AEPD - TD/00129/2020
|AEPD - TD/00129/2020|
|Relevant Law:||Article 4(1) GDPR|
Article 4(2) GDPR
Article 12 GDPR
Article 15 GDPR
Article 13 LOPDGDD
Article 64(1) LOPDGDD
|Parties:||Xfera Móviles SA|
|National Case Number/Name:||TD/00129/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish DPA (AEPD) held that the complainant could request access to voice recordings from the data controller, Xfera Moviles, under Article 15 GDPR.
English Summary[edit | edit source]
Facts[edit | edit source]
On the 6th november, the complainant exercised her right of access against Xfera Moviles (the defendant). She did not get any response from the defendant.
The complainant had asked the defendant for the recording of calls done between the 6th and 10th November 2019. She only received a response on the 14th November, where Xfera Moviles refused to grant her access to the recording of these calls. This refusal was made on the basis that recordings are for Xfera Moviles internal use only and would be given only as a result of a court order.
The defendant argued that the request was not in exercise of the complainant's right of access under the GDPR. Instead, the defendant argued that the complainant wanted access to the data as a result of a disagreement regarding Xfera Moviles billing and contract with the complainant.
Dispute[edit | edit source]
Is a refusal to give the data subject recordings of her calls in breach of the data subject's right of access under Article 15?
Holding[edit | edit source]
The Spanish DPA held that the complainant had exercised her right of access to the recordings in conformity with the GDPR.
The DPA held that a voice recording is "processing" of "personal data" within the meaning of Article 4(1) and 4(2) GDPR. Therefore, the data subject has the right to request access to these recordings.
The DPA did consider that such recordings could include personal data of third parties. Therefore, granting access to them might infringe the GDPR (processing without consent of the third party). However, it concluded that this was not an issue in this case as the complainant only requested access to recordings that she had herself made.
The Spanish DPA established that it was not competent to investigate information concerning contracts and incidents linked to them.
The Spanish DPA therefore upheld the complaint. It requested that Xfera Moviles respond to the access request within ten days.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Page 1 1/7 File No.: TD / 00129/2020 1037-100919 RESOLUTION Nº: R / 00429/2020 In view of the claim made on January 21, 2020 before this Agency by Mrs. AAA , (from now on the complaining party), against XFERA MÓVILES, SA, (a from now on the claimed part), for not having been duly attended to his Right of access. The procedural actions provided for in Title VIII of the Law have been carried out. Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD), the following have been verified ACTS FIRST: On November 6, 2019, the claimant exercised the right to access against the claimed with NIF A82528548, without your request having received the legally established reply. The complaining party provides various documentation related to the claim raised before this Agency and on the exercise of the right exercised. Due to a claim derived from the contractual relationship, the party The claimant requests the recordings of the calls made on the 6th and 10th of November 2019. The claimant provides the response received on November 14, 2019, where they communicate: “The recordings are internal material and are not at our available, we cannot provide you with access to the recordings unless it is to through a court order. " SECOND : In accordance with the functions provided for in Regulation (EU) 2016/679, of April 27, 2016, General Data Protection (RGPD), particularly those that respond to the principles of transparency and responsibility proactively by the controller, it has been required to inform this Agency of the actions that have been carried out to address the claim raised. In summary, the following allegations were made: - The representative / Delegate of Data Protection of the claimed manifested in the allegations made during the processing of the present proceeding that: “… This denial is based on the fact that it is not possible to provide a copy of the recording without adversely affecting the rights and freedoms of other participants in the same conversation (…) requests access to the personal data of the operator with whom you spoke ... " C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 2 2/7 According to the defendant: “… the object of the request is not the exercise of fundamental right of data protection what is pursued, but a consumer claim for disagreement with your billing and the conditions of your contract ... " Finally, the defendant shows his reservations regarding the purpose of the recording in case the claimant obtains it. Namely: “… since by providing the recording to the interested party we lose the control over it, and we may find that it is disclosed through social networks or communicated to third parties for recreational, mocking or in order to attack the operator or my client ... " - The complaining party, knowing the allegations of the defendant, presents their own where in detail exposes the articles of the Law of Data Protection that regulates your right of access. FOUNDATIONS OF LAW FIRST: The Director of the Spanish Agency for Data Protection, in accordance with the provisions of section 2 of article 56 in in relation to paragraph 1 f) of article 57, both of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data and the free circulation of these data (hereinafter, RGPD); and in article 47 of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). SECOND: Article 64.1 of the LOPDGDD , provides the following: "one. When the procedure refers exclusively to the lack of attention of a request to exercise the rights established in articles 15 to 22 of the Regulation (EU) 2016/679, will start by agreement of admission for processing, which is adopt in accordance with the provisions of the following article. In this case, the term to resolve the procedure will be six months from from the date the claimant was notified of the agreement to admission for processing. After this period, the interested party may consider estimated your claim. " C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 3 3/7 THIRD: Article 12 of Regulation (EU) 2016/679, of April 27, 2016, General Data Protection (RGPD), provides that: "one. The controller will take the appropriate measures to facilitate to the interested party all information indicated in articles 13 and 14, as well as any communication in accordance with articles 15 to 22 and 34 regarding the treatment, in the form concise, transparent, intelligible and easily accessible, with a clear and simple language, in particular any information directed specifically at a child. Information will be provided in writing or by other means, including, if applicable, by means electronic When requested by the interested party, the information may be provided verbally provided that the identity of the interested party is proven by other means. 2. The person in charge of the treatment will facilitate the interested party the exercise of their rights under articles 15 to 22. In the cases referred to in article 11, section 2, the person in charge will not refuse to act at the request of the interested party in order to exercise your rights under articles 15 to 22, unless you can demonstrate that is not in a position to identify the interested party. 3. The person responsible for the treatment will provide the interested party with information regarding their proceedings on the basis of a request pursuant to Articles 15 to 22, and, in In any case, within one month of receiving the request. Saying The term may be extended for another two months if necessary, taking into account the complexity and number of requests. The person in charge will inform the interested party of any of said extensions within a period of one month from the receipt of the request, stating the reasons for the delay. When the interested party presents the request by electronic means, the information will be provided by electronic means when possible, unless the interested party requests that it be provided otherwise. 4. If the person responsible for the treatment does not comply with the request of the interested party, will inform without delay, and at the latest after one month of receipt of the request, the reasons for its non-action and the possibility of submitting a claim before a control authority and to exercise legal actions. 5. The information provided by virtue of articles 13 and 14 as well as all communication and any action carried out pursuant to articles 15 to 22 and 34 they will be free of charge. When the requests are manifestly unfounded or excessive, especially due to its repetitive nature, the person responsible for the treatment may: a) charge a reasonable fee based on the administrative costs incurred to facilitate information or communication or carry out the requested action, or b) refuse to act on the request. The data controller will bear the burden of proving the character manifestly unfounded or excessive of the request. 6. Without prejudice to the provisions of article 11, when the person responsible for the treatment has reasonable doubts regarding the identity of the natural person making the request referred to in articles 15 to 21, may request that the provide the additional information necessary to confirm the identity of the interested party. 7. The information that must be provided to the interested parties by virtue of articles 13 and 14 may be transmitted in combination with standard icons that allow provide in an easily visible, intelligible and clearly legible way a suitable overview of the planned treatment. Icons presented in the format electronic will be machine readable. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 4 4/7 8. The Commission is empowered to adopt delegated acts in accordance with Article 92 in order to specify the information to be submitted through icons and procedures for providing standard icons. " FOURTH: Article 15 of the RGPD provides that: "one. The interested party will have the right to obtain from the person responsible for the treatment confirmation of whether or not personal data concerning you is being processed and, as such case, right of access to personal data and the following information: a) the purposes of the treatment; b) the categories of personal data in question; c) the recipients or categories of recipients to whom they were communicated or personal data will be communicated, in particular recipients in third parties or international organizations; d) if possible, the expected period of conservation of personal data or, if possible, the criteria used to determine this period; e) the existence of the right to request from the person responsible the rectification or deletion of personal data or the limitation of the processing of personal data related to interested party, or to oppose said treatment; f) the right to file a claim with a supervisory authority; g) when the personal data have not been obtained from the interested party, any information available on its origin; h) the existence of automated decisions, including profiling, to referred to in article 22, paragraphs 1 and 4, and, at least in such cases, information significant on the applied logic, as well as the importance and consequences provided for said treatment for the interested party. 2. When personal data is transferred to a third country or an organization international, the interested party will have the right to be informed of the guarantees appropriate under Article 46 regarding the transfer. 3. The person responsible for the treatment will provide a copy of the personal data object of treatment. The person in charge may receive for any other requested copy a reasonable fee based on administrative costs for the interested party. When the interested party submit the application by electronic means, and unless he requests otherwise provided, the information will be provided in an electronic format of Common use. 4. The right to obtain a copy mentioned in section 3 shall not affect negatively to the rights and freedoms of others. " FIFTH: Article 13 of the LOPDGDD determines the following: "one. The right of access of the affected party will be exercised in accordance with the provisions in article 15 of Regulation (EU) 2016/679. When the controller processes a large amount of data related to the affected person and it exercises its right of access without specifying whether it refers to all or part of the data, the person in charge may request, before providing the information, that the affected specify the data or processing activities to which the request. 2. The right of access will be understood to be granted if the person responsible for the treatment provide the affected party with a remote, direct and secure access system to the data personal that guarantees, permanently, access to its entirety. Such C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 5 5/7 effects, the communication by the person in charge to the affected party of the way in which this Accessing said system will be enough to consider the request to exercise the law. However, the interested party may request from the person in charge the information referred to the points provided for in article 15.1 of Regulation (EU) 2016/679 that are not be included in the remote access system. 3. For the purposes established in article 12.5 of Regulation (EU) 2016/679, may consider the exercise of the right of access repetitive on more than one occasion during the period of six months, unless there is legitimate cause for it. 4. When the affected party chooses a means other than the one offered that involves a disproportionate cost, the request will be considered excessive, so said affected will assume the excess costs that his election entails. In this case, only The data controller will be required to satisfy the right of access without undue delay. " SIXTH: Sections 1) and 2) of article 4 of the RGPD, which deals with the definitions, indicate: "1)" personal data ": any information about an identified natural person or identifiable ("the interested party"); any identifiable natural person shall be considered person whose identity can be determined, directly or indirectly, in particular using an identifier, such as a name, an identification number, location data, an online identifier or one or more elements of the physical, physiological, genetic, psychic, economic, cultural or social identity of said person; 2) "treatment": any operation or set of operations carried out on personal data or personal data sets, either by procedures automated or not, such as collection, registration, organization, structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, broadcast or any other form of authorization of access, collation or interconnection, limitation, deletion or destruction; " SEVENTH: Before going into the substance of the questions raised, it should be noted that this procedure is instructed as a consequence of the denial of any of the rights regulated by data protection regulations (access, rectification, deletion, limitation, portability and opposition) and is intended to adopt the corresponding measures so that the guarantees and rights of the affected are properly restored. Therefore, in the present case, only and assessed those questions raised by the complaining party that remain included within the object of the aforementioned complaints procedure regarding Data Protection. In the case analyzed here, the complaining party exercised its right to access to the voice recordings of November 6 and 10, 2019 and, after the period established in accordance with the aforementioned regulations, your request obtained the legally required response, given that the required access was not provided. That said, that is, whether or not the requested access is applicable, it should be noted that, in accordance with the provisions of sections 1 and 2 of art. 4 of the GDPR C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 6 6/7 previously transcribed, the voice is considered personal data. Therefore, in principle, the complaining party would have the right to have those recordings provided, at the protection of data protection regulations. However, such recordings may contain, in addition to their data, information related to third parties who could not be communicated to you, since, otherwise, it could constitute an assignment of data without consent. In this sense, it must be considered that the voice is a peculiar and individual of each person that makes it identifiable, therefore, it is a data of personal character. Consequently, the right of access to the recording of your voice requested by the complaining party if it is covered by current regulations in data protection matter, facilitating the copy of the recording requested to the party claimant or, failing that, transcription of its content. Once the documentation in the procedure has been examined, it is observed that the complaining party does not raise a dispute for not agreeing with the contractual conditions, at least in the documentation submitted to this Agency, you only request the right of access to some recordings that they made. The claim of the defendant that he could use the recordings in a inadequate, it cannot be taken into account since, in application of the presumption of innocence, in case of doubt regarding a specific fact and decisive, this procedure could not be rejected taking into account that the right has not been addressed. It must be remembered that this Agency only has jurisdiction over data personal, without being able to assess the information concerning possible contracts subscribed or incidents on them. This regardless of what other regulations protect the obtaining of said information, such as, among others, the Real Legislative Decree 1/2007, which approves the General Law for the Defense of Consumers and Users, Law 7/1993, on general conditions of hiring. The bodies that issue binding resolutions for this purpose include the Consumer Arbitration Boards (provided that the creditor voluntarily submits to to them), the Telecommunications User Service Office (www.usuariosteleco.gob.es) or the judicial bodies. They are not binding, between others, the decisions of consumer organizations or public offices municipal consumption. Therefore, the claim that originated the present process. Having regard to the cited precepts and others of general application, the Director of the Spanish Agency for Data Protection RESOLVES: FIRST: ESTIMATE the claim made by Ms. AAA and urge XFERA MÓVILES, SA with NIF A82528548, so that, within ten business days following the notification of this resolution, send the complaining party certification stating that you have met the right of access exercised by this or is reasonedly denied indicating the reasons why it is not applicable meet your request. The actions carried out as a result of this C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 7 7/7 Resolution must be communicated to this Agency within the same period. He Failure to comply with this resolution could lead to the commission of the offense considered in article 72.1.m) of the LOPDGDD, which will be sanctioned, in accordance with with art. 58.2 of the RGPD. SECOND: NOTIFY this resolution to Ms. AAA and XFERA MÓVILES, SA In accordance with the provisions of article 50 of the LOPDGDD, the This Resolution will be made public once it has been notified to the interested parties. Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the interested parties may optionally file an appeal for reversal before the Director of the Spanish Agency for Data Protection within a period of month from the day after notification of this resolution or directly contentious-administrative appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within a period of two months from the day following notification of this act, as provided in article 46.1 of the referred Law. Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es