The Spanish authority fines a company €76,800 for failing to respond to its information requests, thereby obstructing its investigative powers.

Facts and context

The Spanish Data Protection Agency (AEPD) has today published a sanction decision against AECORP 005, S.L. (including the imposition of a €76,800 fine) for breaches related to its obligation to cooperate with the supervisory authority.

This case originated from a complaint that led the authority to send several information requests to the company to investigate the file.

Grounds for the decision

• * Obligation to cooperate with the supervisory authority (Article 58(1) of the GDPR): The authority found that the company did not respond within the deadlines to its information requests, sent repeatedly as part of the investigation of a complaint. By not providing the required information, the company obstructed the authority's investigative powers. This breach constitutes a violation of the obligation to provide access to all information necessary for the performance of its task, qualified by the authority as an infringement under Article 83(5)(e) of the GDPR.

Decision of the authority

Consequently, the authority imposed a fine of €76,800 on AECORP 005, S.L.

Lessons learned

This decision reminds that:

• The obligation to cooperate with a supervisory authority under Article 58 of the GDPR is a strict requirement and non-compliance constitutes an infringement in itself.
• Failure to respond to information requests from a supervisory authority within the prescribed deadlines is considered an obstruction to its investigative powers.
• Failure to provide access to information requested by a supervisory authority exposes the data controller to administrative fines of up to €20 million or 4% of the global annual turnover, pursuant to Article 83(5)(e) of the GDPR.
• The obligation to respond to a supervisory authority is independent of the merits of the initial complaint; obstruction of the investigation can be sanctioned autonomously.