Content type · 1,205 documents in this view · 3,831 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Country: Spain (50) Clear filter
Filter by Topic Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€40,000 VODAFONE SERVICIOS, S.L.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on VODAFONE SERVICIOS, S.L.U.. A data subject has filed a complaint with the AEPD against the data controller. The data subject states… SPAIN ·Art. 6 Oct 26, 2021
€3,000 MERCEDES GERENCIA, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on MERCEDES GERENCIA, S.L.. The controller failed to respond to a request for information from the DPA in a timely manner. SPAIN ·Art. 58 Oct 25, 2021
€3M CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 3,000,000 on CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.. An individual had filed a complaint against the controller. The reason… SPAIN ·Art. 6 Oct 21, 2021
€70,000 Vodafone España, S.A.U.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) has imposed a fine of EUR 70,000 on VODAFONE ESPAÑA, S.A.U.. A data subject had filed a complaint with the DPA for having received promotional emails from… SPAIN ·Art. 21 Oct 19, 2021
€40,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined Vodafone España, S.A.U. EUR 40,000. An individual had filed a complaint with the DPA against Vodafone for debiting his bank account in May 2020… SPAIN ·Art. 6 Oct 19, 2021
€2,000 BEEPING FULFILMENT S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined BEEPING FULFILMENT S.L. in the amount of EUR 2,000. The controller had not provided the required information about the purposes and… SPAIN ·Art. 13 Oct 19, 2021
€40,000 Vodafone España, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A woman filed a complaint against the controller based on the fact that the controller had sent telephone bills… SPAIN ·Art. 5, 32 Oct 13, 2021
€10,000 MAF.COM ESQUI CLUB: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 10,000 on MAF.COM ESQUI CLUB. The mother of an underage girl who had attended ski lessons with the controller filed a complaint… SPAIN ·Art. 7 Oct 11, 2021
€30,000 ORANGE ESPAGNE, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on ORANGE ESPAGNE, S.A.U.. A data subject had filed a complaint with the DPA as she had received a total of 30 calls from Jazztel employees… SPAIN ·Art. 6 Oct 8, 2021
€4,000 CLUB DEPORTIVO SANSUEÑA, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined CLUB DEPORTIVO SANSUEÑA, S.L. EUR 4,000 for adding the cell phone number of a data subject to a WhatsApp group without the data subject's consent. SPAIN ·Art. 5, 6, 32 Oct 5, 2021
€2,000 Store owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on the owner of a store. The controller had installed a video surveillance system that covered, among other things, a public… SPAIN ·Art. 5 Oct 4, 2021
€1,000 Store owner: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on the owner of a store. The controller had installed a video surveillance system, however, without having placed signs… SPAIN ·Art. 13 Oct 4, 2021
€5,000 CALDERERIA Y SOLDADURA DE ESTRUCTURAS METALICAS, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined CALDERERIA Y SOLDADURA DE ESTRUCTURAS METALICAS, S.L. EUR 5,000 for unlawfully processing an individual's data. Previously, CYNGASA, S.L. had… SPAIN ·Art. 6 Oct 4, 2021
€5,000 CYNGASA, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on CYNGASA, S.L.. The data subject, when requesting a work report, discovered that the controller had disclosed his personal… SPAIN ·Art. 6 Sep 29, 2021
€10,000 ACONCAGUA JUEGOS S.A.: Insufficient involvement of data protection officer The Spanish DPA (AEPD) has imposed a fine of EUR 10,000 on ACONCAGUA JUEGOS S.A.. The controller had failed to appoint a data protection officer and thus violated Art. 37 GDPR. SPAIN ·Art. 37 Sep 29, 2021
€3,000 Bar owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a bar owner EUR 3,000. A data subject had filed a complaint with the DPA. He had suffered an accident in the bar which was recorded by the… SPAIN ·Art. 5 Sep 28, 2021
€3,000 SPAIN DPA: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a company. The company had requested various personal data from customers for appointment bookings. The DPA found that… Art. 13 ·Insufficient fulfilment of information obligations Sep 24, 2021
€18,000 CEDICO, CENTRO DE DIAGNÓSTICO POR LA IMÁGEN, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on CEDICO, CENTRO DE DIAGNÓSTICO POR LA IMÁGEN, S.L.. The data subject filed a complaint with the AEPD. He had requested an MRI scan of… SPAIN ·Art. 5 Sep 20, 2021
€4,000 Frigorifica Botana S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 4,000 on Frigorifica Botana S.L.. The main activity of Frigorífica Botana is freezing, storing and processing seafood. Based on a… SPAIN ·Art. 5 Sep 16, 2021
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. for insufficient legal basis for data processing. The data subject stated that he received a call from Vodafone in… SPAIN ·Art. 6 Sep 14, 2021
€40,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. for insufficient legal basis for data processing. The data subject stated that two telephone lines were registered… SPAIN ·Art. 6 Sep 14, 2021
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. for insufficient legal basis for data processing.The data subject stated that several telephone lines were… SPAIN ·Art. 6 Sep 14, 2021
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. due to insufficient legal basis for data processing. The data subject stated that, unauthorized third parties had… SPAIN ·Art. 6 Sep 14, 2021
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. due to insufficient legal basis for data processing. The data subject stated that unauthorized third parties… SPAIN ·Art. 6 Sep 14, 2021
€9,000 Website operator: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 9,000 on the controller of a website. A person had filed a complaint with the DPA due to the fact that the controller had… SPAIN ·Art. 6, 13 Sep 13, 2021
€1,000 GESTIONES AUTO LOW COST S. L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) imposed a fine of EUR 1,000 on GESTIONES AUTO LOW COST S. L. due to the fact that the company's website did not contain a privacy policy. SPAIN ·Art. 13 Sep 13, 2021
€1,000 Hairdressing salon: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on a hairdressing salon. The controller had installed video surveillance cameras and had not properly informed the data… SPAIN ·Art. 13 Sep 13, 2021
€1,500 AMPUDIA DIAZ, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on AMPUDIA DIAZ, S.L.. The controller had installed a video surveillance system in its premises, which recorded a public… SPAIN ·Art. 5, 13 Sep 4, 2021
€4,000 Automecanica Jerez, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA (AEPD) has fined Automecanica Jerez, S.L. EUR 4,000. The controller had sent commercial e-mails to a large number of people without their consent. In doing so, the… SPAIN ·Art. 5, 21, 32 Sep 2, 2021
€6,000 Furnishyourspace S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) imposed a fine of EUR 6,000 on FurnishYourSpace S.L.. The AEPD had received a complaint from the Berlin DPA via the EU Internal Market Information System… SPAIN ·Art. 5, 6, 12 +2 Aug 30, 2021
€1,000 Owners Association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on an owners' association. The controller had unlawfully installed a video surveillance system in a residential complex… SPAIN ·Art. 5 Aug 26, 2021
€120,000 Banco Bilbao Vizcaya Argentaria, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA (AEPD) has imposed a fine on Banco Bilbao Vizcaya Argentaria, S.A.. The reason for this had been a complaint from a person relating to a lack of authentication.… SPAIN ·Art. 32 Aug 25, 2021
€1,800 Agency: Insufficient technical and organisational measures to ensure information security The Spanish DPA (AEPD) has imposed a fine on an agency. The controller had disposed of documents containing personal data of its clients in the garbage. The AEPD considered this… SPAIN ·Art. 32 Aug 23, 2021
€2,000 Company owner: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on a company owner. A person had applied for a job at the controller's company and sent the controller his CV via WhatsApp.… SPAIN ·Art. 13 Aug 23, 2021
€1,000 Employer: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on an employer. The controller had installed a video surveillance system without properly informing employees. SPAIN ·Art. 13 Aug 13, 2021
€2,000 DESPACHO TEJEDOR INFANTES CONSULTORES ASESORES: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on DESPACHO TEJEDOR INFANTES CONSULTORES ASESORES, S.L.. The controller had forwarded two emails containing personal data… SPAIN ·Art. 5 Aug 10, 2021
€1,000 BAZTANDIS, S.L.: Insufficient fulfilment of information obligations Use of surveillance cameras without proper contact information on the data controller, in violation of Art. 13 GDPR. SPAIN ·Art. 13 Aug 9, 2021
€5,000 CLUB GIMNASIA RÍTMICA SAN ANTONIO: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on CLUB GIMNASIA RÍTMICA SAN ANTONIO. A person had filed a complaint against the controller with the AEPD based on the… SPAIN ·Art. 6 Aug 9, 2021
€3,000 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a private individual. Two neighbors had complained about the individual to the DPA due to the fact that he had installed… SPAIN ·Art. 5 Aug 5, 2021
€6,000 Future Vinline S.L.: Insufficient fulfilment of information obligations The Spanish Data Protection Agency (AEPD) has fined Future Vinline S.L.. The privacy policy on the website operated by the controller did not comply with the provisions of the… SPAIN ·Art. 13 Aug 5, 2021
€96,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on Vodafone España, S.A.U.. A data subject had filed a complaint with the DPA against the controller for failing to comply with her… SPAIN ·Art. 6, 17 Aug 3, 2021
€3,000 Club Náutico el Estacio: Insufficient technical and organisational measures to ensure information security The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on Club Náutico el Estacio. A data subject filed a complaint against the controller with the AEPD. The complaint is based on… SPAIN ·Art. 32 Aug 2, 2021
€4,000 Gas inspector: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined a gas inspector. The controller had carried out butane gas checks in the private homes of the data subjects on the basis of a list containing… SPAIN ·Art. 6 Jul 30, 2021
€600 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a private individual EUR 600 for unauthorized video surveillance. The controller had installed a video surveillance camera which covered, among… SPAIN ·Art. 5 Jul 30, 2021
€2,000 Private Individual: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine of EUR 2,000 on a private individual. The controller had published the phone number of the data subject to a picture of another person on a… SPAIN ·Art. 6 Jul 30, 2021
€3,000 UNIVERSIDAD A DISTANCIA DE MADRID, S.A.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) has imposed a fine on UNIVERSIDAD A DISTANCIA DE MADRID, S.A.. A data subject had filed a complaint against the distance learning university. He stated that… SPAIN ·Art. 17, 21 Jul 29, 2021
€3,000 UST GLOBAL ESPAÑA, S.A.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on UST GLOBAL ESPAÑA, S.A.. An employee filed a complaint against the controller with the DPA. UST GLOBAL ESPAÑA, S.A. was… SPAIN ·Art. 5 Jul 27, 2021
€4,000 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a private individual EUR 4,000 for unauthorized video surveillance. The controller had installed two cameras on a public road and another in a… SPAIN ·Art. 5 Jul 27, 2021
€500 Website operator: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) fined a website operator EUR 500 due to the fact that its privacy policy did not comply with the requirements of Art. 13 GDPR. SPAIN ·Art. 13 Jul 27, 2021
€1,000 NEXTSTEPAGENCY, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined NEXTSTEPAGENCY, S.L. EUR 1,000. A website of the controller lacked reliable data about the owner of the website such as tax number and postal… SPAIN ·Art. 13 Jul 27, 2021