The Spanish DPA fined Securitas Direct 100 000 EUR for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number
Spain's data protection authority fined Securitas Direct €100,000 after the security company directed people to a paid-rate phone number to exercise their GDPR rights. A consumer association brought the complaint, citing video surveillance notices that routed access and objection requests through a chargeable 902 number.
Why this matters: GDPR gives people rights on paper. Companies decide how hard those rights are to use in practice. Routing people to a number that costs money to call is not a neutral technical choice — it is a friction tax on anyone who wants to know what data a surveillance company holds on them. Most people will hang up rather than pay. That is the point. Regulators are right to treat deliberate friction as a violation, not a technicality.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · Cybersecurity · General readers · Policy
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.