Spain

CUMACA MOTOR, S.L.

6,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-03-10.

Rank · Sector

#277

of 597 in Industry and Commerce

Rank · Spain

#487

of 1,075

Rank · All fines

#1,663

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-03-10
Controller / Processor: CUMACA MOTOR, S.L.
Sector: Industry and Commerce
Quoted Articles: Art. 5 (1) c) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 6,000 on CUMACA MOTOR, S.L. The controller required a data subject to provide a national identity document, which it copied for the purpose of a vehicle repair. The controller claimed that this was a requirement of the insurance company, which was paying for the repair. However, the insurance company did not require repair shops to check the identity documents of claimants, and the controller had no other legal basis for this processing. The original fine of EUR 7,500 was reduced to EUR 6,000 due to immediate payment by the controller.

Open original source Links to the regulator's original publication or another source.