Spain

Private individual

2,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2022-05-20.

Rank · Sector

#129

of 351 in Individuals and Private Associations

Rank · Spain

#701

of 1,075

Rank · All fines

#2,299

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2022-05-20
Controller / Processor: Private individual
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has fined a private individual operating three websites EUR 2,000. During its investigation, the DPA found that all three websites lacked a field for giving consent to the processing of personal data. In addition, the DPA found that the privacy policies on the websites were missing any reference to the identity of the data controller and to the right of data subjects to withdraw their consent to data processing.

Open original source Links to the regulator's original publication or another source.