The Spanish data protection authority sanctions a company for failing to respond to a request to exercise the right of access, following a cross-border complaint initiated in Italy.

Facts and context

The Spanish data protection authority (AEPD) has today published a sanction decision against TELECONTACT LIST S.L. (including the imposition of a fine of €1,000) for breaches related to the respect of data subjects' rights.

The case originated from a complaint filed in Italy by a natural person who did not receive a response to their request for access to their personal data, a complaint which was then forwarded to the AEPD via the European cooperation system.

Grounds for the decision

The authority found a main breach against the company:

• Obligation to respond to access requests (Article 15 of the GDPR): The authority found that the company did not respond to the request to exercise the right of access made by the complainant on 1 March 2023. By providing no response, the company failed in its obligation to facilitate the exercise of the data subject's rights and to provide the information required by the GDPR. The AEPD, acting as the lead authority in this cross-border complaint, concluded that this lack of response constituted a direct violation of the obligations imposed on the controller.

Authority's decision

Consequently, the authority imposed a fine of €1,000 on TELECONTACT LIST S.L. However, the company benefited from a 40% reduction for acknowledgment of responsibility and voluntary payment, reducing the amount paid to €600.

Furthermore, the authority ordered the company to respond to the complainant's access request and to provide proof of this response within 30 days.

Lessons learned

This decision reminds that:

• Any request to exercise rights, regardless of its origin, must be handled diligently and receive a response within the prescribed time limits, with a total lack of response constituting a clear violation.
• A complaint filed with a supervisory authority of another Member State may be forwarded to the competent authority via the cooperation mechanism and lead to local sanction proceedings.
• The obligation to respect data subjects' rights applies to all controllers, regardless of their size or turnover (here, €950,504 in 2022).
• Mechanisms for acknowledgment of responsibility and voluntary payment can allow a significant reduction of the fine amount, constituting a strategic option to consider in case of proceedings.