Securitas Direct Fined €100K for Obstructing GDPR Data Subject Rights via Chargeable Helpline

Written by AI from the linked story. Not reviewed by an editor. How this works

Securitas Direct violated GDPR Article 12 by routing individuals seeking to exercise their data subject rights to a chargeable 902 telephone number, effectively creating a financial barrier to rights that must be accessible free of charge. Even though alternative free channels existed, the deliberate direction to a paid number was sufficient for the Spanish DPA to determine that the company made the exercise of rights 'unduly difficult.' This case underscores that GDPR compliance is not only about having compliant processes in theory, but ensuring that every communication channel actively promoted to data subjects meets the regulation's accessibility standards. Organizations must audit all customer-facing touchpoints — not just their policies — to ensure no inadvertent or intentional friction is introduced into the rights-exercise process.

Tactical Insight

Immediate actions

Audit all customer-facing contact channels (web, email, phone, post) to confirm none impose a cost on individuals exercising data subject rights.
Replace or clearly de-emphasize any chargeable telephone numbers used for privacy or data rights enquiries with free-of-charge alternatives.

Policy & Process improvements

Establish a formal Data Subject Rights (DSR) procedure that mandates free, accessible channels and is reviewed annually against GDPR Article 12 requirements.
Train customer service and legal teams to recognize that actively directing individuals to paid channels constitutes a GDPR violation, even if free alternatives technically exist.
Document all DSR intake channels in your Records of Processing Activities (RoPA) and include channel accessibility as a standing compliance checkpoint.

Ongoing compliance monitoring

Conduct periodic mystery-shopper or internal audits to test the actual end-to-end experience of exercising data subject rights across all promoted channels.
Implement a compliance calendar with scheduled reviews triggered by any changes to customer service infrastructure or telephony contracts.