Providing non-functional email addresses for the exercise of rights, making any erasure request impossible, constitutes a violation of the obligation to facilitate the exercise of the right to erasure.

Facts and Context

The Spanish data protection authority (AEPD) has today published a sanction decision against MONUMENTAL FORMA SPORT, S.L. (including the imposition of a €6,000 fine) for breaches related to the exercise of the right to erasure.

The case originated from a complaint filed on 13 September 2024, following the data subject's inability to obtain the deletion of their data due to non-functional contact email addresses.

Reasons for the Decision

• Obligation to guarantee the right to erasure (Article 17 of the GDPR): The authority found that the company obstructed the exercise of the right to erasure. Indeed, the complainant attempted several times, on 5 February, 8 February, and 20 March 2024, to contact the company to request the deletion of their data, but all attempts resulted in email delivery failures. The contact address indicated in the privacy policy for exercising rights was found to be non-operational. The authority concluded that failing to provide a valid and effective communication channel to receive data subject requests rendered the right to erasure illusory, thus constituting a violation of Article 17 of the GDPR.

Authority's Decision

Consequently, the authority imposed a €6,000 fine on MONUMENTAL FORMA SPORT, S.L.

Furthermore, the authority ordered the company to take, within one month from the date the decision becomes enforceable, the following corrective measures: to comply with the complainant's erasure request and to establish a valid and functional email address for the exercise of rights.

Lessons Learned

This decision reminds that:

• Communication channels designated for the exercise of data subject rights, such as an email address, must not only be indicated but also maintained in effective working order.
• Failing to provide a valid contact means constitutes an obstruction to the exercise of rights and is punishable in the same way as a refusal to comply with a request.
• It is imperative to regularly verify and test the functionality of contact points mentioned in privacy policies and information notices.
• Failure to respond or cooperate with the supervisory authority during an investigation may be considered an aggravating factor in sanction assessment.