Spain

Private individual

2,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2022-10-31.

Rank · Sector

#134

of 351 in Individuals and Private Associations

Rank · Spain

#707

of 1,075

Rank · All fines

#2,324

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2022-10-31
Controller / Processor: Private individual
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on a member of a staff council. The individual had sent minutes of staff council meetings to unauthorized third parties that were not members of the staff council. During its investigation, the DPA found that the individual did not have an effective legal basis for sending the emails.

Open original source Links to the regulator's original publication or another source.