Spain

Private individual

1,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026.

Rank · Sector

#203

of 368 in Individuals and Private Associations

Rank · Spain

#908

of 1,133

Rank · All fines

#2,923

of 3,267

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026
Controller / Processor: Private individual
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 1,000 on a private individual. A third party shared a screenshot containing the image, names and age of a data subject on social media. The post provided information about the data subject's private and sexual life. The AEPD found no legal basis for publicly sharing this kind of information.

Open original source Links to the regulator's original publication or another source.