Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L.: Insufficient legal basis for data processing
The Spanish DPA has imposed fine on SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L.
Full text
The Spanish DPA has imposed fine on SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L. The controller offers fitness courses which are recorded and published. The consent obtained for the processing does not meet the legal standards. Additionally the controller does not limit the retention period of the data.. The original fine of EUR 36,000 was reduced to EUR 21,600 due to immediate payment and admission of responsibility by the controller.
Industry: Industry and Commerce
How it connects
Related across sources
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data
C-231/22 État belge v Autorité de protection des données In Case C-231/22, the Court of Justice of the European Union interpreted Article 4(7) and Article 5(2) of the GDPR in response to a preliminary reference from the Brussels Court… CJEU ·Third Chamber Jan 11, 2024 Controllers Personal Data Public Authority
C-136/17 GC and Others v CNIL C-136/17 (GC and Others) CJEU Sep 24, 2019 Right to be Forgotten Legitimate Interest Criminal Data
C-634/21 OQ v Land Hessen In Case C-634/21, the CJEU addressed a preliminary ruling from the Verwaltungsgericht Wiesbaden concerning OQ's challenge against Land Hessen's refusal to order SCHUFA Holding AG… CJEU ·First Chamber Dec 7, 2023 Profiling Automated Decision-Making Marketing
W292 2298015-1 The data subject was a customer of a bank (controller) The data subject withdrew their consent to the processing of their e-mail address and phone number by the controller, and requested the deletion thereof. The data was not deleted.… BVwG - W292 2298015-1 ·Federal Administrative Court Jun 10, 2026 Legitimate Interest Personal Data Consent
W137 2333649-1 Federal Administrative Court: retention of job applicant data for potential legal claims The data subject applied for a job with the association and provided additional documents, regarding the use of their personal data. Among other things, it was stated that the… Jul 8, 2026 Storage Limitation Retention Period Right to be Forgotten