Spain

Online Services

10,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2020-12-15.

Rank · Sector

#212

of 597 in Industry and Commerce

Rank · Spain

#393

of 1,075

Rank · All fines

#1,333

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2020-12-15
Controller / Processor: Online Services
Sector: Industry and Commerce
Quoted Articles: Art. 13 GDPR, Art. 8 (1) GDPR, Art. 6 (1) a) GDPR
Type of violation: Insufficient fulfilment of information obligations

Summary

The Spanish DPA (AEPD) fined the operator of the online store banderacatalana.cat. EUR 10,000 for a violation of Art. 13 GDPR. The operator stated on its website privacy notices that a minimum age of 13 or sufficient legal capacity was required to subscribe to the newsletter. It was also stated that filling out the newsletter subscription form would be considered as consent to the processing of personal data. This constitutes a violation of the GDPR, as according to Art. 8 GDPR, the processing of personal data of under-16-year-olds requires the consent of the holder of parental responsibility over the child.

Open original source Links to the regulator's original publication or another source.