Spain

Private individual

2,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-08-19.

Rank · Sector

#152

of 363 in Individuals and Private Associations

Rank · Spain

#756

of 1,114

Rank · All fines

#2,570

of 3,223

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-08-19
Controller / Processor: Private individual
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 2,000 on a private individual. The name, email address, ID number and photo of a data subject were used on a third party's website to provide more information. The website was used to carry out a scam involving fake parking tickets that directed drivers to a direct payment page. The domain was taken offline, after which the AEPD identified the individual who had registered it.

Open original source Links to the regulator's original publication or another source.