Court case SAN 487/2024 – Court Ruling (Spain, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Spanish court ruled that a company cannot require employees to use their personal phones for two-factor authentication without providing the necessary tools. The court found that the company must supply devices for this purpose instead of relying on employees' personal devices. This decision is significant as it protects workers' privacy and sets a standard for how companies should handle security measures.
What happened
A court ruled that a company’s requirement for employees to use personal phones for two-factor authentication was invalid.
Who was affected
Employees of the company who were asked to use their personal phones for work-related security measures were affected.
What the authority found
The court decided that the company must provide the necessary tools for two-factor authentication instead of mandating the use of personal devices, based on labor agreements.
Why this matters
This ruling highlights the importance of protecting employee privacy and sets a precedent that companies must provide appropriate tools for work-related security measures. Businesses should review their practices to ensure compliance with labor laws.
National Law Articles
On 29 November 2023, the Spanish trade union CCOO initiated legal action against the controller concerning a collective labor dispute. In response to the pandemic, some employees of the controller transitioned to telecommuting arrangements. The controller proposed a telecommuting agreement, which the Workers' Legal Representation did not accept, ending the negotiation process without consensus. The controller then entered into individual agreements with the employees regulating, among other topics, the use of personal devices of employees for 2-factor authentication purposes (2FA). The Worker’s Legal Representation brought proceedings before the court seeking annulment, among others, of the clause that mandated the employees to provide their cell phone numbers for receiving SMS messages and/or accessing applications to confirm identity during established working hours. The controller justified this requirement based on cybersecurity reasons and their legitimate interest in ensuring information and system security. The court held that the clause was void since, according to [https://www.boe.es/diario_boe/txt.php?id=BOE-A-2023-13741 Article 19.7 of the Collective Bargaining Agreement of State Scope for the Contact Center Sector], companies shall provide tools, applications, or devices especially in the event where a 2FA system is necessary. The controller should furnish the requisite tools and means, rather than relying on workers' personal devices. In exceptional cases and exclusively for this purpose, if the employee refuses the tool provided by the company, they may consent to use devices or tools of their own.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case SAN 487/2024 in ES
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case SAN 487/2024 - Spain (2024). Retrieved from cookiefines.eu
Last updated: