Spanish DPA fines Securitas Direct €100,000 for charging phone line for data subject rights

What happened

The Spanish Data Protection Agency (AEPD) issued a final decision on 1 February 2023 finding Securitas Direct in breach of GDPR Article 12(2) by directing data subjects to a chargeable 902 telephone number to exercise their rights. The agency imposed a fine of 100 000 EUR and ordered the company to replace the notices within 12 months. The decision confirms that data subject rights must be exercisable free of charge.

Penalty

imposed a fine of 100 000 EUR on Securitas Direct

Why it matters for trust and compliance

• Its status is decided. The case has an outcome that others may cite.
• The enforcement underscores that charging fees for exercising GDPR data subject rights is prohibited.
• Takes effect February 1, 2023.
• Compliance deadline February 1, 2024.
• Penalty: imposed a fine of 100 000 EUR on Securitas Direct.
• It relates to GDPR. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Confirm access, correction, deletion and opt-out requests are handled within the required time.