Spain

Private individual

6,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-07-28.

Rank · Sector

#63

of 361 in Individuals and Private Associations

Rank · Spain

#503

of 1,104

Rank · All fines

#1,753

of 3,197

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-07-28
Controller / Processor: Private individual
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 6,000 on a private individual. A data subject complained to the Spanish DPA stating that security cameras had been installed in a room they rented in a shared flat without signage indicating this or their consent to the recording. Four cameras were installed in the flat's communal areas, including the kitchen, staircase, boiler room and entrance. According to the data subjects two people, neither of whom was the landlord, were viewing the recordings and sending messages to tenants regarding images taken by the cameras. It was found that the clause in the rental agreement was not sufficient consent for the recording activities.

Open original source Links to the regulator's original publication or another source.