AEPD (Spain) - TD/00129/2020
| AEPD - TD/00129/2020 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 4(1) GDPR Article 4(2) GDPR Article 12 GDPR Article 15 GDPR Article 13 LOPDGDD Article 64(1) LOPDGDD |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 28.09.2020 |
| Published: | 22.10.2020 |
| Fine: | None |
| Parties: | Xfera Móviles SA |
| National Case Number/Name: | TD/00129/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | n/a |
The Spanish DPA (AEPD) held that the complainant could request access to voice recordings from the data controller, Xfera Moviles, under Article 15 GDPR.
English Summary
Facts
On the 6th november, the complainant exercised her right of access against Xfera Moviles (the defendant). She did not get any response from the defendant.
The complainant had asked the defendant for the recording of calls done between the 6th and 10th November 2019. She only received a response on the 14th November, where Xfera Moviles refused to grant her access to the recording of these calls. This refusal was made on the basis that recordings are for Xfera Moviles internal use only and would be given only as a result of a court order.
The defendant argued that the request was not in exercise of the complainant's right of access under the GDPR. Instead, the defendant argued that the complainant wanted access to the data as a result of a disagreement regarding Xfera Moviles billing and contract with the complainant.
Dispute
Is a refusal to give the data subject recordings of her calls in breach of the data subject's right of access under Article 15?
Holding
The Spanish DPA held that the complainant had exercised her right of access to the recordings in conformity with the GDPR.
The DPA held that a voice recording is "processing" of "personal data" within the meaning of Article 4(1) and 4(2) GDPR. Therefore, the data subject has the right to request access to these recordings.
The DPA did consider that such recordings could include personal data of third parties. Therefore, granting access to them might infringe the GDPR (processing without consent of the third party). However, it concluded that this was not an issue in this case as the complainant only requested access to recordings that she had herself made.
The Spanish DPA established that it was not competent to investigate information concerning contracts and incidents linked to them.
The Spanish DPA therefore upheld the complaint. It requested that Xfera Moviles respond to the access request within ten days.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
