Spain

Private individual

3,200 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-07-10.

Rank · Sector

#100

of 361 in Individuals and Private Associations

Rank · Spain

#611

of 1,104

Rank · All fines

#2,098

of 3,197

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-07-10
Controller / Processor: Private individual
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 (1) GDPR, Art. 13 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 3,200 on a private individual. The controller lives on the upper floor of their house and rents out the lower floor as a holiday let. A data subject renting the lower floor lodged a complaint stating that three cameras were recording the garden, porch, jacuzzi and the interior of the house through a window and that there was no signage installed to indicate this. The owner stated that six cameras had been installed for security purposes. However the DPA found that several of the cameras covered the rented area and that, although a sign was in place, it referred to repealed data protection law. The owner was fined a total of EUR 4,000, which was reduced to EUR 3,200 for immediate payment.

Open original source Links to the regulator's original publication or another source.