Spain

BIDA FARMA S.C. ANDALUZA

16,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-09-02.

Rank · Sector

#75

of 219 in Employment

Rank · Spain

#371

of 1,114

Rank · All fines

#1,229

of 3,223

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-09-02
Controller / Processor: BIDA FARMA S.C. ANDALUZA
Sector: Employment
Quoted Articles: Art. 5 (1) b) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Spanish DPA has imposed a fine of EUR 16,000 on Bida Farma S.C. Andaluza. In a court case in 2024, the controller used information on its employees' union membership in its defence. Several of these employees were not parties to the case. Furthermore, the employees had only consented to their personal data relating to their union membership being processed for payroll deduction purposes. Therefore, the controller had no legal basis for using this sensitive data in a court case.

Open original source Links to the regulator's original publication or another source.