The Spanish authority sanctions a company for providing a non-functional email address, which prevented a data subject from exercising their right to erasure.

Facts and context

The Spanish Data Protection Authority (AEPD) has today published a sanction decision against DISTRIBUTED ENERGY ASSETS, S.L. (including the imposition of a €5,000 fine) for breaches related to the exercise of the right to erasure.

The case originated from a complaint by a person who was unable to exercise their right to erasure with the company because the email address provided for this purpose was invalid.

Grounds for the decision

• Obligation to respect the right to erasure (Article 17 of the GDPR): The authority found that the complainant, after cancelling a photovoltaic panel installation service, attempted to exercise their right to erasure using the email address indicated in the contract. However, the attempt failed, with the mail server returning an error message stating that the address was not found or could not receive messages. The authority considered that providing a non-functional contact method for exercising rights constitutes a direct obstruction to the right to erasure, making its exercise impossible and thus violating the controller's obligations.

Decision of the authority

Consequently, the authority imposed a €5,000 fine on DISTRIBUTED ENERGY ASSETS, S.L.

Furthermore, the authority ordered the company, within one month from the date the decision becomes enforceable, to comply with the complainant's erasure request and to set up a valid and functional email address to receive rights exercise requests.

Lessons learned

This decision reminds that:

• Providing a channel for exercising rights (such as an email address) must be effective; an invalid or non-functional address is equivalent to the absence of a means and constitutes an obstruction to the exercise of rights.
• The obligation to facilitate the exercise of data subjects' rights requires the controller to actively verify and maintain the functionality of communication channels provided for this purpose.
• Obstructing the exercise of the right to erasure, including through technical obstacles such as a faulty contact address, constitutes a direct violation of Article 17 of the GDPR.
• Failure to respond to the supervisory authority's requests and lack of cooperation during the investigation are factors that may be held against the controller.