Spain

Private individual

1,600 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-07-21.

Rank · Spain

#772

of 1,104

Rank · All fines

#2,597

of 3,197

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-07-21
Controller / Processor: Private individual
Sector: Accomodation and Hospitalty
Quoted Articles: Art. 5 (1) c) GDPR, Art. 13 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Spanish DPA has imposed a fine of EUR 1,600 on a private individual. A former restaurant employee sent a request for access to video camera recordings to the owner via WhatsApp. The complainant stated that there were no signs informing people of the camera and that the camera captured the entrance therefore leaving the possibility that public space was being recorded. During the AEPD's investigation the controller did not respond to letters sent to them. They later stated that they had taken down the camera. They also stated that no real camera had been installed as the device was only simulated.

Open original source Links to the regulator's original publication or another source.