Spain

Vasco Andaluza de Inversiones S.L.

2,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2021-07-27.

Rank · Sector

#420

of 595 in Industry and Commerce

Rank · Spain

#677

of 1,070

Rank · All fines

#2,257

of 3,039

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2021-07-27
Controller / Processor: Vasco Andaluza de Inversiones S.L.
Sector: Industry and Commerce
Quoted Articles: Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on Vasco Andaluza de Inversiones S.L.. The data subject had signed a contract with the gym Fitness Place. In this contract, the data subject agreed that his data could be shared with the controller, the owner of Fitness Place sports centers. However, the company shared the data with Gerco Fit S.L. and Body Tonic Shop S.L., although this was not foreseen in the contract. Gerco Fit S.L. and Body Tonic Shop S.L. then processed the data without a legal basis.

Open original source Links to the regulator's original publication or another source.