Spain: €100,000, and a year of ladders

On the outside wall of a building there is a small plate. It tells you that cameras are recording. It gives you a telephone number to call if you want to know what has been recorded of you, or if you want to object to being recorded at all.

The number was a 902 line. Calling it costs money.

The Spanish data protection authority has now fined the company €100,000. It has also given the company one year to replace every one of those plates it has installed across Spain.

I want you to notice who complained. It was not a customer. It was the consumer organisation FACUA, which had been documenting this company’s use of 902 numbers since 2021, on the plates and on the website. The AEPD concluded that sending citizens to a high cost number to exercise their rights of access and objection to the recording of their images breaches data protection law.

Five years passed between the first complaint and this resolution. In those five years the plates did not change. What changed is that the regulator finished its work.

This is the thing I repeat to my students more than any other. Supervisory authorities do not forget. They are slow, and slow is not the same as absent.

What’s was wrong?

Three findings matter here more than the number.

The right cost money. Article 12(5) GDPR says that information and communications, and any action taken under Articles 15 to 22, shall be provided free of charge. Spanish law repeats it: the means must be easily accessible for the affected person, and the controller’s actions in responding to these requests are free. A premium line does not refuse your right. It puts a price on it. For Article 12, that is not better. It is only quieter.

The right was in the small print. The AEPD noted that the text about access and objection was printed in a much smaller size than the telephone number. Article 12(1) asks for information that is concise, transparent, intelligible and easily accessible. A plate where the number is large and the reason to call it is small complies in form and defeats itself in substance.

It was not a rights channel at all. That same 902 number was used for ordinary commercial business. So a person who wanted to object to being filmed was calling a sales line, and paying for the call.

There is one more fact, from a different proceeding, and it is the one I would put on the slide. The CNMC fined Telefónica €160,000, later confirmed by the Audiencia Nacional, for paying Securitas Direct a share of the revenue from calls to that 902 line. The law forbids companies to profit from such calls. The cost is supposed to go to the operator.

Read it together with everything above. The route to the right was not only inconvenient. It produced income.

Legal background

Article 12(2) obliges the controller to facilitate the exercise of data subject rights. Not to allow it. Not to have a procedure somewhere. To facilitate. This is an active duty, and this case is really about that word.

Article 12(5) makes the exercise free of charge.

Article 13 governs what a person must be told when their data is collected, which is exactly the job a video surveillance plate is doing. The EDPB guidelines on video devices describe a layered approach: the essential information on the sign, the rest easily available. A sign that makes the phone number bigger than the right it serves has turned that layering upside down.

Articles 15 and 21 are the rights themselves: access to the footage, and objection to the processing.

Article 58(2)(d) is the source of the structural order, the power to require that processing operations be brought into compliance, in a specified manner and within a specified period. One year. Every plate.

Article 83(5)(b) places infringements of data subject rights under Articles 12 to 22 in the higher tier, up to €20 million or 4% of total worldwide annual turnover. Against a group operating in 18 countries, €100,000 is not a deterrent by size. It is a deterrent by obligation.

This is the part I ask practitioners to study, because it is the part the headlines miss.

The €100,000 will be paid and forgotten. The order will not. Replacing every information plate on every building where this company installed a system in Spain means finding them, manufacturing new ones, sending a person to each address, and proving to a regulator within twelve months that it is done. The labour cost is far larger than the penalty. And every new plate is a small public notice that the previous one was unlawful.

People often ask me why Spanish fines look modest next to other authorities. Here is the answer. The AEPD is not trying to win a headline with the number. It is using Article 58(2)(d) to change what the company does, and it was willing to wait five years to do it.

This is not the first time this controller has met this authority over this family of obligations. In 2023 the AEPD fined it €50,000 in connection with its obligations towards the agency itself. There is a separate €25,000 penalty for not complying with orders about the right of access. Now €100,000 and a year of ladders.

Three decisions. One failure underneath all of them. The right of access treated as a request to be managed, instead of a right to be facilitated.

And notice how findable this case was. Nobody needed to be inside the company. The evidence was bolted to the outside of buildings, in public, for years. Anyone walking past could photograph it. Eventually somebody did, and kept doing it, and wrote it down until a regulator acted.

There is a way to read this decision as a small technical matter about telephone tariffs. I do not read it that way.

Somebody sat in a meeting and chose which number to print on that plate. That person was not planning a violation. They were choosing a customer service option, and the option that produced revenue was also the option that was easier to justify internally. The right was an abstraction. The line item was real.

So ask the question that no template asks. Would you have accepted that plate on the wall of your own building, if the person standing in front of it, squinting at very small text about a camera pointed at them, deciding whether the call was worth the cost, were someone you love?

Everything on that plate was documented. Almost nothing about it was facilitated.