- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Court case SAN 487/2024 – Court Ruling (Spain, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Spanish court ruled on a dispute over telecommuting agreements between a company and its employees. The court found that the company could not require employees to use their personal devices for work-related security measures. This decision reinforces the need for companies to provide necessary tools instead of relying on employees' personal resources.
What happened
The court ruled that a clause requiring employees to provide personal cell phone numbers for 2-factor authentication was void.
Who was affected
Employees of the company who were affected by the telecommuting agreement were involved in the dispute.
What the authority found
The court decided that the company must provide the necessary tools for 2-factor authentication instead of requiring employees to use their personal devices.
Why this matters
This ruling sets a precedent that companies must supply tools for work-related security, which could impact how businesses handle remote work arrangements and employee privacy.
Source checks
Linked-source text retrieved.
Automated check recorded — 22 March 2026.
Processing notes: national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 29 November 2023, the Spanish trade union CCOO initiated legal action against the controller concerning a collective labor dispute. In response to the pandemic, some employees of the controller transitioned to telecommuting arrangements. The controller proposed a telecommuting agreement, which the Workers' Legal Representation did not accept, ending the negotiation process without consensus. The controller then entered into individual agreements with the employees regulating, among other topics, the use of personal devices of employees for 2-factor authentication purposes (2FA). The Worker’s Legal Representation brought proceedings before the court seeking annulment, among others, of the clause that mandated the employees to provide their cell phone numbers for receiving SMS messages and/or accessing applications to confirm identity during established working hours. The controller justified this requirement based on cybersecurity reasons and their legitimate interest in ensuring information and system security. The court held that the clause was void since, according to [https://www.boe.es/diario_boe/txt.php?id=BOE-A-2023-13741 Article 19.7 of the Collective Bargaining Agreement of State Scope for the Contact Center Sector], companies shall provide tools, applications, or devices especially in the event where a 2FA system is necessary. The controller should furnish the requisite tools and means, rather than relying on workers' personal devices. In exceptional cases and exclusively for this purpose, if the employee refuses the tool provided by the company, they may consent to use devices or tools of their own.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case SAN 487/2024 in ES
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case SAN 487/2024 - Spain (2024). Retrieved from cookiefines.eu
Last updated: