The AEPD fine with 42,000 euros to a company

The Spanish Agency for Data Protection (AEPD) has imposed a sanction of 70,000 euros to LVMH Iberia, a subsidiary of the French giant of the luxury cosmetics, to add a worker to a group of work WhatsApp using their personal telephone number without prior consent. The resolution, to which Diario Sur It has had accessIt is not an isolated case, and reflects how companies can violate the Data Protection Law With something as simple as put someone in a WhatsApp group.

Origin. The employee had to use her personal mobile for labor matters for the demand of the company, while waiting for a new mobile phone to work that was never delivered. According to declaredother incorporated partners after they received these devices. At the beginning of his vacation, he warned by email and verbally that he would leave the WhatsApp groups work and stop using his personal mobile for work, although he would maintain contact with the clients he already had.

Conflict. During his vacation, a person from the company adds his number to the WhatsApp group without prior notice or communication. The worker remained in that group until, weeks later, the same person eliminated her when she was fired from the company. It was then that he decided to denounce the facts before the AEPD.

The defense of the company. According to account Diario Sur, LVMH Iberia claimed to have adopted a “guarantee” position and defended that the employee’s mail did not request a permanent elimination of the groups, but temporary during the holidays. The company claimed to have respected its decision not to participate during that period and argued that the worker expressed her willingness to continue using the personal mobile for labor purposes.

The resolution. The AEPD considered that there had been an illegal treatment of personal data by not collecting prior consent of the employee, violating the General Data Protection Regulation (GDPR). The sanction also takes into account the violation of the right of digital disconnection, protected by labor regulations. After assuming its responsibility and receiving reductions by recognition of the facts, the company finally contributed a total of 42,000 euros, a figure agreed between the agency and the company.

What does legislation say. Although the GDPR does not specifically add the WhatsApp work groups, The AEPD has established That the telephone number is a protected personal fact, so adding an employee to a group without their consent constitutes an illicit data treatment.

The situation changes when the company provides a corporate phone, since in that case the device and the number belong to the company, which can establish its use in internal policies. For those who telework, the obligation to provide contact data can appear in the contract, although its use It must be justified as urgent and does not allow the employee to be added to groups without direct consent. Likewise, as this last case has reflected, the worker has full right to refuse to use his personal device for labor communications.

Cover image | Israel Andrade and own assembly

In Xataka | The MIT has studied the impact of AI on companies. Its conclusion: only 5% of the time changes some really