Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
SIDECU, S.A.: Non-compliance with general data processing principles
The Spanish DPA imposed a fine of EUR 96,000 on SIDECU, S.A.
Full text
The Spanish DPA imposed a fine of EUR 96,000 on SIDECU, S.A. The controller introduced facial recognistion system as the only access method to their facilities, without offering alternative access methodes. The controller did not have a sufficient legal basis for processing the data, failed to adequately inform the data subjects about the processing, and failed to carry out a data protection impact assessment. The original fine of EUR 160,000 was reduced to EUR 96,000 due to immediate payment and admission of responsibility by the controller.
Industry: Industry and Commerce
How it connects
Related across sources
Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines Jul 7, 2021 Controllers Processors IP Address
Guidelines 4/2019 Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines on data protection by design and by default Guidelines Oct 20, 2020 Privacy by Design & Default Privacy by Default Privacy by Design
Guidelines 1/2019 Codes of Conduct and Monitoring Bodies under Regulation 2016/679 Guidelines on codes of conduct and monitoring bodies Guidelines Jun 4, 2019 Accountability Codes of Conduct GDPR Article 5 Principles of Processing
Opinion 6/2019 draft list of the competent supervisory authority of Spain regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted 1 EDPB Plenary m eeting, 12 - 13 March 2019 - Item 2.3.1 Opinion 6 /201 9 on the draft list of the competent supervisory authority of Spain regarding the processing… Opinion Mar 12, 2019 DPIA Supervision Supervisory Authorities
Opinion 13/2019 draft list of the competent supervisory authority of France regarding the processing operations exempt from the requirement of a data protection impact assessment (Article 35(5) GDPR) Opinion Jul 12, 2019 DPIA Supervision Supervisory Authorities
Opinion 7/2019 draft list of the competent supervisory authority of Iceland regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted 1 EDPB Plenary m eeting, 12 - 13 March 2019 - Item 2.3.1 Opinion 7 /201 9 on the draft list of the competent supervisory authority of Iceland regarding the processing… Opinion Mar 12, 2019 DPIA Supervision Supervisory Authorities