Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Homeowners Association: Insufficient legal basis for data processing

The Spanish DPA has imposed a fine of EUR 2,000 on a homeowners' association.

€2,000 Fine
Homeowners Association
SPAIN
Art. 6 GDPR Art. 15 GDPR
Personal Data Right of Access Controllers Consent Supervisory Authorities
Dec 28, 2022 Source aepd.es

Full text

The Spanish DPA has imposed a fine of EUR 2,000 on a homeowners' association. An individual who did cleaning work in the residential complex had filed a complaint with the DPA because members of the association had added them to a WhatsApp group without their consent. The data subject was required to upload pictures of the cleaning they had done for documentation purposes. The DPA concluded that adding their phone number to the WhatsApp group without their consent violated Art. 6 GDPR and was therefore unlawful. The DPA also found that the controller had not complied with the data subject's request for access to personal data in a timely manner, therefore violating Art. 15 GDPR.

Industry: Employment

How it connects

References

Related across sources

C-169/23 Nemzeti Adatvédelmi és Információszabadság Hatóság v UC In Case C-169/23, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Kúria (Hungary) concerning whether the Budapest Metropolitan… CJEU ·Third Chamber Nov 28, 2024 Personal Data Legitimate Interest Supervision
2 A 165/24 OVG Saarlouis - 2 A 165/24 The data subject was an employee, the controller was the employer. On 14 January 2022, the data subject requested access to personal data from the controller under Article 15… May 13, 2025 Right of Access Personal Data Right to Restriction
C-154/21 RW v Österreichische Post AG The Court of Justice of the European Union (First Chamber), in response to a preliminary reference from the Oberster Gerichtshof (Austrian Supreme Court), interpreted Article… CJEU ·First Chamber Jan 12, 2023 Right of Access Personal Data Recipient
C-203/22 CK v Magistrat der Stadt Wien In Case C-203/22, the Court of Justice of the European Union interpreted Article 15(1)(h) of the GDPR in response to a preliminary ruling from the Verwaltungsgericht Wien… CJEU ·First Chamber Feb 27, 2025 Profiling Automated Decision-Making Marketing
C-434/16 Peter Nowak v Data Protection Commissioner C-434/16 (Nowak) CJEU Dec 20, 2017 Right of Access Personal Data Right to be Forgotten
M 32 E 26.3990 VG Munich: university may be GDPR controller for professors' editorial work emails The author of a manuscript (the data subject) submitted their text to an editorial office of a quarterly journal for review in November 2025. The journal was published by a… Administrative Court Munich Aug 11, 2026 Controllers Right of Access Personal Data
Related documents