The Spanish DPA fined Securitas Direct 100 000 EUR for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number

A consumer association lodged a complaint against Securitas Direct concerning video surveillance notices that directed data subjects to a chargeable 902 telephone number to exercise their rights of access and objection. This was considered to impose a cost on data subjects and to hinder the exercise of their rights. The use of a chargeable telephone number for the exercise of data subject rights was contrary to the GDPR requirement that such rights be exercisable free of charge and could discourage data subjects from exercising them. The availability of other free channels on the website did not remedy the issue, as the notice specifically referred data subjects to the 902 telephone number for this purpose. The Spanish DPA (AEPD) found an infringement of Article 12(2) GDPR, which requires controllers to facilitate the exercise by data subjects of their rights under Articles 15 to 22 GDPR. The Spanish DPA (AEPD) imposed a fine of 100 000 EUR on Securitas Direct for infringing Article 12 GDPR and ordered the company, as a corrective measure, to replace within 12 months the notices referring to the 902 telephone number in order to bring them into compliance with the GDPR.