Failure to respond to a request for information from a supervisory authority constitutes a violation of its investigative powers, even in the absence of a breach on the merits of the initial case.

Facts and context

The Spanish Data Protection Authority (AEPD) published a decision declaring an infringement against the Extremadura Health Service (SES) for a failure related to its obligation to cooperate in the context of an investigation.

The case originated from a complaint filed against the SES, which led the authority to exercise its investigative powers.

Reasons for the decision

• Obligation to cooperate with the supervisory authority (Article 58 of the GDPR): The authority found that the SES did not respond within the deadlines to one of the multiple requests for information addressed to it during the investigation of the complaint. The AEPD considered that this failure to respond constituted an obstruction to the exercise of its investigative powers, as defined in Article 58(1) of the GDPR. The authority dismissed the SES's arguments regarding internal confusion, judging that these did not justify non-compliance with its obligations. This infringement is specifically targeted by Article 83(5)(e) of the GDPR.

Decision of the authority

Consequently, the authority declared that the Extremadura Health Service committed an infringement of Article 58(1) of the GDPR.

Furthermore, the authority ordered the notification of its decision to the Ombudsman and decided to make it public.

Lessons learned

This decision reminds that:

• The obligation to cooperate with the supervisory authority is mandatory and failure to respond to a request for information constitutes an infringement in itself.
• A formal infringement, such as failure to meet a response deadline, can be sanctioned independently of the existence of a material breach of data protection rules in the original case.
• Internal organizational difficulties or confusion about the identity of the data controller do not constitute a valid excuse for not responding to requests from a supervisory authority.
• Supervisory authorities have extensive investigative powers under Article 58 of the GDPR, and any obstruction to the exercise of these powers is liable to sanction.