The Spanish authority sanctions a natural person for failing to respond to its information requests, emphasizing that obstruction of investigative powers constitutes a serious violation of the GDPR.

Facts and context

The Spanish Data Protection Agency (AEPD) has today published a sanction decision against A.A.A. (including the imposition of a 300 € fine) for breaches related to their obligation to cooperate with the supervisory authority.

The case originated from a complaint that led the authority to open an investigation and send several information requests to the individual concerned.

Grounds for the decision

• Obligation to cooperate with the supervisory authority (Article 58(1) of the GDPR): The authority sent three successive information requests to A.A.A. as part of its investigation. Although these requests were notified in accordance with applicable administrative procedures, A.A.A. provided no response. The AEPD considered that this lack of cooperation hindered the exercise of its investigative powers, which are conferred by the GDPR to supervise the application of the regulation and protect individuals' rights. This breach is specifically qualified as an infringement by Article 83(5)(e) of the GDPR.

Authority's decision

Consequently, the authority imposed a fine of 300 € on A.A.A.

Furthermore, the authority ordered A.A.A. to provide, within ten working days from the date the decision becomes enforceable, the information that had been requested during the investigation.

Lessons learned

This decision reminds that:

• The obligation to cooperate with the supervisory authority, notably by responding to its information requests, is an autonomous obligation whose non-compliance constitutes a distinct and punishable infringement.
• Failing to provide information requested by a supervisory authority is considered an obstruction to its investigative powers and constitutes a serious infringement, classified among those subject to the highest sanctions provided by the GDPR.
• Failure to respond to an information request is sanctionable as soon as the supervisory authority can prove that the notification was validly made, even if initial attempts were unsuccessful.