Skip to content
Enforcement · AEPD (Spain)

A data subject sent a complaint to Giants Gaming Esports S.L

PS/00114/2026gdprhub.eu ↗

Holding

The DPA held that whilst it is true that the exposure of the filing system did not make the information available on websites, search engines and on social media. The DPA took into account the fact that the data was visible and accessible via the internet for almost a month. This ultimately affected the confidentiality of 80,581 data subjects’ personal data. This in connection with the fact that someone created this filing system, which was an unusual practice, was a clear indication for the DPA that the controller lacked the necessary technical and organisational measures to mitigate against a data breach risk. As a result, the DPA held that the controller was in violation of Article 32 GDPR. The fine was initially set at €6,000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The controller opted to make a voluntary payment and reduced the fine by 20%, paying the reduced sanction amount of €4,800.

From GDPRhub’s case note — a summary of the decision, not its own words.

Full text

1/45  Case No.: EXP202311912 DECISION TO TERMINATE THE PROCEEDINGS DUE TO VOLUNTARY PAYMENT Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On June 30, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate disciplinary proceedings against GIANTS GAMING ESPORTS, S.L. (hereinafter, GIANTS). After notifying GIANTS of the decision to initiate proceedings and analyzing the arguments submitted, on June 1, 2026, the proposed resolution was issued, as transcribed below: > SECOND: On June 16, 2026, GIANTS paid the penalty in the amount of 4,800.00 euros, taking advantage of the reduction provided for in the draft resolution transcribed above. LEGAL GROUNDS I Jurisdiction In accordance with the powers granted to each supervisory authority under Article 58(2) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) grants to each supervisory authority, and as established in Articles 47, 48.1, 64.2, and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to resolve this proceeding. Likewise, Article 63.2 of the LOPDGDD provides that: “Proceedings handled by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, this Organic Law, the adopted to implement it, and, to the extent they do not contradict them, on a subsidiary basis, by the general rules on administrative proceedings.” 28001 - Madrid 6 sedeagpd.gob.es 43/45 II Termination of Proceedings Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), under the heading “Termination of Disciplinary Proceedings,” provides as follows: “1. Once disciplinary proceedings have been initiated, if the offender acknowledges liability, the proceedings may be resolved by imposing the appropriate penalty. 2. When the sanction is solely of a pecuniary nature, or when it is appropriate to impose both a pecuniary sanction and a non-pecuniary sanction but the inappropriateness of the latter has been established, voluntary payment by the alleged offender, at at any time prior to the final decision, shall result in the termination of the proceedings, except with respect to the restoration of the altered situation or the determination of compensation for damages caused by the commission of the violation. 3. In both cases, when the penalty is solely financial in nature, the body competent to resolve the proceedings shall apply reductions of at least 20% of the amount of the proposed penalty, which may be cumulative. The aforementioned reductions must be specified in the notice of initiation of the proceedings, and their effectiveness shall be conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty. “The reduction percentage provided for in this section may be increased by regulation.” III Voluntary Payment In accordance with the provisions of the aforementioned Article 85 of the LPACAP, the notified proposed resolution allowed you to make a voluntary payment of the proposed penalty, which would result in a 20% reduction of its amount. With the application of this reduction, the penalty would be set at 4,800.00 euros, and its payment would result in the termination of the proceedings, without prejudice to the imposition of the corresponding measures. Following the aforementioned proposed resolution, and before a decision was issued by this authority, GIANTS, on June 16, 2026, proceeded to make the voluntary payment, availing itself of the 20% reduction. In accordance with paragraph 3 of Article 85 of the LPACAP, the effectiveness of said reduction is conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty. It should be noted that, in accordance with the provisions of the LPACAP, as well as the case law of the Supreme Court on this matter, the making of a voluntary payment by the alleged liable party does not exempt the administration from the obligation to resolve and notify all proceedings, regardless of how they were initiated. Similarly, Article 88 of the aforementioned law establishes that the decision 28001 - Madrid 6 sedeagpd.gob.es 44/45 that brings the proceeding to a close shall resolve all issues raised by the data subjects and any others arising therefrom. Therefore, in accordance with applicable law and after assessing the criteria for determining the severity of sanctions, the Presidency of the Spanish Data Protection Agency RESOLVES: FIRST: TO DECLARE that the violations have been committed and TO CONFIRM the penalties set forth in the operative part of the proposed resolution transcribed in this resolution. The sum of the aforementioned amounts totals 6,000.00 euros. Since GIANTS GAMING ESPORTS, S.L. has made a voluntary payment, although without acknowledging liability, pursuant to Article 85 of the LPACAP, a 20% reduction of the aforementioned total, resulting in a final amount of 4,800.00 euros. The effectiveness of the aforementioned reduction is conditional, in any case, upon the withdrawal or waiver of any administrative action or appeal. SECOND: TO DECLARE the termination of proceeding EXP202311912, in accordance with the provisions of Article 85 of the LPACAP. THIRD: TO NOTIFY GIANTS GAMING ESPORTS, S.L. of this decision. FOURTH: In accordance with the provisions of Article 85 of the LPACAP, which makes the reduction for voluntary payment conditional upon the withdrawal or waiver of any action or administrative appeal, this decision shall be final in administrative proceedings and fully enforceable as of the date of its notification. In accordance with the provisions of Article 50 of the LOPDGDD, this Decision shall be made public. Publication shall take place once the decision has been notified to the data subjects. This resolution, which concludes the administrative proceedings as provided for in Article 114.1.c) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, data subjects may file an administrative appeal before the Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, within two months from the day following notification of this decision, as provided for in Article 46.1 of the aforementioned Law. However, in accordance with the provisions of Article 90.3(a) of the LPACAP, the final administrative decision may be provisionally suspended if the data subject expresses their intention to file a contentious-administrative appeal. If this is the case, the data subject must formally notify this fact in writing 28001 - Madrid 6 sedeagpd.gob.es 45/45 addressed to the Spanish Data Protection Agency, submitting it through the Agency’s Electronic Registry , or through any of the other registries provided for in Art 16.4 of the aforementioned Law 39/2015, of October 1. You must also submit to the Agency the documentation proving that the contentious-administrative appeal has been effectively filed. If the Agency is not notified of the filing of the contentious-administrative appeal within two months from the day following notification of this decision, it will consider the precautionary suspension to have ended. 968-101025 Lorenzo Cotino Hueso President of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es