The Spanish DPA fined Securitas Direct EUR 100 000 for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number

Background informationDate of final decision: 1 February 2023National caseController: SECURITAS DIRECT, S.A.Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject)Decision: Administrative fine, Compliance orderKey words: Data subject rightsSummary of the DecisionOrigin of the case A consumer association lodged a complaint against Securitas Direct concerning video surveillance notices that directed data subjects to a chargeable 902 telephone number to exercise their rights of access and objection. This was considered to impose a cost on data subjects and to hinder the exercise of their rights.Key FindingsThe use of a chargeable telephone number for the exercise of data subject rights was contrary to the GDPR requirement that such rights be exercisable free of charge and could discourage data subjects from exercising them. The availability of other free channels on the website did not remedy the issue, as t