AEPD (Spain) - RR/00075/2024
| AEPD - RR/00075/2024 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 15 GDPR Article 18 GDPR Ley 25/2007, de 18 de octubre, de Conservación de Datos relativos a las comunicaciones electrónicas |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 23.02.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | Euskaltel |
| National Case Number/Name: | RR/00075/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | nzm |
The DPA confirmed that telecommunication service providers have to provide access to location data they process under national data retention legislation contrary to the controller who argued that such legislation provided a full exemption for the right to access.
English Summary
Facts
See also: AEPD (Spain) - EXP202201673
A data subject requested access and the restriction of the processing specifically of his geolocation data regarding his telephone number with Euskaltel (“controller”). The controller refused to comply with the access request arguing that Law 25/2007, of October 18, 2007, on the Conservation of Data related to electronic communications and public communications networks (Ley 25/2007, de 18 de octubre, de Conservación de Datos relativos a las comunicaciones electrónicas) did not allow him to do so. The data subject then filed a complaint with the Spanish DPA (“AEPD”). The AEPD archived the proceedings. Following that the data subject appealed this decision with the Audencia Nacional (“AN”) who annulled the AEPD decision.
On 5 January 2024, the AEPD issued a new decision in the proceedings, stating that the controller was in violation of Articles 15 and 18 GDPR.
On 25 January 2024, the controller filed an internal appeal for reconsideration against this decision with the AEPD (recurso de reposición). claiming that (i) the initial decision required the controller to infringe the law, (ii) the controller does not process geolocation data.
On 23 February 2024, the AEPD issued a decision on this matter.
Holding
Firstly, the AEPD stated that the GDPR and Law 25/2007 are not contradictory rules, but complementary by their purpose or the balance sought between public safety and respect for individual rights. However, the AEPD also pointed out that Law 25/2007 establishes special rules in relation to the rights conferred by the GDPR, and is for these purposes a lex specialis. The AEPD maintained the same reasoning as in the appealed decision, by stating that Law 25/2007 does not establish that the right to access cannot be exercised. Furthermore, the AEPD added that this position does not depart from the AEPD’s precedents.
Secondly, regarding the argument that the controller does not process geolocation data, the AEPD noted that on the one hand, the controller stated that they did not have, nor have they ever had geolocation data, but on the other hand they told the data subject that they could not provide him with the geolocation data with regard to Law 25/2007. Furthermore, this law also indicates that geolocation data must be kept by the operators. Therefore, the AEPD did not accept this argument.
Thirdly, regarding the absence of information regarding the restriction of processing, the AEPD indicated that the GDPR does not allow the request to be ignored as if it had not been made leaving it without response. Therefore, the DPA reiterated that the request for the exercise of rights obliges the controller to give an express reply in any case, using any means that justifies receipt of the reply.
Finally, regarding the stay of execution of the contested act, the AEPD considered that in light of Spanish law, the request for suspension could not be granted since the contested decision was not immediately effective and would be enforceable once the appeal for reconsideration (recurso de reposición) had been resolved. Therefore, the AEPD considered that the suspension request was devoid of purpose.
In conclusion, the AEPD ruled that no new facts or legal arguments had been put forward, dismissed the appeal and upheld its previous decision.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
The campaign, carried out by the Agency and the Spanish Association of Pediatrics, promotes the digital health of minors through raising the awareness of their fathers and mothers, reducing the risks posed on a physical, mental and social level by intensive and uncontrolled use. of the screens.
