[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhrCH2VSMtDwve3cBwhM02kXlwT1-mTusQPff5SH9ARU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41,"controls":42},"653e9a3e-f34a-4959-b5d1-2b3fcdade117","securitas-direct-fined-100k-for-obstructing-gdpr-data-subject-rights-via-chargeable-helpline","7f24e4d0-0bfa-4b5d-8e3e-433d8658072a","Securitas Direct Fined €100K for Obstructing GDPR Data Subject Rights via Chargeable Helpline","Securitas Direct violated GDPR Article 12 by routing individuals seeking to exercise their data subject rights to a chargeable 902 telephone number, effectively creating a financial barrier to rights that must be accessible free of charge. Even though alternative free channels existed, the deliberate direction to a paid number was sufficient for the Spanish DPA to determine that the company made the exercise of rights 'unduly difficult.' This case underscores that GDPR compliance is not only about having compliant processes in theory, but ensuring that every communication channel actively promoted to data subjects meets the regulation's accessibility standards. Organizations must audit all customer-facing touchpoints — not just their policies — to ensure no inadvertent or intentional friction is introduced into the rights-exercise process.","**Immediate actions:**\n- Audit all customer-facing contact channels (web, email, phone, post) to confirm none impose a cost on individuals exercising data subject rights.\n- Replace or clearly de-emphasize any chargeable telephone numbers used for privacy or data rights enquiries with free-of-charge alternatives.\n\n**Policy & Process improvements:**\n- Establish a formal Data Subject Rights (DSR) procedure that mandates free, accessible channels and is reviewed annually against GDPR Article 12 requirements.\n- Train customer service and legal teams to recognize that actively directing individuals to paid channels constitutes a GDPR violation, even if free alternatives technically exist.\n- Document all DSR intake channels in your Records of Processing Activities (RoPA) and include channel accessibility as a standing compliance checkpoint.\n\n**Ongoing compliance monitoring:**\n- Conduct periodic mystery-shopper or internal audits to test the actual end-to-end experience of exercising data subject rights across all promoted channels.\n- Implement a compliance calendar with scheduled reviews triggered by any changes to customer service infrastructure or telephony contracts.",[12,13,14,15,16,17,18,19],"GDPR Article 12 — Transparent information, communication and modalities for the exercise of the rights of the data subject","GDPR Article 15-22 — Data subject rights (access, erasure, portability, objection, etc.)","GDPR Article 83(5)(b) — Infringements of data subjects' rights","NIST Privacy Framework PR.PO-P1 — Policies and procedures for data processing","NIST SP 800-53 IP-1 — Consent; IP-6 — Redress","CIS Control 3 — Data Protection (data governance and accountability)","ISO\u002FIEC 27701:2019 — Privacy Information Management (PIMS), clause 7.3 — Rights of data subjects","ITIL Service Design — Accessibility and usability of service channels",{},"published","2026-09-22T12:21:34.153957+00:00","2026-09-22T12:21:33.821+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fthe-spanish-dpa-fined-securitas-direct-100-000-eur-for-making-the-exercise-of-data-subject_en","the-spanish-dpa-fined-securitas-direct-100-000-eur-for-making-the-exercise-of-da-14c9a9","The Spanish DPA fined Securitas Direct 100 000 EUR for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]