- The Spanish data protection supervisory authority AEPD imposed a fine of EUR 100,000 on an IT service provider on August 17, 2021.
- The service provider refused to provide the controller with the order data and access to the server despite the order processing agreement.
- Data subjects’ rights have priority; processors should not be given the right to refuse to perform data processing.
The Spanish data protection supervisory authority AEPD has imposed a fine of EUR 100,000 on an IT service provider with effect from August 17, 2021which, contrary to the provision of the order processing agreement, it is failed to disclose the order data to the responsible person or to make the server operated by the order processor accessible. The order processor had objected that he had outstanding claims against the responsible. Apparently, this had caused high damage to the person responsible.
The decision illustrates that the order processor certainly has the possibility to enforce claims against the controller. However, the rights of the data subjects take precedence. For this reason, an order processor should not have a right to refuse performance with regard to the processing of the order data, which can and, depending on the case, should be stipulated in an order processing agreement.