# GSMA Limited: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2024-05-31
- Original: https://www.enforcementtracker.com/ETid-2545
- Canonical: https://overview.legal/posts/48660
- Topics: Archiving, Processing Agreement, Personal Data, Processing, Supervisory Authorities, Law Enforcement

## Summary

The Spanish DPA has imposed a fine of EUR 600,000 on GSMA Limited. In 2022, GSMA Limited required employees of its suppliers to register on an online platform and upload proof of vaccination against COVID-19. One of the data subjects filed a complaint with the DPA as they considered the data processing to be unlawful. GSMA referred to a legal obligation and public interest, but could not provide a specific legal basis. The DPA found that less invasive safeguards would have been possible and that

## Full text

The Spanish DPA has imposed a fine of EUR 600,000 on GSMA Limited. In 2022, GSMA Limited required employees of its suppliers to register on an online platform and upload proof of vaccination against COVID-19. One of the data subjects filed a complaint with the DPA as they considered the data processing to be unlawful. GSMA referred to a legal obligation and public interest, but could not provide a specific legal basis. The DPA found that less invasive safeguards would have been possible and that the affected workers were not sufficiently informed about the data processing.

GDPR Articles: Art. 6 (1), Art. 9 (2) GDPR, Art. 14 GDPR
Industry: Individuals and Private Associations

---
Generated by overview.legal · https://overview.legal/posts/48660 · 2026-08-22