Euskaltel – Complaint Upheld (Spain, 2024)

See also: AEPD (Spain) - EXP202201673 A data subject requested access and the restriction of the processing specifically of his geolocation data regarding his telephone number with Euskaltel (“controller”). The controller refused to comply with the access request arguing that Law 25/2007, of October 18, 2007, on the Conservation of Data related to electronic communications and public communications networks (Ley 25/2007, de 18 de octubre, de Conservación de Datos relativos a las comunicaciones electrónicas) did not allow him to do so. The data subject then filed a complaint with the Spanish DPA (“AEPD”). The AEPD archived the proceedings. Following that the data subject appealed this decision with the Audencia Nacional (“AN”) who annulled the AEPD decision. On 5 January 2024, the AEPD issued a new decision in the proceedings, stating that the controller was in violation of Articles 15 and 18 GDPR. On 25 January 2024, the controller filed an internal appeal for reconsideration against this decision with the AEPD (recurso de reposición). claiming that (i) the initial decision required the controller to infringe the law, (ii) the controller does not process geolocation data. On 23 February 2024, the AEPD issued a decision on this matter. Firstly, the AEPD stated that the GDPR and Law 25/2007 are not contradictory rules, but complementary by their purpose or the balance sought between public safety and respect for individual rights. However, the AEPD also pointed out that Law 25/2007 establishes special rules in relation to the rights conferred by the GDPR, and is for these purposes a lex specialis. The AEPD maintained the same reasoning as in the appealed decision, by stating that Law 25/2007 does not establish that the right to access cannot be exercised. Furthermore, the AEPD added that this position does not depart from the AEPD’s precedents. Secondly, regarding the argument that the controller does not process geolocation data, the AEPD noted that on the one hand, the controller stated that they did not have, nor have they ever had geolocation data, but on the other hand they told the data subject that they could not provide him with the geolocation data with regard to Law 25/2007. Furthermore, this law also indicates that geolocation data must be kept by the operators. Therefore, the AEPD did not accept this argument. Thirdly, regarding the absence of information regarding the restriction of processing, the AEPD indicated that the GDPR does not allow the request to be ignored as if it had not been made leaving it without response. Therefore, the DPA reiterated that the request for the exercise of rights obliges the controller to give an express reply in any case, using any means that justifies receipt of the reply. Finally, regarding the stay of execution of the contested act, the AEPD considered that in light of Spanish law, the request for suspension could not be granted since the contested decision was not immediately effective and would be enforceable once the appeal for reconsideration (recurso de reposición) had been resolved. Therefore, the AEPD considered that the suspension request was devoid of purpose. In conclusion, the AEPD ruled that no new facts or legal arguments had been put forward, dismissed the appeal and upheld its previous decision.