Content type · 1,205 documents in this view · 3,831 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Country: Spain (50) Clear filter
Filter by Topic Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 500 on a private individual. The controller had installed a surveillance camera on his property, which recorded, among other… SPAIN · ·Art. 5 May 12, 2022
€2,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on a private individual. The individual had shared a video on WhatsApp showing images of a violent attack on the data subject… SPAIN · ·Art. 6 May 12, 2022
€6,000 Homeowners Association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 6,000 on a homeowners' association. An apartment owner who had been a resident for 15 years had filed a complaint with the DPA due… SPAIN · ·Art. 5, 13 May 11, 2022
€600 Bar owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a bar owner EUR 600. The bar operated a video surveillance system in which the observation angle of the cameras extended into the public space. The… SPAIN · ·Art. 5 May 11, 2022
€300 Store owner: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 300 on a store owner. The controller had requested various personal data from customers for appointment bookings. The DPA found… SPAIN · ·Art. 13 May 10, 2022
€1,200 CONTIMAG INVEST, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined CONTIMAG INVEST, S.L. EUR 1,200 for failing to provide sufficient information on video surveillance in one of the restaurants it operates SPAIN · ·Art. 13 May 9, 2022
€5,000 MISTORE CANARIAS, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on MISTORE CANARIAS, S.L.. A person who had made a purchase from the company had filed a complaint against the company with… SPAIN · ·Art. 6 May 3, 2022
€4,200 CLÍNICA DENTAL SAN FRANCISCO, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) has imposed a fine on CLÍNICA DENTAL SAN FRANCISCO, S.L.. A data subject had filed a complaint with the AEPD against the controller due to the fact that the… SPAIN · ·Art. 17, 21 Apr 29, 2022
€16,000 LABORATORIOS GONZÁLEZ, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined LABORATORIOS GONZÁLEZ, S.L.. The laboratory had sent the results of a Covid-19 test that the data subject had taken not only to them but also to… SPAIN · ·Art. 5 Apr 29, 2022
€1,500 CAFFE VECCHIO, S.L.: Insufficient legal basis for data processing The Spanish DPA has fined CAFFE VECCHIO, S.L. EUR 1,500. A former employee of the café had filed a complaint with the DPA. The operator of the café had responded to negative… SPAIN · ·Art. 5, 6 Apr 28, 2022
€40,000 Working Capital Management España, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 40,000 on the credit information agency Working Capital Management España, S.L.. A data subject had filed a complaint with the… SPAIN · ·Art. 6 Apr 28, 2022
€15,000 MEDEROS MOVITEN, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 15,000 on MEDEROS MOVITEN, S.L.. The data subject had signed a mobile service contract with the company. However, the company also… SPAIN · ·Art. 6 Apr 28, 2022
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Apr 27, 2022
€1,200 MOVALIA TRASLADOS, S.L.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on MOVALIA TRASLADOS, S.L.U.. During its investigation, the DPA found numerous deficiencies on a website operated by the controller. For… SPAIN · ·Art. 6, 13 Apr 23, 2022
€5,600 Physician: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined a physician. The physician had used recordings of a patient's treatment for advertising purposes. However, the patient had not consented to this.… SPAIN · ·Art. 6 Apr 22, 2022
AEPD admits claim against Securitas Direct for failure to handle access and erasure Resolution No. R/00665/2022 is highlighted by a case concerning a claimant (namely A.A.A) and a respondent party (namely Securitas Direct España, S.A). The claimant filed against… R/00665/2022 ·Spain ·Art. 17, 55 Apr 22, 2022
€600 DOOR2DOOR SPAIN, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine on DOOR2DOOR SPAIN, S.L.. The controller had failed to implement measures repeatedly ordered by the DPA in due time. Also, the controller had… ·Art. 58 ·Insufficient cooperation with supervisory authority Apr 19, 2022
€1,800 FLORAQUEEN FLOWERING THE WORLD S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined FLORAQUEEN FLOWERING THE WORLD S.L. for failing to provide information requested by the DPA during an investigation. The original fine of EUR 3,000 was… SPAIN · ·Art. 58 Apr 18, 2022
€9,000 JIMBO NETWORKS, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine on JIMBO NETWORKS, S.L.. During its investigation, the DPA found numerous deficiencies on a website operated by the controller. For… SPAIN · ·Art. 6, 13, 22 Apr 18, 2022
€1,800 Website operator: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine on the operator of the website link During its investigation, the DPA found numerous deficiencies on a website operated by the… SPAIN · ·Art. 6, 13, 22 Apr 18, 2022
€8,000 RAMONA FILMS, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) fined RAMONA FILMS, S.L. for failing to ensure that the company's privacy policy complied with the requirements of Art. 13 GDPR. Specifically, the website… SPAIN · ·Art. 13, 22 Apr 13, 2022
€500 Homeowners Association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 500 on a homeowners' association. The executive board of the owners' association had publicly posted a list of defaulting owners. The DPA… SPAIN · ·Art. 5 Apr 12, 2022
€150,000 BASER COMERCIALIZADORA DE REFERENCIA, S.A.: Insufficient legal basis for data processing The Spanish DPA has fined BASER COMERCIALIZADORA DE REFERENCIA, S.A., EUR 150,000. A customer of the company had filed a complaint with the DPA since their electricity supply… SPAIN · ·Art. 6, 32 Apr 11, 2022
€1,200 FRUTAS Y VERDURAS LOS CAMPEONES, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on FRUTAS Y VERDURAS LOS CAMPEONES, S.L.. The controller had installed a video surveillance system, however, without having… SPAIN · ·Art. 13 Feb 23, 2022
€1,500 WORLDWIDE CLASSIC CARS NETWORK S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on WORLDWIDE CLASSIC CARS NETWORK S.L.. The controller had installed video surveillance cameras which, among other things,… SPAIN · ·Art. 5, 13 Feb 23, 2022
€1,000 MALAGATROM, S.L.U.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 1,000 on MALAGATROM, S.L.U. for failing to comply with an order issued by the DPA. SPAIN · ·Art. 58 Feb 22, 2022
€3,000 Hotel operator: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a hotel operator. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Feb 22, 2022
€1,000 Store owner: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined a store owner EUR 1,000 for failing to provide information signs about CCTV surveillance in the establishment. SPAIN · ·Art. 13 Feb 21, 2022
€1,500 RESTATURANTE FUENTEBRO, S.C.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined RESTATURANTE FUENTEBRO, S.C. EUR 1,500 for failing to provide information signs about CCTV surveillance in the establishment. SPAIN · ·Art. 13 Feb 21, 2022
€2,500 Private person: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 2,500 on a private individual. The controller had installed video surveillance cameras at his house which, among other things,… SPAIN · ·Art. 5, 13 Feb 18, 2022
€6,000 Private individual: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 6,000 on a private individual. The data subject had filed a complaint against the data controller for publishing images of herself… SPAIN · ·Art. 6 Feb 16, 2022
€1,600 RECLAMADOR, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) has imposed a fine RECLAMADOR, S.L.. A data subject had filed a complaint with the AEPD against the controller due to the fact that the controller continued… SPAIN · ·Art. 17, 21 Feb 14, 2022
€2M Amazon Road Transport Spain S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined Amazon Road Transport Spain S.L. EUR 2,000,000. The AEPD had received a complaint from a trade union against the company. Amazon Road required… ·Art. 6, 10 ·Insufficient legal basis for data processing Feb 11, 2022
€10,000 PINTODIS, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined PINTODIS, S.L. EUR 10,000. The controller had installed several video cameras which also covered the food areas and changing rooms of their employees.… SPAIN · ·Art. 5 Feb 7, 2022
€1,000 Cafe operator: Non-compliance with general data processing principles The cafe used CCTV cameras which also captured the public space outside resulting in a violation of the so called principle of data minimisation. SPAIN · ·Art. 5 Feb 7, 2022
€900 Private person: Non-compliance with general data processing principles Unlawful usage of video surveillance cameras which also monitored parts of the public space (violation of principle of data minimization). SPAIN · ·Art. 5 Feb 4, 2022
€300,000 SEGURCAIXA ADESLAS, S.A. DE SEGUROS Y REASEGUROS: Insufficient legal basis for data processing The Spanish DPA (AEPD) fined SEGURCAIXA ADESLAS, S.A. DE SEGUROS Y REASEGUROS. in the amount of EUR 300,000. The data subject had received marketing emails from the controller… SPAIN · ·Art. 6, 17, 28 Feb 4, 2022
€2,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on a private individual. The individual had published audiovisual material of a court trial on Twitter without obtaining the… SPAIN · ·Art. 6 Feb 4, 2022
€2,000 ASESORES DE SEGURIDAD PRIVADA, S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 2,000 on ASESORES DE SEGURIDAD PRIVADA, S.L.. The DPA criticized that the controller did not sufficiently inform the data subject about… SPAIN · ·Art. 13 Feb 2, 2022
€70,000 ORANGE ESPAÑA VIRTUAL, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined ORANGE ESPAÑA VIRTUAL, S.L. EUR 70,000. Two Orange España Virtual customers had filed complaints with the DPA. In the course of its investigation, the… SPAIN · ·Art. 5 Feb 1, 2022
€900,000 TELEFÓNICA MÓVILES ESPAÑA, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has fined TELEFÓNICA MÓVILES ESPAÑA, S.A.U. EUR 900,000. Four Telefónica customers had filed complaints with the DPA. In the course of its investigation, the DPA… SPAIN · ·Art. 5 Feb 1, 2022
€3.9M Vodafone España, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has fined Vodafone España, S.A.U. EUR 3.94 million. Nine Vodafone customers had filed complaints with the DPA. In the course of its investigation, the DPA found… SPAIN · ·Art. 5 Feb 1, 2022
€700,000 Orange Espagne S.A.U.: Non-compliance with general data processing principles The Spanish DPA has fined Orange Espagne S.A.U. EUR 700,000. Two Orange Espagne customers had filed complaints with the DPA. In the course of its investigation, the DPA found that… SPAIN · ·Art. 5 Feb 1, 2022
€200,000 XFERA MÓVILES, S.A.: Non-compliance with general data processing principles The Spanish DPA has fined XFERA MÓVILES, S.A. EUR 200,000. Two Xfera customers had filed complaints with the DPA. In the course of its investigation, the DPA found that fraudsters… SPAIN · ·Art. 5 Feb 1, 2022
€5,000 Cyrana España General S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined Cyrana España General S.L. EUR 5,000. The controller had sent an invoice to the data subject although no contractual relationship existed. SPAIN · ·Art. 6 Jan 31, 2022
€1,500 Property Owner Community: Insufficient legal basis for data processing Use of CCTV cameras in building complex without obtaining the consent of all the property owners. SPAIN · ·Art. 6 Jan 31, 2022
€5,000 INCOPROSOL, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined INCOPROSOL, S.L. EUR 5,000. The controller had recorded a telephone conversation with a customer without obtaining the customer's consent. SPAIN · ·Art. 5 Jan 31, 2022
€1,200 Property Owner Community: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a property owners' community EUR 1,200. A property manager had sent a copy of the general meeting minutes to the director of the security company… SPAIN · ·Art. 5 Jan 21, 2022
€2,000 Website operator: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) imposed a fine of EUR 2,000 on a website operator for the lack of a privacy policy on its website, in violation of Art. 13 GDPR. SPAIN · ·Art. 13 Jan 21, 2022
€56,000 VODAFONE ESPAÑA, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on VODAFONE ESPAÑA, S.A.U. due to insufficient legal basis for data processing. The data subject states that two telephone connections were… SPAIN · ·Art. 6 Jan 18, 2022