The Spanish authority sanctions a company for not responding to its information requests, reminding that failure to cooperate constitutes a separate and serious infringement under the GDPR.

Facts and context

The Spanish Data Protection Authority (AEPD) has today published a sanction decision against the company NEGOCIOS R&R 2020 S.L. including the imposition of a €20,000 fine for breaches related to its obligation to cooperate with the supervisory authority.

This case originated from a complaint that led the authority to conduct investigations and send three successive information requests to the company, which remained unanswered.

Grounds for the decision

• Obligation to cooperate with the supervisory authority (Article 58(1) of the GDPR): The authority found that the company did not respond to any of the three information requests sent during an investigation. The authority emphasizes that these requests were validly notified, including by publication in the Spanish official journal after postal notification failed. By refraining from providing the required information, the company hindered the authority's investigative powers, constituting a violation of the cooperation obligation under the GDPR, an infringement expressly sanctionable under Article 83(5)(e) of the GDPR.

Authority's decision

Consequently, the authority imposed a €20,000 fine on NEGOCIOS R&R 2020 S.L.

Furthermore, the authority ordered the company to provide the initially requested information within ten working days from the date this decision becomes enforceable.

Lessons learned

This decision reminds that:

• Failure to respond to an information request from a supervisory authority constitutes a separate infringement under the GDPR, regardless of the merits of the initial complaint.
• The obligation to cooperate with the supervisory authority, set out in Article 58 of the GDPR, is not optional but a binding legal obligation for every controller.
• Non-compliance with the authority's investigative powers, such as refusal to provide information, is subject to the highest sanctions under the GDPR, which can reach €20 million or 4% of the global annual turnover.
• Controllers must ensure receipt and processing of official communications, including those published in the official journal in case of failed postal notifications, which are considered validly made.