The Spanish DPA fined Securitas Direct 100 000 EUR for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number
Spanish DPA fines Securitas Direct €100,000 for hindering data subject rights via chargeable phone number.
Summary
The Spanish Data Protection Agency (AEPD) has fined Securitas Direct €100,000 for violating GDPR Article 12. The company directed individuals to a chargeable 902 telephone number to exercise their data subject rights, which is contrary to GDPR requirements for free access. Despite offering other free channels, the specific direction to the costly number was deemed a hindrance.
Full text
The Spanish DPA fined Securitas Direct 100 000 EUR for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number National News 22 September 2026 es Background informationDate of final decision: 1 February 2023National caseController: SECURITAS DIRECT, S.A.Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject)Decision: Administrative fine, Compliance orderKey words: Data subject rightsSummary of the DecisionOrigin of the case A consumer association lodged a complaint against Securitas Direct concerning video surveillance notices that directed data subjects to a chargeable 902 telephone number to exercise their rights of access and objection. This was considered to impose a cost on data subjects and to hinder the exercise of their rights.Key FindingsThe use of a chargeable telephone number for the exercise of data subject rights was contrary to the GDPR requirement that such rights be exercisable free of charge and could discourage data subjects from exercising them. The availability of other free channels on the website did not remedy the issue, as the notice specifically referred data subjects to the 902 telephone number for this purpose.DecisionThe Spanish DPA (AEPD) found an infringement of Article 12(2) GDPR, which requires controllers to facilitate the exercise by data subjects of their rights under Articles 15 to 22 GDPR. The infringement is subject to the penalties laid down in Article 83(5)(b) GDPR.The Spanish DPA (AEPD) imposed a fine of 100 000 EUR on Securitas Direct for infringing Article 12 GDPR and ordered the company, as a corrective measure, to replace within 12 months the notices referring to the 902 telephone number in order to bring them into compliance with the GDPR.For further information: Sanctioning Procedure Decision – SECÚRITAS DIRECT ESPAÑA, S.A.U. (Spanish – ES) Relevant topics Fines Latest news RSS Feed EDPB News EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines21 September 2026 National News fr Failure to respect the rights of individuals: The CNIL fined EXTIA 300 000 EUR11 September 2026 National News fr Health data breach: the CNIL fined Hôpital Privé de la Loire 500 000 EUR09 September 2026All news