Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

IZA OBRAS Y PROMOCIONES, S.A.: Non-compliance with general data processing principles

The Spanish DPA has fined IZA OBRAS Y PROMOCIONES, S.A.

€50,000 Fine
IZA OBRAS Y PROMOCIONES, S.A.
SPAIN
Art. 5 GDPR
Retention Period Personal Data Controllers Processing IP Address
Dec 14, 2021 Source aepd.es

Full text

The Spanish DPA has fined IZA OBRAS Y PROMOCIONES, S.A. EUR 50,000. An employee had filed a complaint with the DPA against the company, alleging that the controller had unauthorizedly disclosed his personal data to another company from which it had received a construction order. The data subject was working as a construction manager on the project, but was absent from work for a period of time due to illness. The controller therefore informed its client and additionally disclosed the data subject's email address and certain health information. The DPA determined that the disclosure of this data would not have been necessary and that the controller had therefore violated the principle of data minimization.

Industry: Employment

How it connects

References

Related across sources

C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) CJEU Jan 12, 2023 Supervisory Authorities IP Address Supervision
HvJ EU 9 januari 2025, C‑394/23 (Mousse) Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20… HvJ EU 9 januari 2025, C‑394/23 (Mousse). ·CJEU Jan 9, 2025 IP Address Retention Period Identification
Guidelines 3/2019 processing of personal data through video devices Guidelines ·EDPB Jan 30, 2020 Personal Data Processing Material scope (GDPR)
C-17/22 HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG and Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co. KG v Müller Rechtsanwaltsgesellschaft mbH and Others The Court of Justice of the European Union (Fourth Chamber) issued a preliminary ruling in joined cases C-17/22 and C-18/22, originating from the Amtsgericht München, concerning… CJEU ·Fourth Chamber Sep 12, 2024 Legitimate Interest Personal Data Fairness & Transparency
C-621/22 Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens The CJEU ruled on a preliminary reference from the Amsterdam District Court in proceedings between the Koninklijke Nederlandse Lawn Tennisbond (KNLTB) and the Dutch Data… CJEU ·Ninth Chamber Oct 4, 2024 Personal Data Legitimate Interest IP Address
Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors IP Address
Related documents