Spain

DRSMILE IBERIA, S.L.

7,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-09-17.

Rank · Sector

#179

of 290 in Health Care

Rank · Spain

#470

of 1,114

Rank · All fines

#1,662

of 3,223

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-09-17
Controller / Processor: DRSMILE IBERIA, S.L.
Sector: Health Care
Quoted Articles: Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 7,000 on DrSmile Iberia, S.L. In December 2021, the controller offered free orthopaedic consultations. Having attended such a consultation, the complainant was sent an invoice for EUR 1,890. The controller treated a click on their website as confirmation of a contract for the consultation, which was valued at EUR 1,890. The controller then assigned the claim to its payment provider. Due to non-payment, the data subject was listed in the ASNEF credit defaults register in January 2024 and April 2024. However, the controller could not prove that a contract had been agreed with the data subject, meaning that they had no legal basis for processing the data subject's data for payment purposes.

Open original source Links to the regulator's original publication or another source.