# FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2023-09-25
- Original: https://www.enforcementtracker.com/ETid-2048
- Canonical: https://overview.legal/posts/48163
- Topics: Health Data, Personal Data, Healthcare, IP Address, Education, Controllers, Public Authority, Processing Agreement, Processing, Public Sector

## Summary

The Spanish DPA has imposed a fine of EUR 17,000 on FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA. Athletes were required to upload the vaccination certificate against COVID with the complete vaccination schedule or a certificate of recovery from the disease or an antigen test with a negative result to the controller's website 48 hours before sports events in order to participate in sports competitions. During its investigation, the DPA found that the controller did not have a valid legal basis

## Full text

The Spanish DPA has imposed a fine of EUR 17,000 on FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA. Athletes were required to upload the vaccination certificate against COVID with the complete vaccination schedule or a certificate of recovery from the disease or an antigen test with a negative result to the controller's website 48 hours before sports events in order to participate in sports competitions. During its investigation, the DPA found that the controller did not have a valid legal basis for processing this sensitive health data. The DPA also found that the controller had not provided sufficient information about the processing of personal data.

GDPR Articles: Art. 9 GDPR, Art. 13 GDPR
Industry: Public Sector and Education

---
Generated by overview.legal · https://overview.legal/posts/48163 · 2026-08-22