Xfera Móviles SA – Complaint Upheld (Spain, 2020)

On the 6th november, the complainant exercised her right of access against Xfera Moviles (the defendant). She did not get any response from the defendant. The complainant had asked the defendant for the recording of calls done between the 6th and 10th November 2019. She only received a response on the 14th November, where Xfera Moviles refused to grant her access to the recording of these calls. This refusal was made on the basis that recordings are for Xfera Moviles internal use only and would be given only as a result of a court order. The defendant argued that the request was not in exercise of the complainant's right of access under the GDPR. Instead, the defendant argued that the complainant wanted access to the data as a result of a disagreement regarding Xfera Moviles billing and contract with the complainant. Is a refusal to give the data subject recordings of her calls in breach of the data subject's right of access under Article 15? The Spanish DPA held that the complainant had exercised her right of access to the recordings in conformity with the GDPR. The DPA held that a voice recording is "processing" of "personal data" within the meaning of Article 4(1) and 4(2) GDPR. Therefore, the data subject has the right to request access to these recordings. The DPA did consider that such recordings could include personal data of third parties. Therefore, granting access to them might infringe the GDPR (processing without consent of the third party). However, it concluded that this was not an issue in this case as the complainant only requested access to recordings that she had herself made. The Spanish DPA established that it was not competent to investigate information concerning contracts and incidents linked to them. The Spanish DPA therefore upheld the complaint. It requested that Xfera Moviles respond to the access request within ten days.