Given the queries we have received from customers, we want to warn companies about an attempted telephone scam that has been multiplying in recent weeks. These are telephone calls to companies, in which they threaten sanctions for non-compliance with data protection regulations. They identify themselves as official Social Security organizations or data protection consultants and require urgent hiring of a course as the only way to avoid inspections and high fines. In some cases they refer to a false breach in the communication of data files.
In addition, there are companies that continue to sell mandatory and subsidized courses by the State Foundation for Employment Training (Fundae) in order for the employer to save that money. These actions are a scam and are practices strictly prohibited in the Organic Law on Data Protection. This is what the standard says:
Sixteenth additional provision. Aggressive data protection practices.
For the purposes provided for in article 8 of Law 3/1991, of January 10, on Unfair Competition, the following are considered aggressive practices:
a) Act with the intention of impersonating the identity of the Spanish Data Protection Agency or an autonomous data protection authority when making any communication to those responsible and in charge of the treatments or to the interested parties.
b) Generate the appearance that you are acting in the name, on behalf of or in collaboration with the Spanish Data Protection Agency or an autonomous data protection authority, in making any communication to those responsible and in charge of the treatments in that the sender offers its products or services.
c) Carry out commercial practices in which the decision-making power of the recipients is restricted by reference to the possible imposition of sanctions for non-compliance with the personal data protection regulations.
d) Offer any type of document that seeks to create an appearance of compliance with the data protection provisions in a complementary manner to the performance of training actions, without having carried out the necessary actions to verify that said compliance actually occurs. .
e) Assume, without express designation of the person responsible or in charge of processing, the function of data protection delegate and communicate in this capacity with the Spanish Data Protection Agency or the regional data protection authorities.
In fact, this information is published on the website of the Español de Protección de Datos (AEPD) in July 2019 through a press release that you can consult from this link. Fundae itself also warns about this type of practices in this link.
None of the arguments used to intimidate companies over the telephone are true: there has been no record of files since May 2018 and, therefore, there is no obligation to communicate them. The Spanish Data Protection Agency is an organization that depends on the Ministry of Justice and has no link with Social Security.
Companies must not submit any contract on data protection management to any body. In fact, contracts between consultants and companies are private and are not registered anywhere. Training credits for workers cannot be used to implement standards. In fact, the General Treasury of Social Security (TGSS), via the Labor Inspection, is very likely to act ex officio and request the return of subsidized amounts (also exposing itself to possible sanctions and/or actions through criminal or administrative means) and The supposed consultant will never attend to your claim.
The best way to respond to these calls is to request the information they are talking about through an email, something that they are hardly willing to do. In any case, We recommend contacting Tomarial in the case of receiving telephone calls about any issue related to data protection and its management within the company. Our specialized department will clarify any queries in this regard to avoid falling into a scam.
