Spain

Homeowners Association

2,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2022-12-28.

Rank · Sector

#182

of 213 in Employment

Rank · Spain

#711

of 1,075

Rank · All fines

#2,331

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2022-12-28
Controller / Processor: Homeowners Association
Sector: Employment
Quoted Articles: Art. 6 (1) GDPR, Art. 15 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 2,000 on a homeowners' association. An individual who did cleaning work in the residential complex had filed a complaint with the DPA because members of the association had added them to a WhatsApp group without their consent. The data subject was required to upload pictures of the cleaning they had done for documentation purposes. The DPA concluded that adding their phone number to the WhatsApp group without their consent violated Art. 6 GDPR and was therefore unlawful. The DPA also found that the controller had not complied with the data subject's request for access to personal data in a timely manner, therefore violating Art. 15 GDPR.

Open original source Links to the regulator's original publication or another source.