Enforcement · Spanish Data Protection Authority (aepd) EN LLM context

TECHPUMP SOLUTIONS S.L.: Non-compliance with general data processing principles

The Spanish DPA has fined Techpump Solutions S.L.

€525,000 Fine

TECHPUMP SOLUTIONS S.L.

SPAIN

Art. 5 GDPR Art. 6 GDPR Art. 8 GDPR Art. 12 GDPR Art. 13 GDPR Art. 25 GDPR Art. 30 GDPR Art. 22 GDPR

Retention Period Personal Data Storage Limitation Minors Consent

Oct 31, 2022 Source aepd.es

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline

The Spanish DPA has fined Techpump Solutions S.L. EUR 525,000. Techpump operates several websites with adult content. The DPA found several violations of data protection law during its investigation. Firstly, the DPA found that, contrary to the specified information in the privacy policy, Techpump shared users' personal data with companies belonging to the same group. In addition, the DPA found that Techpump had not specified a retention period for users' personal data and kept it indefinitely until users requested to withdraw their consent. Techpump also processed users' personal data without first obtaining their consent. Further, the DPA found that Techpump did not have sufficient parental controls to prevent minors under the age of 14 from accessing its content. In addition, Techpump's privacy policy was only available in English, rather than Spanish, and the information was not clearly understandable.

Retention Period Minors Storage Limitation

Techpump also required that individuals who wished to exercise their data subject rights submit their ID card information in order to verify their identity. The DPA considered this to be an unacceptable impediment to the exercise of data subject rights. Finally, Techpump also collected various data such as IP addresses and WIFI data without having defined a processing purpose for it. GDPR Articles: Art. 5 (1) a), b), e) GDPR, Art. 6 (1) GDPR, Art. 8 GDPR, Art. 12 (1), (2) GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 30 (1) GDPR, Art. 22 (2) LSSI Industry: Media, Telecoms and Broadcasting

Personal Data Supervisory Authorities applies Art. 5(1)Art. 6(1)Art. 12(1)Art. 30(1)

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

All 12

Related across sources

C-136/17 GC and Others v CNIL C-136/17 (GC and Others) CJEU Sep 24, 2019 Right to be Forgotten Legitimate Interest Criminal Data

C-175/20 SIA 'SS' v Valsts ieņēmumu dienests In Case C-175/20, the Court of Justice of the EU interpreted GDPR Articles 5 and 6 in response to a preliminary ruling from the Latvian Regional Administrative Court concerning a… CJEU ·Fifth Chamber Feb 24, 2022 Retention Period Personal Data Legitimate Interest

HvJ EU 9 januari 2025, C‑394/23 (Mousse) Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20… HvJ EU 9 januari 2025, C‑394/23 (Mousse). ·CJEU Jan 9, 2025 IP Address Retention Period Identification

Guidelines 10/2020 restrictions under Article 23 GDPR Guidelines ·EDPB Oct 13, 2021 GDPR Subject-Matter and Objectives Right to Restriction Data Portability

Guidelines 5/2019 criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1) Guidelines ·EDPB Jul 7, 2020 Right to be Forgotten Personal Data Right to Rectification

CJEU: Mandatory communications metadata retention only justified for fighting serious Data retention: Legally mandated communications meta-data retention can only be a justified interference with the right of privacy and the right to data protection under EU law if… Apr 8, 2014 Storage Limitation Retention Period Integrity and Confidentiality Principle