The Spanish data protection authority sanctioned a company for failing to respond to its information requests, emphasizing that obstruction of investigative powers constitutes a serious violation of the GDPR.

Facts and context

The Spanish data protection authority (AEPD) today published a sanction decision against MONUMENTAL FORMA SPORT, S.L. (including the imposition of a €10,000 fine) for breaches related to its obligation to cooperate during an investigation.

The case originated from a complaint filed against the company, which led the authority to initiate formal investigations.

Grounds for the decision

• Obligation to cooperate with the supervisory authority and provide access to information (Article 58(1) of the GDPR): The authority found that the company, despite being notified several times electronically and by post, did not provide any of the requested information during the investigation. By doing so, it obstructed the investigative powers granted to the authority by the GDPR. The authority emphasized that this obstruction prevents the effective enforcement of the regulation and the protection of data subjects' rights, constituting a direct violation of its obligations.

Authority's decision

Consequently, the authority imposed a €10,000 fine on MONUMENTAL FORMA SPORT, S.L.

Furthermore, the authority ordered the company to provide, within twelve working days from the enforceability of the decision, all the information requested during the investigation.

Lessons learned

This decision confirms / clarifies / recalls that:

• The obligation to cooperate with a supervisory authority is an autonomous obligation and its non-compliance constitutes a separate infringement, regardless of the merits of the initial complaint.
• Ignoring information requests from an authority, even after multiple notification attempts through different channels, is considered deliberate obstruction of its investigative powers.
• Obstructing an authority's investigations is classified as a serious infringement because it undermines its fundamental mission to oversee the application of the GDPR and protect individuals' rights.
• The absence of response or allegations from a company during the sanction procedure may lead the authority to consider its proposed resolution as final.