The Spanish authority issued a warning against a company that delayed responding to an access request and then deleted the relevant data before complying, thus obstructing the exercise of the individual's right.

Facts and context

The Spanish Data Protection Authority (AEPD) today published a sanction decision against CONSORWEB, S.L. (including the issuance of a warning) for failures related to handling a request to exercise the right of access.

The case originated from a complaint by an individual who, after requesting the termination of their contract, did not receive a satisfactory response to their access requests, notably call recordings.

Grounds for the decision

• Obligation to guarantee the right of access (Article 15 of the GDPR): The authority found that the data controller did not respond to the access request within one month, the first request dating from June 5, 2024, and the response only provided on July 11, 2024. Furthermore, the response was incomplete, merely referring the data subject to the signed contract and informing them of the deletion of the requested call recordings, without providing the information required by the GDPR. The authority emphasized that deleting data after receiving the access request constitutes a direct obstruction to exercising this right, as the recordings did exist at the date of the initial request.

Authority's decision

Consequently, the authority issued a warning against CONSORWEB, S.L.

Additionally, the authority ordered the company to provide the complainant, within one month, with a certificate justifying the satisfaction or the motivated refusal of their access request, and to implement appropriate measures to facilitate the exercise of this right in the future.

Lessons learned

This decision reminds that:

• Deleting personal data after receiving an access request constitutes an obstruction to exercising rights and a violation of the GDPR.
• Internal procedures for data retention and deletion must be suspended for data subject to a rights exercise request, so as not to hinder it.
• The one-month deadline to respond to a rights exercise request starts from the data subject's first solicitation, even if it is formalized later.
• A response to an access request cannot merely refer the data subject to documents already in their possession, such as a contract, but must provide all the information listed in Article 15 of the GDPR.