# Homeowners Association: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2022-12-28
- Original: https://www.enforcementtracker.com/ETid-1585
- Canonical: https://overview.legal/posts/47700
- Topics: Personal Data, Controllers, Right of Access, Employees, Consent, Processing Agreement, Processing, Supervisory Authorities, Data Controller, Law Enforcement

## Summary

The Spanish DPA has imposed a fine of EUR 2,000 on a homeowners' association. An individual who did cleaning work in the residential complex had filed a complaint with the DPA because members of the association had added them to a WhatsApp group without their consent. The data subject was required to upload pictures of the cleaning they had done for documentation purposes. The DPA concluded that adding their phone number to the WhatsApp group without their consent violated Art. 6 GDPR and was th

## Full text

The Spanish DPA has imposed a fine of EUR 2,000 on a homeowners' association. An individual who did cleaning work in the residential complex had filed a complaint with the DPA because members of the association had added them to a WhatsApp group without their consent. The data subject was required to upload pictures of the cleaning they had done for documentation purposes. The DPA concluded that adding their phone number to the WhatsApp group without their consent violated Art. 6 GDPR and was therefore unlawful. The DPA also found that the controller had not complied with the data subject's request for access to personal data in a timely manner, therefore violating Art. 15 GDPR.

GDPR Articles: Art. 6 (1) GDPR, Art. 15 GDPR
Industry: Employment

---
Generated by overview.legal · https://overview.legal/posts/47700 · 2026-08-22