Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

TECHPUMP SOLUTIONS S.L.: Non-compliance with general data processing principles

€525,000 Fine
TECHPUMP SOLUTIONS S.L.
SPAIN
Art. 5 GDPR Art. 6 GDPR Art. 8 GDPR Art. 12 GDPR Art. 13 GDPR Art. 25 GDPR Art. 30 GDPR Art. 22 GDPR
Retention Period Data Subject Rights Exercise Modalities and Procedures Personal Data IP Address Storage Limitation Minors Telecommunications Processing Agreement
Oct 31, 2022 Source

How it connects

Related across sources

Case Law GC and Others v CNIL CJEU Guidance Guidelines 9/2022 on personal data breach notification under GDPR EDPB Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 10/2020 on restrictions under Article 23 GDPR EDPB Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB

Full text

The Spanish DPA has fined Techpump Solutions S.L. EUR 525,000. Techpump operates several websites with adult content. The DPA found several violations of data protection law during its investigation. Firstly, the DPA found that, contrary to the specified information in the privacy policy, Techpump shared users' personal data with companies belonging to the same group. In addition, the DPA found that Techpump had not specified a retention period for users' personal data and kept it indefinitely until users requested to withdraw their consent. Techpump also processed users' personal data without first obtaining their consent. Further, the DPA found that Techpump did not have sufficient parental controls to prevent minors under the age of 14 from accessing its content. In addition, Techpump's privacy policy was only available in English, rather than Spanish, and the information was not clearly understandable. Techpump also required that individuals who wished to exercise their data subject rights submit their ID card information in order to verify their identity. The DPA considered this to be an unacceptable impediment to the exercise of data subject rights. Finally, Techpump also collected various data such as IP addresses and WIFI data without having defined a processing purpose for it.

Industry: Media, Telecoms and Broadcasting

Original document at the source www.aepd.es

Similar Content