# Private individual: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2022-05-20
- Original: https://www.enforcementtracker.com/ETid-1184
- Canonical: https://overview.legal/posts/47299
- Topics: Personal Data, Controllers, Processing, Data Controller, Consent, Processing Agreement, Human Resources, Supervisory Authorities

## Summary

The Spanish DPA has fined a private individual operating three websites EUR 2,000. During its investigation, the DPA found that all three websites lacked a field for giving consent to the processing of personal data. In addition, the DPA found that the privacy policies on the websites were missing any reference to the identity of the data controller and to the right of data subjects to withdraw their consent to data processing.

## Full text

The Spanish DPA has fined a private individual operating three websites EUR 2,000. During its investigation, the DPA found that all three websites lacked a field for giving consent to the processing of personal data. In addition, the DPA found that the privacy policies on the websites were missing any reference to the identity of the data controller and to the right of data subjects to withdraw their consent to data processing.

GDPR Articles: Art. 6 (1) GDPR
Industry: Individuals and Private Associations

---
Generated by overview.legal · https://overview.legal/posts/47299 · 2026-08-22