The Spanish authority found a violation of the cooperation obligation against a public body, even if the initial procedure leading to the information requests was declared void.

Facts and context

The Spanish Data Protection Authority (AEPD) has today published a decision finding an infringement against the State Organism of the Labour and Social Security Inspectorate for failing to cooperate with the authority.

The procedure was initiated following a complaint, which led the supervisory authority to send several information requests to the data controller.

Reasons for the decision

• Obligation to provide the information requested by the supervisory authority (Article 58(1) of the GDPR): The supervisory authority sent two formal information requests to the public body on 29 May and 27 June 2025 as part of its investigative duties. The body did not respond to any of these requests within the deadlines. The authority considered that this failure to respond constituted a direct violation of the cooperation obligation, which stems from the powers granted to authorities by the GDPR to carry out their tasks. The body's argument that the initial investigation procedure was void was rejected, the authority considering that the failure to cooperate is a distinct and autonomous infringement, independent of the outcome of the substantive procedure.

Decision of the authority

Consequently, the authority found an infringement of Article 58(1) of the GDPR by the State Organism of the Labour and Social Security Inspectorate. No fine was imposed by the authority, which does not have the power to do so regarding State entities.

Lessons

This decision reminds that:

• The obligation to cooperate with a supervisory authority and to respond to its information requests is an autonomous and imperative obligation for any data controller.
• A failure to comply with this cooperation obligation constitutes an infringement in itself, which can be prosecuted independently of the outcome of the initial procedure that motivated the information request.
• The termination or voiding of a complaint procedure cannot retroactively exempt a data controller from liability for failing to cooperate with the authority's investigation.
• The investigative powers of supervisory authorities, including the right to obtain access to all information necessary for the performance of their tasks, must be scrupulously respected.