BULLETIN №083Last updated · 06 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -22.8%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 01 Jan 2021 | COMUNIDAD PROPIETARIOS ***DIRECCIÓN.1The Community of Property Owners was fined by the AEPD EUR 500 for posting on notice boards a list of owners in arrears together with personal data. The information was accessible to third parties, which constituted a breach of data protection rules. | ES | AEPD | GDPR | €500 | ↗ |
| 27 Feb 2025 | RED ESPAÑOLA DE IDENTIFICACIÓN DE ANIMALES DE COMPAÑÍAREIAC was fined EUR 600 by the AEPD for failing to provide the required information to the data protection authority. The case concerns Article 58(1) GDPR and reflects a failure to cooperate with the supervisory authority. | ES | AEPD | GDPR | €600 | ↗ |
| 08 Mar 2023 | ALTERNATIVA CORELLANA INDEPENDIENTE (ACI)The organization published a court ruling on its blog without anonymizing the personal data of the individuals involved. The AEPD found a breach of the data minimization principle and imposed a 500 EUR fine. | ES | AEPD | GDPR | €500 | ↗ |
| 01 Jan 2024 | BONTECU DISTRIBUCIONES, S.L.U.BONTECU DISTRIBUCIONES, S.L.U. was fined by the AEPD for processing personal data without consent and for failing to have proper data processing agreements in place. The case concerned a complainant who received an unsolicited contract from Factor Energía. | ES | AEPD | GDPR | €25,000 | ↗ |
| 03 Dec 2021 | MEDIOS DE PREVENCIÓN EXTERNOS, S.L.The entity was fined for sending unsolicited advertising emails despite requests to cancel the subscription. This conduct breached rules on electronic commercial communications. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 21 Feb 2014 | INSTITUCIÓN EUROAMERICANA DE FORMACIÓN E.I.R.L.The entity was fined by the AEPD in the amount of 39,000 EUR for sending unsolicited commercial emails without prior recipient consent. This constituted a breach of Article 21 of the LSSI governing electronic marketing communications. | ES | AEPD | ePrivacy | €39,000 | ↗ |
| 01 Jan 2024 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD 200,000 EUR for processing personal data without consent. The case involved duplicating a SIM card without the user's authorization, which led to unauthorized bank transactions. | ES | AEPD | GDPR | €200,000 | ↗ |
| 01 Jan 2023 | B.B.B.The entity installed a video surveillance system in a garage without the required authorization and without informing the affected individuals. This constituted a breach of data protection rules and resulted in a EUR 600 fine imposed by the AEPD. | ES | AEPD | GDPR | €600 | ↗ |
| 15 Apr 2021 | HAZTEOIR.ORGThe association HazteOir.Org was fined EUR 5,000 by the AEPD for including images and names of individuals in a pamphlet without their consent. The authority found this to be a breach of data protection rules. | ES | AEPD | GDPR | €5,000 | ↗ |
| 01 Jan 2023 | CIUDAD RESIDENCIAL H.H.H.CIUDAD RESIDENCIAL H.H.H. was fined by the AEPD EUR 2,000 for breaching the data minimization principle. The case concerned capturing and storing photographs of residents collecting packages without informing them about this processing. | ES | AEPD | GDPR | €2,000 | ↗ |
| 01 Jan 2021 | ASOCIACIÓN JEREZ CAPITALThe entity was fined by the AEPD for failing to comply with data protection rules in relation to its website cookie policy. Non-essential cookies were placed on the site without prior user consent. | ES | AEPD | GDPR | €1,000 | ↗ |
| 01 May 2022 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD EUR 70,000 for unauthorized access to a former customer's account. The access enabled a third party to make purchases and subscriptions, indicating improper processing of personal data without consent. | ES | AEPD | GDPR | €70,000 | ↗ |
| 27 Jul 2023 | B.B.B.A neighbor installed a surveillance camera that captured images of the complainant’s property without authorization. The AEPD found this to be a breach of Article 5(1)(c) GDPR and imposed a fine of EUR 300. | ES | AEPD | GDPR | €300 | ↗ |
| 01 Jan 2021 | DAVISER SERVICIOS, S.L.DAVISER SERVICIOS, S.L. was fined by the AEPD 20,000 EUR for using biometric data from fingerprint readers and surveillance cameras without properly informing employees. The authority found this to be a breach of data protection principles. | ES | AEPD | GDPR | €20,000 | ↗ |
| 22 Nov 2021 | B.B.B.The entity installed a surveillance camera in a shared stairway without the consent of the affected persons. The camera captured an excessive area, including private spaces, which breached data protection principles. | ES | AEPD | GDPR | €2,000 | ↗ |
| 19 Dec 2024 | CLUB RÁPIDO DE BOUZASThe club was fined by the AEPD for leaving documents containing players’ personal data, including minors’ data, in a public trash container. The authority found this breached data protection principles, especially confidentiality and security. | ES | AEPD | GDPR | €1,000 | ↗ |
| 24 Feb 2025 | SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L.SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L. was fined by the AEPD 15,000 EUR for recording gym sessions without informing participants or obtaining their consent. The authority found this to be a breach of GDPR rules on consent and personal data processing. | ES | AEPD | GDPR | €15,000 | ↗ |
| 05 Nov 2020 | DR MARÍN CIRUGIA PLÁSTICA, S.L.P.DR MARÍN CIRUGIA PLÁSTICA, S.L.P. was fined EUR 4,000 by the AEPD. The authority found that the company failed to provide a privacy policy on its website and used personal data for marketing purposes without consent. | ES | AEPD | ePrivacy | €4,000 | ↗ |
| 24 Jul 2018 | TELEFONICA MOVILES ESPAÑA, S.A.U.TELEFONICA MOVILES ESPAÑA, S.A.U. was fined by the AEPD 8,100 EUR for sending unsolicited advertising emails without prior recipient consent. The case concerned a breach of Article 21 of the LSSI and reflects unlawful direct marketing practices. | ES | AEPD | ePrivacy | €8,100 | ↗ |
| 01 Jan 2024 | ORANGE BANK, S.A. SUCURSAL EN ESPAÑAOrange Bank was fined for a security breach that exposed personal data. The authority found a violation of Article 5(1)(f) of the GDPR. | ES | AEPD | GDPR | €1,500,000 | ↗ |