# CYNGASA, S.L.: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2021-09-29
- Original: https://www.enforcementtracker.com/ETid-855
- Canonical: https://overview.legal/posts/46970
- Topics: Personal Data, Controllers, Employees, Processing Agreement, Consent, Processing, Data Controller, Security, Supervisory Authorities

## Summary

The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on CYNGASA, S.L.. The data subject, when requesting a work report, discovered that the controller had disclosed his personal data to a third party company without his consent. The data involved included among others first and last name as well as his social security number.

## Full text

The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on CYNGASA, S.L.. The data subject, when requesting a work report, discovered that the controller had disclosed his personal data to a third party company without his consent. The data involved included among others first and last name as well as his social security number.

GDPR Articles: Art. 6 GDPR
Industry: Employment

---
Generated by overview.legal · https://overview.legal/posts/46970 · 2026-08-22