The Spanish Data Protection Agency (AEPD) has today published a sanction decision against the Temporary Business Union GRÚAS SEVILLA, including the imposition of a 10,000 € fine, for breaches related to its obligation to cooperate with the supervisory authority.

Facts and Context

This case originated from a complaint, during the investigation of which the company did not respond to the authority's requests for information.

Grounds for the Decision

• Obligation to cooperate with the supervisory authority (Article 58(1) of the GDPR): The authority reproaches the company for not providing the information it requested twice within the scope of its investigative powers. Although notifications were made in accordance with applicable procedures, one having been formally received, the company did not provide any response. This lack of cooperation constitutes a direct obstruction to the exercise of the supervisory authority's tasks and a violation of the obligation to provide access to all information necessary for the performance of its mission.

Authority's Decision

Consequently, the authority imposed a fine of 10,000 € on the Temporary Business Union GRÚAS SEVILLA.

Furthermore, the authority ordered the company to provide the initially requested information within ten working days from the moment the decision becomes enforceable.

Lessons Learned

This decision reminds that:

• The obligation to cooperate with a supervisory authority is an autonomous obligation, the breach of which can be sanctioned independently of the merits of the initial complaint.
• Ignoring requests from a supervisory authority, including by not withdrawing electronic notifications, does not suspend the procedure and constitutes a strategy that worsens the data controller's situation.
• Failure to respond to a supervisory authority's request for information is a serious infringement, punishable by administrative fines of up to 20 million euros or 4% of the annual global turnover.
• The imposition of a fine for non-cooperation does not extinguish the obligation to provide the information; the authority may also accompany its sanction with an injunction to communicate the requested elements.