About the date, first of all
The decision has been final since 1 February 2023 and was published in the European register on 22 September 2026. This is not a new line: it is a line that has just become visible. Worth saying, because an old decision freshly circulated is sometimes cited as if it were a recent turn, and it is not.
TL;DR
A consumer association complained about Securitas Direct's CCTV notices, which directed data subjects to a chargeable telephone number — a 902 — to exercise their rights of access and objection. The Spanish authority found an infringement of Article 12(2) GDPR, subject to the penalties in Article 83(5)(b), imposed a fine of one hundred thousand euro and ordered the notices replaced within twelve months. The decisive point: having other free channels on the website did not cure the infringement, because it was the notice that pointed to the paid number.
Facilitating is not permitting
Article 12(2) requires the controller to facilitate the exercise of the rights in Articles 15 to 22. It is an active verb and it is the centre of this case: it is not enough that the right can be exercised, the route must not get in the way. A chargeable number introduces a cost — small, but a cost — at the precise moment a person decides whether to complain or let it go, and that friction acts on whoever is least sure.
The reasoning has a second edge that concerns any controller: the channel you advertise is the one that counts. Securitas Direct had free routes, but the notice — the document a person reads just as they are being filmed — pointed to the paid number. Someone reading the sign is not going to go and check whether a better alternative exists somewhere else.
- Review the SIGNS, not just the privacy notice: the first-layer sign is where an old number, a premium-rate line or a sales switchboard tends to survive.
- Check what the numbers shown actually cost: in Spain 902 numbers are premium-rate; the equivalent elsewhere is any line that is not free from a mobile.
- Having a free mailbox on the website does not fix a paid channel advertised somewhere else. The fix goes through changing what is advertised.
- The corrective measure came with a deadline: twelve months to replace the notices. A compliance deadline is also a verification date — put it in the client file.
- The same test reaches forms that force registration, those asking for an ID copy without need, and those requiring the use of an app.
Where to look tomorrow
List every point from which a data subject can ask your clients for something: CCTV sign, website footer, privacy notice, contract, invoice, email signature, switchboard message. Check which of those channels costs money or disproportionate time. There is almost always a forgotten one, and it is almost always a phone number.
The amount — one hundred thousand euro — matters less than the logic. What was penalised was not a refusal to answer anyone: it was the design of the route. And the design of the route is exactly the part that gets reviewed once and then stays for ten years on a sticker beside the door.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
