Baby Palace S.L. – Complaint Upheld (Spain, 2020)

The complainant asked a company to exercise his/her right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and to access these data in accordance with Article 15 GDPR. The request did not receive the legally required response. The claimant provided various documents relating to the complaint submitted to the Spanish DPA, which requested the company in question to inform the Agency of the actions taken to deal with the complaint submitted. There was also no response to this request. Can companies be sanctioned for not attending to a customer's claim to exercise his or her right of access to data? The Spanish DPA admitted the claim and urged the controller to send the claimant a certificate stating that his/her request to exercise the right of access has been satisfied or to refuse it, indicating the reasons why his/her request should not be satisfied. If the company complained of fails to comply with this resolution, this could lead to the commission of a very serious infringement, which will be sanctioned in accordance with art. 58 (2) of the GDPR.