Content type · 1,205 documents in this view · 3,831 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Country: Spain (50) Clear filter
Filter by Topic Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€300 Private Person: Non-compliance with general data processing principles Usage of CCTV camera that was also capturing foreign private space of a neighbour and the public space. Art. 5 Jul 27, 2022
€800 EFS MANTENIMIENTO Y SERVICIOS TÉCNICOS, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined EFS MANTENIMIENTO Y SERVICIOS TÉCNICOS, S.L. EUR 800. A trade union had filed a complaint with the DPA because the company had unauthorizedly shared… Art. 5 Jul 26, 2022
€2,500 Homeowners Association: Non-compliance with general data processing principles The Spanish DPA has fined a homeowners association EUR 2,500 for publishing information (name, surname, apartments) regarding several owners on their website. Art. 5 Jul 26, 2022
€15,000 TELEFÓNICA MÓVILES ESPAÑA, S.A.U.: Insufficient legal basis for data processing A former customer had received e-mails containing electronic bills even after they had terminated their contract with the company resulting in a processing of personal data… Art. 6 Jul 26, 2022
€500 CINCON S.C.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 500 on CINCON S.C.. The company had failed to provide the information required by Art. 13 GDPR on a form through which potential… Art. 13 Jul 22, 2022
€40,000 ESVETEL, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) imposed a fine of EUR 40,000 on ESVETEL, S.L.. The data subject had received an advertising call from the controller made on behalf of Vodafone España,… Art. 28, 48 Jul 22, 2022
€600 Private individual: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 600 on a private individual. The individual had failed to implement measures repeatedly ordered by the DPA in due time. Art. 58 Jul 19, 2022
€5,000 Bar owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a bar owner EUR 5,000. The owner had unlawfully shared recordings from the CCTV in the bar via WhatsApp and other social media platforms. Art. 5 Jul 19, 2022
€2,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of 2,000 euros on a private individual. The individual had installed video cameras in the apartment building where they live that recorded,… Art. 5 Jul 19, 2022
€4,000 Bookstore employee: Insufficient technical and organisational measures to ensure information security The Spanish Data Protection Agency has imposed a fine of EUR 4,000 on an employee of a bookstore. An individual had filed a complaint with the DPA because he had received an… Art. 5, 32 Jul 19, 2022
€56,000 BANKINTER, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 56,000 on BANKINTER, S.A.. The controller had inadvertently sent a report on the data subject's investment portfolio to a third party.… Art. 5 Jul 18, 2022
€3,600 ECOZONO Y CULTURA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on ECOZONO Y CULTURA, S.L.. Econzo, through a service provider, had collected data from data subjects who agreed to disclose the data for survey… Art. 6 Jul 15, 2022
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… Art. 5, 13 Jul 15, 2022
€132,000 DKV Seguros y Reaseguros, S.A.E.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on DKV Seguros y Reaseguros, S.A.E.. An individual had filed a complaint with the DPA after receiving multiple e-mails from the controller… Art. 5, 32, 33 Jul 13, 2022
€6,000 FREE SUN ENERGY S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on FREE SUN ENERGY S.L.. A customer of the company had filed a complaint with the DPA because instead of receiving their invoice, they had… Art. 5, 32 Jul 12, 2022
€1,600 JOYPAZAR, S.A.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of 1,600 on JOYPAZAR, S.A.. The company had installed video surveillance cameras which, among other things, also covered a public… Art. 5 Jul 12, 2022
€800 SMART ELECTRIC SOLUTIONS, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 800 on SMART ELECTRIC SOLUTIONS, S.L.. The company had installed video surveillance cameras which, among other things, also… Art. 5, 13 Jul 12, 2022
€1,800 FINCAS ARENYS SL: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on FINCAS ARENYS SL. An individual had filed a complaint with the DPA. The individual had contacted the real estate company in order to rent a… Art. 13 Jul 7, 2022
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. due to insufficient legal basis for data processing. The data subject stated that, unauthorized third parties had… Art. 6 Jul 6, 2022
€3,000 ASOCIACIÓN DE AFICIONADOS Y PEQUEÑOS ACCIONISTAS UNIDAD HERCULANA: Non-compliance with general data processing principles The Spanish DPA (AEPD) imposed a fine of EUR 3,000 on ASOCIACIÓN DE AFICIONADOS Y PEQUEÑOS ACCIONISTAS UNIDAD HERCULANA for the lack of a privacy policy on its website, in… Art. 5, 13 Jul 6, 2022
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… Art. 5, 13 Jul 5, 2022
€500 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 500 for the unauthorized installation of a video surveillance camera on their property. The cameras recorded public space and… Art. 5 Jul 1, 2022
€300 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 300 for the unauthorized installation of a video surveillance camera on their property. The cameras recorded public space and… Art. 5 Jul 1, 2022
€3,000 FLY FUT, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine against FLY FUT, S.L., a company specialized in drone footage at soccer matches in the amount of EUR 3,000. A father had filed a complaint with… Art. 6 Jun 28, 2022
€1,000 Company: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on a company. The company had requested various personal data from customers for appointment bookings. The DPA found that… Art. 13 Jun 28, 2022
€180 Store owner: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined a store owner EUR 180 for failing to provide information signs about CCTV surveillance in the establishment. Art. 13 Jun 24, 2022
€30,000 RADIO TELEVISION MADRID, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on RADIO TELEVISION MADRID, S.A.. Several media outlets, including the controller had published an audio recording of a multiple rape victim's… Art. 5 Jun 23, 2022
€30,000 CORPORACIÓN DE RADIO Y TELEVISIÓN ESPAÑOLA S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on CORPORACIÓN DE RADIO Y TELEVISIÓN ESPAÑOLA S.A. Several media outlets, including the controller had published an audio recording of a… Art. 5 Jun 23, 2022
€1,600 URQUÍA & BAS, CORREDURÍA DE SEGUROS S.L.: Insufficient fulfilment of data breach notification obligations The spanish DPA has fined URQUÍA & BAS, CORREDURÍA DE SEGUROS S.L.for failing to report a data breach to the DPA in a timely manner. The original fine of EUR 2,000 was reduced to… Art. 33 Jun 22, 2022
€1,000 Company: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined a company EUR 1,000 for failing to provide information signs about CCTV surveillance in its premises. Art. 13 Jun 17, 2022
€1,000 SCOTCH CORNER BAR: Non-compliance with general data processing principles The Spanish DPA has fined the bar operator SCOTCH CORNER BAR EUR 1,000. The controller had installed a CCTV which also covered parts of the public space. Furthermore the… Art. 5, 58 Jun 16, 2022
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has fined a private individual EUR 10,000. The individual had created a humiliating and discriminatory video of three siblings based on their skin color, and… Art. 6 Jun 9, 2022
€600 Private individual: Non-compliance with general data processing principles Usage of CCTV camera that was also capturing foreign private space of a neighbour and the public space. Art. 5 Jun 9, 2022
€1,000 Store owner: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined a store owner EUR 1,000 for failing to provide information signs about CCTV surveillance in the establishment. Art. 13 Jun 3, 2022
€360 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 360 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… Art. 5, 13 Jun 3, 2022
€3,000 LODEJU, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on the restaurant operator LODEJU, S.L.. The controller had installed video surveillance cameras in its premises which,… Art. 5, 13 Jun 3, 2022
€300 Private individual: Non-compliance with general data processing principles Usage of CCTV camera that was also capturing foreign private space of a neighbour and the public space. Art. 5 Jun 1, 2022
€1,600 CORON ISLAND SLU: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,600 on CORON ISLAND SLU. A customer had filed a complaint with the DPA against the restaurant. The customer had asked for a bill in her… Art. 5 May 31, 2022
€42,000 Alquiler Seguro SA: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 42,000 on Alquiler Seguro SA. The company had advertised a job for which the data subject had applied. As part of the application… Art. 6 May 24, 2022
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. The controller had installed video surveillance cameras in his car which, among other things, also… Art. 5 May 20, 2022
€2,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has fined a private individual operating three websites EUR 2,000. During its investigation, the DPA found that all three websites lacked a field for giving… Art. 6 May 20, 2022
€2,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on a private individual. The individual had taken photos of a group of minors as well as police officers without their consent and… Art. 6 May 20, 2022
€600 SCF ZHU, S.L.: Insufficient fulfilment of information obligations The Spanish DPA has fined SCF ZHU, S.L. due to a lack of sufficient data processing information in relation to video surveillance on business premises. The original fine of EUR… Art. 13 May 18, 2022
€10M Google LLC: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 10 million on GOOGLE LLC. Two data subjects had complained to the DPA that Google had disclosed their personal data to third… Art. 6, 17 May 18, 2022
€8,000 TIGERS MARKET, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) imposed a fine of EUR 8,000 on TIGERS MARKET, S.L.. The data subject had received advertising calls from the controller, although the data subject was… Art. 21, 23, 48 May 17, 2022
€18,000 RAMONA FILMS, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA (AEPD) has fined RAMONA FILMS, S.L. for failing to provide information requested by the DPA during an investigation. The original fine of EUR 30,000 was reduced to… Art. 58 May 17, 2022
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. The controller had installed video surveillance cameras on his property which, among other things,… Art. 5 May 17, 2022
€4,000 INSEKT FOOD S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 4,000 on INSEKT FOOD S.L.. A data subject hat filed a complain with the DPA against the controller due to the fact that the… Art. 6 May 17, 2022
€42,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on Vodafone España S.A.U.. A data subjects had filed a complaint with the AEPD against the controller. The data subject complained about… Art. 6 May 17, 2022
€170,000 Mercadona S.A.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 170,000 on the supermarket chain Mercadona S.A.. An individual had filed a complaint with the DPA. The individual had suffered an… Art. 6, 12, 15 May 13, 2022