Spain

Private individual

6,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-10-27.

Rank · Sector

#65

of 368 in Individuals and Private Associations

Rank · Spain

#519

of 1,133

Rank · All fines

#1,788

of 3,267

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-10-27
Controller / Processor: Private individual
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 6,000 on a private individual. On 1 April 2024, a female data subject filed a complaint with the AEPD, stating that a third party had created fake online profiles of her and published nude images of her. These images were found on various websites, which took them down after receiving removal requests from the AEPD. The original fine of EUR 10,000 was reduced due to the complainant's immediate payment and acknowledgement of responsibility.

Open original source Links to the regulator's original publication or another source.