Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Working Capital Management España, S.L.: Insufficient legal basis for data processing

The Spanish DPA (AEPD) has imposed a fine of EUR 40,000 on the credit information agency Working Capital Management España, S.L..

€40,000 Fine
Working Capital Management España, S.L.
SPAIN
Art. 6 GDPR
Personal Data Consent Insurance Supervisory Authorities Processing
Apr 28, 2022 Source aepd.es

Full text

The Spanish DPA (AEPD) has imposed a fine of EUR 40,000 on the credit information agency Working Capital Management España, S.L.. A data subject had filed a complaint with the AEPD against the company. Fraudulent third parties had taken out a loan with NBQ Technology, S.A.U. in the name of the data subject without the data subject actually entering into a contract. After the data subject subsequently did not make payments, NBQ disclosed the data subject's information to Working Capital Management. The AEPD determined that Working Capital Management, has processed the data subjects data illegally since the personal data was entered into the company's information systems without checking whether the data subject had given their consent to the processing of their personal data.

Industry: Finance, Insurance and Consulting

How it connects

References

Related across sources

CJEU: Processing of beneficiary data not based on consent; individuals must be informed Purpose for processing: The legislation at issue does base the processing on consent. Rather, it provides that they are to be informed. Thus, processing is not based on their… Nov 9, 2010 Consent Personal Data Right to Restriction
SAN 3154/2026 National court annuls DPA sanction against KFC Spain over website privacy information In May 2021, a data subject lodged a complaint with the DPA against KFC Restaurants Spain, S.L.U., the controller, concerning the processing of personal data through its website.… Jul 16, 2026 Supervisory Authorities Personal Data Controllers
14 K 19.01274 VG Ansbach: Lawyer not required to redact client data when submitting files to court In December 2018, the data subject filed with the DPA (the defendant in this case), a complaint under Article 77 GDPR against a lawyer who had represented the data subject in a… Sep 22, 2021 Legitimate Interest Personal Data Professional Secrecy
W256 2227693-1 Austrian FAC: DPA rightly found loyalty program consent for profiling invalid under GDPR On 05.09.2019, the Austrian DPA (DSB) notified the controller of a customer loyalty program that they were initiating an ex officio investigation. The controller responded by… Federal Administrative Court Sep 28, 2023 Marketing Profiling Automated Decision-Making
C-129/21 Proximus NV v Gegevensbeschermingsautoriteit In a preliminary ruling requested by the Brussels Court of Appeal, the Court of Justice of the European Union addressed the interpretation of Article 12 of Directive 2002/58/EC… CJEU ·Fourth Chamber Oct 27, 2022 Telecommunications Right to be Forgotten Personal Data
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data
Related documents