The Spanish DPA fined Securitas Direct 100 000 EUR for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number
Spanish DPA fines Securitas Direct €100,000 for hindering data subject rights via chargeable phone number.
The Spanish Data Protection Agency (AEPD) has fined Securitas Direct €100,000 for violating GDPR Article 12. The company directed individuals to a chargeable 902 telephone number to exercise their data subject rights, which is contrary to GDPR requirements for free access. Despite offering other free channels, the specific direction to the costly number was deemed a hindrance.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Securitas Direct?
Get an email when a new story names Securitas Direct, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonSecuritas Direct violated GDPR Article 12 by routing individuals seeking to exercise their data subject rights to a chargeable 902 telephone number, effectively creating a financial barrier to rights that must be accessible free of charge. Even though alternative free channels existed, the deliberate direction to a paid number was sufficient for the Spanish DPA to determine that the company made the exercise of rights 'unduly difficult.' This case underscores that GDPR compliance is not only about having compliant processes in theory, but ensuring that every communication channel actively promoted to data subjects meets the regulation's accessibility standards. Organizations must audit all customer-facing touchpoints — not just their policies — to ensure no inadvertent or intentional friction is introduced into the rights-exercise process.