DPA case EXP202201673 – Complaint Upheld (Spain, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Euskaltel did not allow a user to access their geolocation data, citing legal obligations. This is important because it shows that companies must balance legal requirements with users' rights to access their data.
What happened
Euskaltel refused a user's request for access to their geolocation data, claiming legal obligations to retain it.
Who was affected
A user who requested access to their geolocation data held by Euskaltel.
What the authority found
The AEPD found that Euskaltel did not properly justify its refusal to provide access to the user's data.
Why this matters
This case highlights the need for companies to understand and respect users' rights under GDPR, even when facing legal obligations to retain data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject requested access to his personal data, specifically the geolocation data regarding his telephone number with Euskaltel (“controller”). A few days after this access request, he also exercised his right to restrict the processing and specifically requested that they do not proceed with the deletion of the data until he had been given access to it. The controller responded that they could not provide the data subject with this information as Law 25/2007, of October 18, 2007, on the Conservation of Data related to electronic communications and public communications networks (Ley 25/2007, de 18 de octubre, de Conservación de Datos relativos a las comunicaciones electrónicas) would impose the obligation to retain certain data generated as a result of the activity of its users for the sole and exclusive purpose of making them available to the authorities for the detection, investigation and prosecution of serious crimes. Therefore, no access to personal data under Article 15 GDPR could be granted. Following this response, the data subject filed a complaint against the controller with the Spanish DPA (“AEPD”). On 25 April 2022, the AEPD decided to archive the proceedings with regard to the reasoned refusal given by the controller. The data subject filed an administrative appeal against this decision with the Audencia Nacional (“AN”) who annulled the decision of the AEPD in January 2023. As a result, the AEPD reopened the proceedings in order to take AN decision into account. The DPA heard both parties. Firstly, the AEPD indicated that the controller did not dispute the personal data nature of the information requested by the data subject, therefore, once this nature is established, the only exceptions that may apply to the exercise of any GDPR rights are those established by the law. The AEPD found that Law 25/2007 does not establish a limitation to the exercise of the right of access other that the the data subject is not to be informed about the the
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case EXP202201673 in ES
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case EXP202201673 - Spain (2024). Retrieved from cookiefines.eu
Last updated: