The Spanish Data Protection Agency (AEPD) issued a final decision on 1 February 2023 finding Securitas Direct in breach of GDPR Article 12(2) by directing data subjects to a chargeable 902 telephone number to exercise their rights. The agency imposed a fine of 100 000 EUR and ordered the company to replace the notices within 12 months. The decision confirms that data subject rights must be exercisable free of charge.
Why it matters: The enforcement underscores that charging fees for exercising GDPR data subject rights is prohibited.
Summary generated from the sources below. Check the primary source before relying on it; this is not legal advice.
