Spain

ATRIUM LEX SFC

100,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2024-12-18.

Rank · Sector

of 86 in Real Estate

Rank · Spain

#106

of 1,075

Rank · All fines

#486

of 3,051

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2024-12-18
Controller / Processor: ATRIUM LEX SFC
Sector: Real Estate
Quoted Articles: Art. 13 GDPR, Art. 32 (1) GDPR
Type of violation: Insufficient fulfilment of information obligations

Summary

The Spanish DPA has imposed a fine of EUR 100,000 on the real estate management company ATRIUM LEX SFC. An investor had filed a complaint with the DPA because the controller had requested a copy of the investor's ID card to enable them to receive information about a project. The DPA found that the controller had not provided sufficient information about this data processing and that the sending of copies of ID cards by email was not sufficiently secure. The DPA assessed this as a violation of Art. 13 GDPR and Art. 32 (1) GDPR.

Open original source Links to the regulator's original publication or another source.