Spain

ARES CAPITAL, S.A.

200,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-03-04.

Rank · Sector

#17

of 213 in Employment

Rank · Spain

#76

of 1,075

Rank · All fines

#374

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-03-04
Controller / Processor: ARES CAPITAL, S.A.
Sector: Employment
Quoted Articles: Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 13 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 200,000 on ARES CAPITAL, S.A. The controller required its employees to use mobile phones for work purposes. The controller offered corporate devices for this purpose, but was unable to provide enough for all employees who did not want to use their own mobile phones. Employees who used their own devices had to install multiple surveillance applications that continuously monitored all activity on those devices. The controller had no sufficient legal basis for this extensive surveillance. Additionally, the controller failed to adequately inform data subjects regarding the processing.

Open original source Links to the regulator's original publication or another source.