Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
PLAY FUL KIDS, S.L.: Insufficient legal basis for data processing
The Spanish DPA imposed a fine of EUR 3,000 on PLAY FUL KIDS, S.L.
Full text
The Spanish DPA imposed a fine of EUR 3,000 on PLAY FUL KIDS, S.L. due to an incident that occurred during a children's birthday party on the premises of the controller involving guests and employees. Following the event, the guests posted negative reviews on Google. In response, the data controller shared surveillance footage showing minor guests without a valid legal basis via WhatsApp to pressure the guests into withdrawing their reviews.
Industry: Not assigned
How it connects
Related across sources
C-807/21 Deutsche Wohnen SE v Staatsanwaltschaft Berlin C-807/21 (Deutsche Wohnen) CJEU Dec 5, 2023 Fines Public Authority Processors
C-362/14 Maximillian Schrems v Data Protection Commissioner C-362/14 (Schrems I) CJEU Oct 6, 2015 Privacy Shield Supervision IP Address
C-507/17 Google LLC v CNIL C-507/17 (Google Territorial Scope) CJEU Sep 24, 2019 Territorial scope (GDPR) Right to be Forgotten Direct Marketing
Guidelines 02/2022 application of Article 60 GDPR Guidelines ·EDPB Mar 14, 2022 Supervision Supervisory Authorities Processors
Guidelines 04/2021 Codes of Conduct as tools for transfers Guidelines on codes of conduct and monitoring bodies Guidelines ·EDPB Feb 22, 2022 International Transfer Processing Agreement Codes of Conduct
Opinion 15/2025 certification criteria of BDO Consulting GmbH ·Opinion ·EDPB Jul 14, 2025 Certification Supervision Supervisory Authorities