Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Furnishyourspace S.L.: Insufficient fulfilment of information obligations

The Spanish DPA (AEPD) imposed a fine of EUR 6,000 on FurnishYourSpace S.L..

€6,000 Fine
Furnishyourspace S.L.
SPAIN
Art. 5 GDPR Art. 6 GDPR Art. 12 GDPR Art. 13 GDPR Art. 21 GDPR
Right to Object Personal Data Retention Period Controllers Supervisory Authorities
Aug 30, 2021 Source aepd.es

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline
§

The Spanish DPA (AEPD) imposed a fine of EUR 6,000 on FurnishYourSpace S.L.. The AEPD had received a complaint from the Berlin DPA via the EU Internal Market Information System about the inadequate design of the controller's privacy notice. Namely, the identity and contact details of the controller were provided in the privacy notice, but under a misleading heading that gave the impression that they were provided for a business purpose. In addition, the purposes of the processing were not clearly stated. No information was provided regarding the legal basis, the retention period of the personal data and the data subjects' right to object. Also, the privacy notice was confusing and the wording contained grammatical errors and used terms that are not part of common usage. In addition, the privacy notice required a tax identification number in order to issue a simplified invoice, i.e., an invoice not exceeding the amount of EUR 3,000.

Personal Data Right to Object Retention Period
§

The AEPD found this to be a violation of the principle of legality. The fine is composed as follows: EUR 3,000 for a breach of Art. 12 GDPR and Art. 13 GDPR; EUR 1,000 for a breach of Art. 21 (4) GDPR; and EUR 2,000 for a breach of Art. 5 (1) a) GDPR and Art. 6 GDPR. GDPR Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 21 (4) GDPR Industry: Industry and Commerce

applies Art. 5(1)Art. 21(4)Art. 6Art. 12

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

All 7

Related across sources

C-136/17 GC and Others v CNIL C-136/17 (GC and Others) CJEU Sep 24, 2019 Right to be Forgotten Legitimate Interest Criminal Data
HvJ EU 9 januari 2025, C‑394/23 (Mousse) Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20… HvJ EU 9 januari 2025, C‑394/23 (Mousse). ·CJEU Jan 9, 2025 IP Address Retention Period Identification
Guidelines 5/2019 criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1) Guidelines ·EDPB Jul 7, 2020 Right to be Forgotten Personal Data Right to Rectification
Guidelines 01/2022 data subject rights - Right of access Guidelines ·EDPB Apr 17, 2023 Right of Access Personal Data Right to Rectification
439360 French Conseil d'État strikes down GendNotes police app decree for excessive special data In February 2020 the French minister of the interior enacted the Decree No. 2020-151 of 20 February 2020 authorising the automated processing of personal data known as "mobile… CE Apr 13, 2021 Types of Special Categories of Personal Data Retention Period Personal Data
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data
Related documents