Fine Tracker — Compliwatch

Imposed	Company	Country	Authority	Type	Amount	↗
19 May 2023	B.B.B.The entity was fined by the AEPD for installing a video surveillance system that captured public areas without authorization. The footage was then used for dissemination via WhatsApp, which breached Article 5(1)(c) GDPR.	ES	AEPD	GDPR	€300	↗
26 Apr 2010	LA OFERTA DE LA SEMANA, S.L.LA OFERTA DE LA SEMANA, S.L. was fined by the AEPD 600 EUR for sending an unsolicited commercial email on 4 September 2009. The message was sent without the recipient’s prior and explicit consent, breaching Article 21.1 of the LSSI.	ES	AEPD	ePrivacy	€600	↗
04 Jun 2021	FINCAS MIGUEL GARCÍA, S.LFINCAS MIGUEL GARCÍA, S.L was fined 2,000 EUR by the AEPD for failing to provide the complainant with its privacy policy before collecting personal data. The authority found this to be a breach of the information duty under Article 13 GDPR.	ES	AEPD	GDPR	€2,000	↗
17 Dec 2019	ORANGE ESPAGNE, S.A.U.ORANGE ESPAGNE, S.A.U. was fined EUR 80,000 by the AEPD for using personal data to fraudulently contract phone lines without consent. The authority found a breach of Article 6(1) GDPR.	ES	AEPD	GDPR	€80,000	↗
01 Jan 2015	ENDESA ENERGÍA S.A.ENDESA ENERGÍA S.A. was fined by the AEPD EUR 5,000 for sending unsolicited commercial SMS messages to a complainant who had previously opted out of such communications. The authority found a breach of Article 21.1 of the LSSI.	ES	AEPD	ePrivacy	€5,000	↗
01 Jan 2023	MAKING SOLUTIONS, S.L. (MY PERFECT WEDDING)MY PERFECT WEDDING was fined by the AEPD EUR 1,000 for failing to properly provide personal data in response to the complainant’s request. The authority found a breach of Article 15 GDPR, which governs the right of access.	ES	AEPD	GDPR	€1,000	↗
13 Jun 2022	AMADEUS IT GROUP, S.A.AMADEUS IT GROUP, S.A. was fined by the AEPD EUR 5,000 for failing to properly handle a data subject's requests to access and delete personal data. The authority found a breach of Article 12 GDPR because the company did not provide an adequate response.	ES	AEPD	GDPR	€5,000	↗
01 Jul 2020	ANMAVAS 61, S.L. (LA CUEVA SEX CLUB)ANMAVAS 61, S.L. did not respond to a data subject’s request for erasure. The AEPD imposed a fine of EUR 2,000 for breaching GDPR obligations.	ES	AEPD	GDPR	€2,000	↗
01 Jan 2024	VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined 200,000 EUR by the AEPD for issuing a duplicate SIM card without the customer’s consent. The incident led to unauthorized financial transactions, indicating significant failures in authorization and security controls.	ES	AEPD	GDPR	€200,000	↗
09 Oct 2015	DESIGN MASTER DIMA, S.L.DESIGN MASTER DIMA, S.L. was fined by the AEPD EUR 1,400 for sending unsolicited commercial emails to an individual who had requested that such communications stop. The conduct breached Article 21.1 of the LSSI.	ES	AEPD	ePrivacy	€1,400	↗
31 Mar 2023	LODEJU, S.L.LODEJU, S.L. was fined by the AEPD EUR 3,000 for improperly directing surveillance cameras toward public spaces without authorization. The authority also found inadequate informational signage, in breach of GDPR Articles 5(1)(c) and 13.	ES	AEPD	GDPR	€3,000	↗
11 Mar 2022	SHOPERY NETWORKS SPAIN, S.L.SHOPERY NETWORKS SPAIN, S.L. was fined 3,000 EUR by the AEPD for a security breach. The authority found a violation of Article 32 GDPR, which requires appropriate technical and organizational measures.	ES	AEPD	GDPR	€3,000	↗
01 Jan 2023	INSTITUTO OFTALMOLÓGICO DE *LOCALIDAD.1 B.B.B., S.L.INSTITUTO OFTALMOLÓGICO DE *LOCALIDAD.1 B.B.B., S.L. was fined by the AEPD EUR 7,000 for unlawfully disclosing personal data, including health information, in response to a Google review. The authority found a breach of confidentiality and of the security obligations under the GDPR.	ES	AEPD	GDPR	€7,000	↗
01 Jan 2012	IDEAS CREATIVAS DE OPERACION S.L.IDEAS CREATIVAS DE OPERACION S.L. was fined EUR 33,001 by the AEPD for sending unsolicited commercial emails despite requests for data cancellation. The authority found a breach of Article 21 of the LSSI.	ES	AEPD	ePrivacy	€33,001	↗
31 Jul 2023	DOÑA B.B.B.The sanctioned individual created a WhatsApp group with 255 participants without prior consent. As a result, the names and phone numbers of the participants were disclosed, constituting a breach of personal data protection rules.	ES	AEPD	GDPR	€2,000	↗
15 Mar 2023	BANKINTER CONSUMER FINANCE E.F.C., S.A.Bankinter Consumer Finance issued a duplicate card without the customer's consent and sent it to an incorrect address. This led to unauthorized transactions and indicated a failure in data protection and payment security controls.	ES	AEPD	GDPR	€70,000	↗
25 Jul 2023	EDICIONES PERIÓDICAS DEL NOROESTE, S.L.The entity published a private video on Twitter without the data subject’s consent. The authority found a breach of data minimization because excessive data were processed beyond what was necessary for the intended purpose.	ES	AEPD	GDPR	€10,000	↗
18 Apr 2024	DELPASO CAR HIRE, S.L.U.DELPASO CAR HIRE, S.L.U. was fined by the AEPD EUR 2,000 for failing to provide a customer with access to their personal data. The authority found a breach of Article 15 of the GDPR.	ES	AEPD	GDPR	€2,000	↗
29 May 2025	IMMUCURA MED, S.L.IMMUCURA MED, S.L. was fined EUR 20,000 by the AEPD for failing to provide access to personal data and the information requested by the data protection authority. The conduct was found to breach Article 58(1) of the GDPR.	ES	AEPD	GDPR	€20,000	↗
17 Feb 2022	VODAFONE ESPAÑA, S.A.VODAFONE ESPAÑA, S.A. was fined EUR 70,000 by the AEPD for issuing a duplicate SIM card to a third party without the customer's consent. This enabled unauthorized access to the customer's bank account.	ES	AEPD	GDPR	€70,000	↗

Fine Tracker.