AEPD (Spain) - TD/00129/2020

From GDPRhub
Revision as of 07:59, 23 October 2020 by 10.90.129.133 (talk)
AEPD - TD/00129/2020
LogoES.jpg
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 4(1) GDPR
Article 4(2) GDPR
Article 12 GDPR
Article 15 GDPR
Article 13 LOPDGDD
Article 64(1) LOPDGDD
Type: Complaint
Outcome: Upheld
Started:
Decided: 28.09.2020
Published: 22.10.2020
Fine: None
Parties: Xfera Móviles SA
National Case Number/Name: TD/00129/2020
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Spanish
Original Source: AEPD (in ES)
Initial Contributor: n/a

The Spanish DPA (AEPD) held that the complainant could request access to voice recordings from the data controller, Xfera Moviles, under Article 15 GDPR.

English Summary

Facts

On the 6th november, the complainant exercised her right of access against Xfera Moviles (the defendant). She did not get any response from the defendant.

The complainant had asked the defendant for the recording of calls done between the 6th and 10th November 2019. She only received a response on the 14th November, where Xfera Moviles refused to grant her access to the recording of these calls. This refusal was made on the basis that recordings are for Xfera Moviles internal use only and would be given only as a result of a court order.

The defendant argued that the request was not in exercise of the complainant's right of access under the GDPR. Instead, the defendant argued that the complainant wanted access to the data as a result of a disagreement regarding Xfera Moviles billing and contract with the complainant.

Dispute

Is a refusal to give the data subject recordings of her calls in breach of the data subject's right of access under Article 15?

Holding

The Spanish DPA held that the complainant had exercised her right of access to the recordings in conformity with the GDPR.

The DPA held that a voice recording is "processing" of "personal data" within the meaning of Article 4(1) and 4(2) GDPR. Therefore, the data subject has the right to request access to these recordings.

The DPA did consider that such recordings could include personal data of third parties. Therefore, granting access to them might infringe the GDPR (processing without consent of the third party). However, it concluded that this was not an issue in this case as the complainant only requested access to recordings that she had herself made.

The Spanish DPA established that it was not competent to investigate information concerning contracts and incidents linked to them.

The Spanish DPA therefore upheld the complaint. It requested that Xfera Moviles respond to the access request within ten days.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.