Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Private individual: Insufficient legal basis for data processing
How it connects
Related across sources
Case Law CJEU - C-311/18 - Facebook Ireland and Schrems Case Law Rb. Den Haag - C/09/689833 Case Law VG München - M 26a K 25.5210 News EDPB contributes to the LED evaluation and adopts recommendations on the application for Processor BCR News CNIL (France) - SAN-2025-014 News CNIL (France) - SAN-2025-015
Full text
The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on a member of a staff council. The individual had sent minutes of staff council meetings to unauthorized third parties that were not members of the staff council. During its investigation, the DPA found that the individual did not have an effective legal basis for sending the emails.
Industry: Individuals and Private Associations
Original document at the source www.aepd.es