Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Patio Ancestral S.L.: Insufficient legal basis for data processing

The Spanish DPA (AEPD) imposed a fine of EUR 5,000 on Patio Ancestral S.L..

€3,000 Fine
Patio Ancestral S.L.
SPAIN
Art. 6 GDPR
Controllers Personal Data Supervisory Authorities Liability Processing
Feb 8, 2021 Source aepd.es

Full text

The Spanish DPA (AEPD) imposed a fine of EUR 5,000 on Patio Ancestral S.L.. The complainant worked for a construction company and had carried out some renovation work for the controller. During these works, damage had been caused to the controller's properties. The controller had then sent a letter with claims for damages not only to the complainant but also to the complainant's father, who had previously been employed by the same construction company. However, the father was an uninvolved third party in this case. The Spanish DPA found that the processing of the father's personal data for this reason had taken place without a legal basis. The original fine was reduced to EUR 3,000 due to immediate payment and admission of responsibility.

Industry: Industry and Commerce

How it connects

References

Related across sources

C-741/21 GP v juris GmbH In Case C-741/21, the Court of Justice of the European Union (Third Chamber) addressed a preliminary reference from the Landgericht Saarbrücken in proceedings between data subject… Third Chamber Apr 11, 2024 Liability Personal Data Integrity and Confidentiality Principle
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data
C-687/21 BL v MediaMarktSaturn Hagen-Iserlohn GmbH In Case C-687/21, the Court of Justice of the European Union interpreted Articles 5, 24, 32, and 82 of the GDPR in response to a preliminary ruling request from the Amtsgericht… Third Chamber Jan 25, 2024 Liability Integrity and Confidentiality Principle Data Breaches
C-757/22 Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V In a preliminary ruling requested by the German Federal Court of Justice (Bundesgerichtshof), the Court of Justice of the European Union interpreted Article 80(2) GDPR in the… Fourth Chamber Jul 11, 2024 Personal Data Transparency Fairness & Transparency
C-340/21 VB v Natsionalna agentsia za prihodite C-340/21 (VB v Natsionalna agentsia) Dec 14, 2023 Integrity and Confidentiality Principle Data Breaches Notification Obligation
C-200/23 Agentsia po vpisvaniyata v OL The Court of Justice of the European Union (First Chamber) ruled on a preliminary reference from the Bulgarian Supreme Administrative Court in a dispute between the Agentsia po… First Chamber Oct 4, 2024 Right to be Forgotten Personal Data Right to Object
Related documents