Content type · 1,205 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Country: Spain (50) Clear filter
Filter by Topic Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€400 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public… SPAIN ·Art. 5 Nov 22, 2023
€56,000 VODAFONE ESPAÑA, S.A.U.: Insufficient legal basis for data processing The Spanish data protection authority has imposed a fine of EUR 50,000 on VODAFONE ESPAÑA, S.A.U.. A customer had filed a complaint with the DPA regarding the fact that due to a… SPAIN ·Art. 6 Nov 22, 2023
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered a neighbouring… SPAIN ·Art. 5 Nov 21, 2023
€8,000 EASYJET AIRLINE COMPANY LIMITED: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine on EASYJET AIRLINE COMPANY LIMITED. A data subject had filed a complaint against the controller with the DPA due to the controller's failure to… SPAIN ·Art. 15 Nov 21, 2023
€200 Private individual: Insufficient cooperation with supervisory authority The Spanish DPA has fined a private individual EUR 200 for failing to provide information requested by the DPA. SPAIN ·Art. 58 Nov 20, 2023
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on a private individual for unlawfully using the photo of a minor to create a social media profile. SPAIN ·Art. 6 Nov 20, 2023
€200 Private individual: Insufficient cooperation with supervisory authority The Spanish DPA has fined a private individual EUR 200 for failing to provide information requested by the DPA. SPAIN ·Art. 58 Nov 20, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN ·Art. 5, 13 Nov 20, 2023
€4,000 LEADDESK, S.L: Insufficient cooperation with supervisory authority The Spanish DPA has fined LEADDESK, S.L EUR 4,000 for failing to provide information requested by the DPA. SPAIN ·Art. 58 Nov 17, 2023
€72,000 Eurocollege Oxford English Institute S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 72,000 on Eurocollege Oxford English Institute S.L. The data subject stated that they had signed a training contract with the affiliated… SPAIN ·Art. 5, 6, 9 Nov 17, 2023
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on a private individual. The person had recorded a video of a violent incident involving minors without a valid legal basis. SPAIN ·Art. 6 Nov 16, 2023
€500 Private individual: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 500 on a private individual. The individual had installed a video surveillance system in a laundromat operated by them without… SPAIN ·Art. 13 Nov 16, 2023
€20,000 QUALITY-PROVIDER S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 20,000 on QUALITY-PROVIDER S.A.. The controller had processed the personal data of a data subject without a valid legal basis and had not… SPAIN ·Art. 6, 58 Nov 16, 2023
€20,000 FORO ASTURIAS: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 20,000 on FORO ASTURIAS. An individual had filed a complaint with the DPA due to the fact that personal data stored by the controller had… SPAIN ·Art. 5, 32 Nov 16, 2023
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on a private individual. The controller had uploaded an individual's personal data, including their name, a picture and their… SPAIN ·Art. 6 Nov 15, 2023
€1,000 TRACTAMENT D'AIGUES TEIA, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 1000 on TRACTAMENT D'AIGUES TEIA, S.L. for failing to comply with an order issued by the DPA. SPAIN ·Art. 58 Nov 13, 2023
€200,000 CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.. The controller had included the data subject's personal data in a credit… SPAIN ·Art. 6 Nov 13, 2023
€600 Store owner: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 600 on a store owner. The controller had installed video surveillance cameras which, among other things, also covered a neighbour… SPAIN ·Art. 5 Nov 7, 2023
€70,000 THE BEE LOGISTICS, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 70,000 on THE BEE LOGISTICS, S.L. for delivering a parcel to a person other than the recipient, thereby unlawfully disclosing the… SPAIN ·Art. 5, 32 Nov 7, 2023
€1,000 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,000 on a homeowners' association. A property owner had filed a complaint with the DPA. The controller had published an enforcement… SPAIN ·Art. 5, 32 Nov 7, 2023
€400 Private individual: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 400 on a private individual for failing to comply with an order issued by the DPA. SPAIN ·Art. 58 Nov 6, 2023
€200,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… Art. 6 ·Insufficient legal basis for data processing Nov 6, 2023
€240 Private individual: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 240 on a private individual. The controller had installed video surveillance cameras without properly informing data subjects. SPAIN ·Art. 13 Nov 6, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 300. The individual had installed video surveillance cameras on their property which covered, among other things, the public… SPAIN ·Art. 5 Nov 6, 2023
€2,000 SINDICATO LIBRE DE TRANSPORTES: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on SINDICATO LIBRE DE TRANSPORTES. A member of the union had shared the data subject's payslip in a WhatsApp group without the data subject's… SPAIN ·Art. 5, 32 Nov 3, 2023
€600 Hotel: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 600 on a hotel. The controller had installed video surveillance cameras which, among other things, also covered the public space and… SPAIN ·Art. 5, 13 Nov 3, 2023
€600 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a Homeowners Association. The association had installed several video surveillance cameras which, among other things, also… SPAIN ·Art. 5 Nov 3, 2023
€30,000 APOLLONIA TOPCO, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 30,000 on APOLLONIA TOPCO, S.L.. An individual had filed a complaint with the DPA due to the fact that, in order to receive a refund,… SPAIN ·Art. 5, 38 Nov 2, 2023
€48,000 INSTITUT MARQUÉS OBSTETRICIA I GINECOLOGIA, S.L.P.: Non-compliance with general data processing principles The Spanish DPA has imposed a finea INSTITUT MARQUÉS OBSTETRICIA I GINECOLOGIA, S.L.P. The controller had suffered a data breach in which personal patient and employee data had… SPAIN ·Art. 5, 32, 34 Nov 2, 2023
€300 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 600 on a private individual. The controller had installed a video surveillance camera which recorded a communal area without this having… SPAIN ·Art. 6 Oct 31, 2023
€180 Private individual: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 180 on a private individual. The controller had installed video surveillance cameras without properly informing data subjects. SPAIN ·Art. 13 Oct 31, 2023
€240 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 240 on a private individual for unlawfully installing a video surveillance camera on their house capturing the public space. SPAIN ·Art. 6 Oct 30, 2023
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on a private individual for publishing intimate images of the data subject on YouTube without their consent. SPAIN ·Art. 6 Oct 28, 2023
€5M CAIXABANK, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 5 million on CAIXABANK, S.A.. A customer had filed a complaint about having access to a document containing information on a transfer… SPAIN ·Art. 5, 25, 32 Oct 26, 2023
€500 UPMOBILE SOLUTIONS, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined UPMOBILE SOLUTIONS, S.L. EUR 500 for failing to provide information requested by the DPA. SPAIN ·Art. 58 Oct 26, 2023
€7,000 Ophthalmologic institute: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 7,000 on a ophthalmologic institute. The controller had responded to an online review, disclosing personal data of a patient. SPAIN ·Art. 5, 32 Oct 26, 2023
€500 BILBAO AD INFINITUM, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined BILBAO AD INFINITUM, S.L. EUR 500. The controller had installed video surveillance cameras which, among other things, also covered the public street. The… SPAIN ·Art. 5 Oct 25, 2023
€6.1M ENDESA ENERGÍA, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has fined ENDESA ENERGÍA, S.A.U. EUR 6,1 million due to a security breach resulting in unauthorized access to its systems. The controller had informed the DPA that… SPAIN ·Art. 5, 32, 33 +2 Oct 25, 2023
€50,000 Oney Servicios Financieros E.F.C.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on Oney Servicios Financieros E.F.C... The controller had submitted data from the data subject to a credit information system… SPAIN ·Art. 5 Oct 23, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN ·Art. 5, 13 Oct 23, 2023
€800,000 BANCO BILBAO VIZCAYA ARGENTARIA, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has fined BANCO BILBAO VIZCAYA ARGENTARIA, S.A. EUR 800,000. A customer had lost her handbag, which also contained her bank card. The individual therefore… SPAIN ·Art. 25, 32 Oct 20, 2023
€500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN ·Art. 5 Oct 19, 2023
€600 FESTINA LOTUS S.A.: Insufficient fulfilment of data subjects rights The Spanish Data Protection Authority has imposed a fine of EUR 600 on FESTINA LOTUS S.A. due to the fact that the controller had not properly complied with a data subject's… SPAIN ·Art. 17 Oct 18, 2023
€2,000 UNIQUE HOTEL APARTMENT S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 2,000 on UNIQUE HOTEL APARTMENT. The controller had copied identification documents for the purposes of guest registration and stored the… SPAIN ·Art. 5 Oct 18, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA has fined a private individual EUR 600 for installing a video surveillance camera that captured parts of a commonly shared garage. The DPA considered this a… SPAIN ·Art. 5, 13 Oct 15, 2023
€5,300 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 5,300 on a private individual. An individual had rented a room from the controller and filed a complaint due to the fact that the… SPAIN ·Art. 6, 13 Oct 11, 2023
€500 ALBEN AIRPORT FACILITIES S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined ALBEN AIRPORT FACILITIES S.L. EUR 500 for failing to provide information requested by the DPA during an investigation. SPAIN ·Art. 58 Oct 11, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 300. The individual had installed video surveillance cameras on their property which covered, among other things, the public… SPAIN ·Art. 5 Oct 11, 2023
€15,000 ILUNION SEGURIDAD, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 15,000 on ILUNION SEGURIDAD, S.A. The controller had sent labor communications by e-mail without using the blind copy option, revealing… SPAIN ·Art. 5, 32 Oct 10, 2023
€1,500 NORDETIA CLINICS MÓSTOLES S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,500 on NORDETIA CLINICS MÓSTOLES S.L.. The controller had sent an e-mail without using the blind copy option, revealing the email… SPAIN ·Art. 5, 32 Oct 10, 2023