AEPD (Spain) - TD/00129/2020

AEPD - TD/00129/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 4(1) GDPR Article 4(2) GDPR Article 12 GDPR Article 15 GDPR Article 13 LOPDGDD Article 64(1) LOPDGDD
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	28.09.2020
Published:	22.10.2020
Fine:	None
Parties:	Xfera Móviles SA
National Case Number/Name:	TD/00129/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish DPA (AEPD) held that the complainant could request access to voice recordings from the data controller, Xfera Moviles, under Article 15 GDPR.

English Summary

Facts

On the 6th november, the complainant exercised her right of access against Xfera Moviles (the defendant). She did not get any response from the defendant.

The complainant had asked the defendant for the recording of calls done between the 6th and 10th November 2019. She only received a response on the 14th November, where Xfera Moviles refused to grant her access to the recording of these calls. This refusal was made on the basis that recordings are for Xfera Moviles internal use only and would be given only as a result of a court order.

The defendant argued that the request was not in exercise of the complainant's right of access under the GDPR. Instead, the defendant argued that the complainant wanted access to the data as a result of a disagreement regarding Xfera Moviles billing and contract with the complainant.

Dispute

Is a refusal to give the data subject recordings of her calls in breach of the data subject's right of access under Article 15?

Holding

The Spanish DPA held that the complainant had exercised her right of access to the recordings in conformity with the GDPR.

The DPA held that a voice recording is "processing" of "personal data" within the meaning of Article 4(1) and 4(2) GDPR. Therefore, the data subject has the right to request access to these recordings.

The DPA did consider that such recordings could include personal data of third parties. Therefore, granting access to them might infringe the GDPR (processing without consent of the third party). However, it concluded that this was not an issue in this case as the complainant only requested access to recordings that she had herself made.

The Spanish DPA established that it was not competent to investigate information concerning contracts and incidents linked to them.

The Spanish DPA therefore upheld the complaint. It requested that Xfera Moviles respond to the access request within ten days.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

Page 1
1/7
 File No.: TD / 00129/2020
1037-100919
RESOLUTION Nº: R / 00429/2020
In view of the claim made on January 21, 2020 before this Agency by
Mrs. AAA , (from now on the complaining party), against XFERA MÓVILES, SA, (a
from now on the claimed part), for not having been duly attended to his
Right of access.
The procedural actions provided for in Title VIII of the Law have been carried out.
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD), the following have been verified
ACTS
FIRST: On November 6, 2019, the claimant exercised the right to
access against the claimed with NIF A82528548, without your request having received the
legally established reply.
The complaining party provides various documentation related to the claim
raised before this Agency and on the exercise of the right exercised.
Due to a claim derived from the contractual relationship, the party
The claimant requests the recordings of the calls made on the 6th and 10th of
November 2019.
The claimant provides the response received on November 14,
2019, where they communicate: “The recordings are internal material and are not at our
available, we cannot provide you with access to the recordings unless it is to
through a court order. "
SECOND : In accordance with the functions provided for in Regulation (EU)
2016/679, of April 27, 2016, General Data Protection (RGPD),
particularly those that respond to the principles of transparency and responsibility
proactively by the controller, it has been required to inform
this Agency of the actions that have been carried out to address the claim
raised. In summary, the following allegations were made:
-
The representative / Delegate of Data Protection of the claimed
manifested in the allegations made during the processing of the
present proceeding that:
“… This denial is based on the fact that it is not possible to provide a
copy of the recording without adversely affecting the rights and freedoms
of other participants in the same conversation (…) requests access to the
personal data of the operator with whom you spoke ... "
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 2
2/7
According to the defendant: “… the object of the request is not the exercise of
fundamental right of data protection what is pursued, but
a consumer claim for disagreement with your
billing and the conditions of your contract ... "
Finally, the defendant shows his reservations regarding the purpose of the
recording in case the claimant obtains it.
Namely: “… since by providing the recording to the interested party we lose the
control over it, and we may find that it is disclosed through
social networks or communicated to third parties for recreational, mocking or
in order to attack the operator or my client ... "
-
The complaining party, knowing the allegations of the defendant, presents
their own where in detail exposes the articles of the Law of
Data Protection that regulates your right of access.
FOUNDATIONS OF LAW
FIRST: The Director of the Spanish Agency for
Data Protection, in accordance with the provisions of section 2 of article 56 in
in relation to paragraph 1 f) of article 57, both of Regulation (EU) 2016/679 of the
European Parliament and of the Council of April 27, 2016 on the protection of
individuals with regard to the processing of personal data and the free
circulation of these data (hereinafter, RGPD); and in article 47 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD).
SECOND: Article 64.1 of the LOPDGDD , provides the following:
"one. When the procedure refers exclusively to the lack of attention of
a request to exercise the rights established in articles 15 to 22 of the
Regulation (EU) 2016/679, will start by agreement of admission for processing, which is
adopt in accordance with the provisions of the following article.
In this case, the term to resolve the procedure will be six months from
from the date the claimant was notified of the agreement to
admission for processing. After this period, the interested party may consider
estimated your claim. "
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 3
3/7
THIRD: Article 12 of Regulation (EU) 2016/679, of April 27, 2016,
General Data Protection (RGPD), provides that:
"one. The controller will take the appropriate measures to facilitate
to the interested party all information indicated in articles 13 and 14, as well as any
communication in accordance with articles 15 to 22 and 34 regarding the treatment, in the form
concise, transparent, intelligible and easily accessible, with a clear and simple language, in
particular any information directed specifically at a child. Information
will be provided in writing or by other means, including, if applicable, by means
electronic When requested by the interested party, the information may be provided
verbally provided that the identity of the interested party is proven by other means.
2. The person in charge of the treatment will facilitate the interested party the exercise of their
rights under articles 15 to 22. In the cases referred to in article 11,
section 2, the person in charge will not refuse to act at the request of the interested party in order
to exercise your rights under articles 15 to 22, unless you can demonstrate
that is not in a position to identify the interested party.
3. The person responsible for the treatment will provide the interested party with information regarding their
proceedings on the basis of a request pursuant to Articles 15 to 22, and, in
In any case, within one month of receiving the request. Saying
The term may be extended for another two months if necessary, taking into account the
complexity and number of requests. The person in charge will inform the interested party of
any of said extensions within a period of one month from the receipt of the
request, stating the reasons for the delay. When the interested party presents the
request by electronic means, the information will be provided by electronic means
when possible, unless the interested party requests that it be provided otherwise.
4. If the person responsible for the treatment does not comply with the request of the interested party,
will inform without delay, and at the latest after one month of receipt of the
request, the reasons for its non-action and the possibility of submitting a
claim before a control authority and to exercise legal actions.
5. The information provided by virtue of articles 13 and 14 as well as all
communication and any action carried out pursuant to articles 15 to 22 and 34
they will be free of charge. When the requests are manifestly unfounded or
excessive, especially due to its repetitive nature, the person responsible for the
treatment may:
a) charge a reasonable fee based on the administrative costs incurred
to facilitate information or communication or carry out the requested action, or
b) refuse to act on the request.
The data controller will bear the burden of proving the character
manifestly unfounded or excessive of the request.
6. Without prejudice to the provisions of article 11, when the person responsible for the
treatment has reasonable doubts regarding the identity of the natural person
making the request referred to in articles 15 to 21, may request that the
provide the additional information necessary to confirm the identity of the interested party.
7. The information that must be provided to the interested parties by virtue of articles
13 and 14 may be transmitted in combination with standard icons that allow
provide in an easily visible, intelligible and clearly legible way a suitable
overview of the planned treatment. Icons presented in the format
electronic will be machine readable.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 4
4/7
8. The Commission is empowered to adopt delegated acts in accordance with
Article 92 in order to specify the information to be submitted through
icons and procedures for providing standard icons. "
FOURTH: Article 15 of the RGPD provides that:
"one. The interested party will have the right to obtain from the person responsible for the treatment
confirmation of whether or not personal data concerning you is being processed and, as such
case, right of access to personal data and the following information:
a) the purposes of the treatment;
b) the categories of personal data in question;
c) the recipients or categories of recipients to whom they were communicated or
personal data will be communicated, in particular recipients in third parties or
international organizations;
d) if possible, the expected period of conservation of personal data or,
if possible, the criteria used to determine this period;
e) the existence of the right to request from the person responsible the rectification or deletion
of personal data or the limitation of the processing of personal data related to
interested party, or to oppose said treatment;
f) the right to file a claim with a supervisory authority;
g) when the personal data have not been obtained from the interested party, any
information available on its origin;
h) the existence of automated decisions, including profiling, to
referred to in article 22, paragraphs 1 and 4, and, at least in such cases, information
significant on the applied logic, as well as the importance and consequences
provided for said treatment for the interested party.
2. When personal data is transferred to a third country or an organization
international, the interested party will have the right to be informed of the guarantees
appropriate under Article 46 regarding the transfer.
3. The person responsible for the treatment will provide a copy of the personal data
object of treatment. The person in charge may receive for any other requested copy
a reasonable fee based on administrative costs for the interested party. When the
interested party submit the application by electronic means, and unless he requests
otherwise provided, the information will be provided in an electronic format of
Common use.
4. The right to obtain a copy mentioned in section 3 shall not affect
negatively to the rights and freedoms of others. "
FIFTH: Article 13 of the LOPDGDD determines the following:
"one. The right of access of the affected party will be exercised in accordance with the provisions
in article 15 of Regulation (EU) 2016/679.
When the controller processes a large amount of data related to the affected person and
it exercises its right of access without specifying whether it refers to all or part
of the data, the person in charge may request, before providing the information, that the
affected specify the data or processing activities to which the
request.
2. The right of access will be understood to be granted if the person responsible for the treatment
provide the affected party with a remote, direct and secure access system to the data
personal that guarantees, permanently, access to its entirety. Such
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 5
5/7
effects, the communication by the person in charge to the affected party of the way in which this
Accessing said system will be enough to consider the request to exercise the
law.
However, the interested party may request from the person in charge the information referred to
the points provided for in article 15.1 of Regulation (EU) 2016/679 that are not
be included in the remote access system.
3. For the purposes established in article 12.5 of Regulation (EU) 2016/679,
may consider the exercise of the right of access repetitive on more than one occasion
during the period of six months, unless there is legitimate cause for it.
4. When the affected party chooses a means other than the one offered that involves a
disproportionate cost, the request will be considered excessive, so said
affected will assume the excess costs that his election entails. In this case, only
The data controller will be required to satisfy the right of access without
undue delay. "
SIXTH: Sections 1) and 2) of article 4 of the RGPD, which deals with the
definitions, indicate:
"1)" personal data ": any information about an identified natural person
or identifiable ("the interested party"); any identifiable natural person shall be considered
person whose identity can be determined, directly or indirectly, in particular
using an identifier, such as a name, an identification number,
location data, an online identifier or one or more elements of the
physical, physiological, genetic, psychic, economic, cultural or social identity of said
person;
2) "treatment": any operation or set of operations carried out
on personal data or personal data sets, either by procedures
automated or not, such as collection, registration, organization, structuring,
conservation, adaptation or modification, extraction, consultation, use,
communication by transmission, broadcast or any other form of authorization of
access, collation or interconnection, limitation, deletion or destruction; "
SEVENTH: Before going into the substance of the questions raised, it should be noted
that this procedure is instructed as a consequence of the denial of
any of the rights regulated by data protection regulations (access,
rectification, deletion, limitation, portability and opposition) and is intended to
adopt the corresponding measures so that the guarantees and rights of the affected
are properly restored. Therefore, in the present case, only
and assessed those questions raised by the complaining party that remain
included within the object of the aforementioned complaints procedure regarding
Data Protection.
In the case analyzed here, the complaining party exercised its right to
access to the voice recordings of November 6 and 10, 2019 and,
after the period established in accordance with the aforementioned regulations, your request
obtained the legally required response, given that the required access was not provided.
That said, that is, whether or not the requested access is applicable, it should be noted
that, in accordance with the provisions of sections 1 and 2 of art. 4 of the GDPR
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 6
6/7
previously transcribed, the voice is considered personal data. Therefore, in principle,
the complaining party would have the right to have those recordings provided, at the
protection of data protection regulations. However, such recordings
may contain, in addition to their data, information related to third parties who
could not be communicated to you, since, otherwise, it could constitute an assignment of
data without consent.
In this sense, it must be considered that the voice is a peculiar and
individual of each person that makes it identifiable, therefore, it is a data of
personal character. Consequently, the right of access to the recording of your voice
requested by the complaining party if it is covered by current regulations in
data protection matter, facilitating the copy of the recording requested to the party
claimant or, failing that, transcription of its content.
Once the documentation in the procedure has been examined, it is observed
that the complaining party does not raise a dispute for not agreeing with the
contractual conditions, at least in the documentation submitted to this
Agency, you only request the right of access to some recordings that they made.
The claim of the defendant that he could use the recordings in a
inadequate, it cannot be taken into account since, in application of the
presumption of innocence, in case of doubt regarding a specific fact and
decisive, this procedure could not be rejected taking into account that the
right has not been addressed.
It must be remembered that this Agency only has jurisdiction over data
personal, without being able to assess the information concerning possible contracts
subscribed or incidents on them. This regardless of what other
regulations protect the obtaining of said information, such as, among others, the Real
Legislative Decree 1/2007, which approves the General Law for the Defense of
Consumers and Users, Law 7/1993, on general conditions of
hiring.
The bodies that issue binding resolutions for this purpose include
the Consumer Arbitration Boards (provided that the creditor voluntarily submits to
to them), the Telecommunications User Service Office
(www.usuariosteleco.gob.es) or the judicial bodies. They are not binding, between
others, the decisions of consumer organizations or public offices
municipal consumption.
Therefore, the claim that originated the present
process.
Having regard to the cited precepts and others of general application,
the Director of the Spanish Agency for Data Protection RESOLVES:
FIRST: ESTIMATE the claim made by Ms. AAA and urge XFERA
MÓVILES, SA with NIF A82528548, so that, within ten business days
following the notification of this resolution, send the complaining party
certification stating that you have met the right of access exercised by
this or is reasonedly denied indicating the reasons why it is not applicable
meet your request. The actions carried out as a result of this
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 7
7/7
Resolution must be communicated to this Agency within the same period. He
Failure to comply with this resolution could lead to the commission of the offense
considered in article 72.1.m) of the LOPDGDD, which will be sanctioned, in accordance with
with art. 58.2 of the RGPD.
SECOND: NOTIFY this resolution to Ms. AAA and XFERA MÓVILES,
SA
In accordance with the provisions of article 50 of the LOPDGDD, the
This Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which ends the administrative procedure in accordance with art.
48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the
LPACAP, the interested parties may optionally file an appeal for reversal
before the Director of the Spanish Agency for Data Protection within a period of
month from the day after notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.
Mar Spain Martí
Director of the Spanish Agency for Data Protection
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es