephone number for this purpose.

Decision

The Spanish DPA (AEPD) found an infringement of Article 12(2) GDPR, which requires controllers to facilitate the exercise by data subjects of their rights under Articles 15 to 22 GDPR. The infringement is subject to the penalties laid down in Article 83(5)(b) GDPR.

The Spanish DPA (AEPD) imposed a fine of 100 000 EUR on Securitas Direct for infringing Article 12 GDPR and ordered the company, as a corrective measure, to replace within 12 months the notices referring to the 902 telephone number in order to bring them into compliance with the GDPR.

For further information: 

• Sanctioning Procedure Decision – SECÚRITAS DIRECT ESPAÑA, S.A.U. (Spanish – ES)