The Spanish data protection authority ('AEPD') published, on 21 April 2023, its decision in Proceeding No. PS-00281-2022, in which it imposed a fine of €50,000 on Securitas Direct España, S.A.U., for violation of Article 58(2)(c) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following a complaint submitted by an individual.

Background to the decision

In particular, the AEPD stated that the complainant exercised their right of access with Securitas Direct España, following the robbery of their holiday residence for which they had signed a security service contract with Securitas Direct España, including the installation, maintenance, and operation of an alarm. Further, the AEPD continued that the complainant alleged that Securitas Direct España had not provided data logs from the alarm system and that those sent to them were incomplete, chronologically disordered, lacking the keys to decrypt them, and thus, intelligible. On this, the AEPD noted that it had issued a decision in 2017 (which was appealed and dismissed) and in 2021 ordering Securitas Direct España to comply with the right of access.

Findings of the AEPD

In light of its investigation, the AEPD found that the logs, generated through the alarm system installed in the complainant's residence, are classified as personal data and that the right of access is therefore applicable. In this regard, the AEPD stated that Securitas Direct España breached Article 58(2)(c) of the GDPR due to the lack of care in complying with the AEPD's orders and denying the right of access to the complainant.

Outcomes

In light of the above, the AEPD imposed the abovementioned fine on Securitas Direct España.

You can read the decision, only available in Spanish, here.