BULLETIN №081Last updated · 27 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 19 Feb 2024 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined EUR 200,000 by the AEPD for processing personal data without a legal basis. The case concerned a phone number portability carried out without the user's consent, which breached the requirement for lawful processing. | ES | AEPD | GDPR | €200,000 | ↗ |
| 30 Jul 2010 | TELEFONICA MOVILES ESPAÑA S.A.TELEFONICA MOVILES ESPAÑA S.A. was fined by the AEPD EUR 600 for sending unsolicited commercial messages without prior consent. This constituted a breach of Article 21.1 of the Spanish LSSI. | ES | AEPD | ePrivacy | €600 | ↗ |
| 01 Jan 2013 | SPACIO TERMAL, S.L.SPACIO TERMAL, S.L. was fined by the AEPD EUR 600 for sending unsolicited commercial emails without the required consent. The conduct breached Article 21 of the LSSI, which governs electronic marketing communications. | ES | AEPD | ePrivacy | €600 | ↗ |
| 22 Jul 2025 | KVIKU SPAIN, S.L.KVIKU SPAIN, S.L. was fined by the AEPD in the amount of EUR 4,000 for sending unsolicited messages and processing personal data without a legal basis. The authority found a breach of Article 6(1) GDPR. | ES | AEPD | GDPR | €4,000 | ↗ |
| 07 Feb 2022 | IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A.Iberia was fined €30,000 by the AEPD for using non-essential cookies on its website without obtaining prior user consent. The case concerns non-compliance with cookie consent rules and related user information requirements. | ES | AEPD | ePrivacy | €30,000 | ↗ |
| 29 Apr 2021 | LA ROCA NETWORKS, S.L.LA ROCA NETWORKS, S.L. was fined by the AEPD €1,000 for sending commercial emails to an individual whose email address was included in the Robinson List. The conduct breached Spanish data protection rules governing unsolicited marketing communications. | ES | AEPD | ePrivacy | €1,000 | ↗ |
| 01 Jan 2022 | UNION SINDICAL OBRERAThe labor union UNION SINDICAL OBRERA was fined by the AEPD for failing to comply with a prior decision on the complainant’s right to data deletion. Despite being notified of the obligation to stop, it continued sending emails. | ES | AEPD | GDPR | €3,000 | ↗ |
| 30 Nov 2022 | CBHNOS S.L.CBHNOS S.L. was fined 500 EUR by the AEPD for installing a video surveillance system that could capture images of public areas. The authority considered this a breach of data protection rules. | ES | AEPD | GDPR | €500 | ↗ |
| 30 Oct 2024 | COLEGIO NOTARIAL DE ARAGÓNCOLEGIO NOTARIAL DE ARAGÓN was fined by the AEPD for implementing a fingerprint-based time control system without carrying out a data protection impact assessment. The authority found breaches of GDPR Articles 9 and 35. | ES | AEPD | GDPR | €10,000 | ↗ |
| 01 Jan 2021 | ORANGE ESPAGNE, S.A.U.ORANGE ESPAGNE, S.A.U. was fined 800,000 EUR by the AEPD for failing to adequately protect personal data. The breach enabled identity fraud and unauthorized access to banking information through SIM card duplication. | ES | AEPD | GDPR | €800,000 | ↗ |
| 02 Feb 2011 | TELEFONICA MOVILES ESPAÑA S.A.TELEFONICA MOVILES ESPAÑA S.A. was fined EUR 30,001 by the AEPD for sending unsolicited commercial communications via MMS and SMS. The messages were sent after the complainant had revoked consent, which breached Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €30,001 | ↗ |
| 01 Jan 2024 | ENDESA ENERGIA, S.A.U.ENDESA ENERGIA, S.A.U. was fined €200,000 by the AEPD for changing the contract holder and bank account without consent. The authority found a breach of data protection principles. | ES | AEPD | GDPR | €200,000 | ↗ |
| 24 Jun 2020 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD 75,000 EUR for continuing to send promotional SMS messages to an individual whose personal data had previously been deleted. The authority found this conduct to be in breach of Article 6 GDPR. | ES | AEPD | GDPR | €75,000 | ↗ |
| 03 May 2022 | TITANIA COMPAÑÍA EDITORIAL, S.L.TITANIA COMPAÑÍA EDITORIAL, S.L. was fined by the AEPD 50,000 EUR for publishing an audio recording of a victim’s testimony in a high-profile court case. The authority found that the company processed personal data excessively and breached data protection principles. | ES | AEPD | GDPR | €50,000 | ↗ |
| 01 Jan 2021 | INMARÁN ASESORES, S.L.INMARÁN ASESORES, S.L. was fined 2,000 EUR by the AEPD for recording telephone conversations without informing the data subject or obtaining consent. The authority found this to be a breach of the GDPR information obligations. | ES | AEPD | GDPR | €2,000 | ↗ |
| 01 Jan 2024 | EMPRENDEDORES ONLINE, LLCEMPRENDEDORES ONLINE, LLC was fined by the AEPD 10,000 EUR for recording and sharing course participants’ personal data without consent. The authority found a breach of GDPR Articles 5(1)(f) and 6(1), indicating unlawful processing and insufficient legal basis. | ES | AEPD | GDPR | €10,000 | ↗ |
| 31 Aug 2025 | A.A.A.A.A.A. was fined by the AEPD EUR 3,000 for using surveillance cameras in a tourist accommodation without a valid legal basis and without informing the individuals concerned. The authority found a breach of Article 6 of the GDPR. | ES | AEPD | GDPR | €3,000 | ↗ |
| 09 Sept 2022 | B.B.B.A private individual was fined 600 EUR by the AEPD for using a webcam oriented toward a public street without prior authorization. The authority treated this as a breach of data protection rules. | ES | AEPD | GDPR | €600 | ↗ |
| 15 Oct 2024 | CARSO TRADING, S.L.CARSO TRADING, S.L. was fined by the AEPD in the amount of EUR 6,000 for failing to respond to a data access request. The authority found a breach of Article 15 of the GDPR and Article 58.2 of the GDPR. | ES | AEPD | GDPR | €6,000 | ↗ |
| 01 Jan 2019 | EL PERIODICO DE CATALUNYA, S.L.EL PERIODICO DE CATALUNYA, S.L. was fined by the AEPD 10,000 EUR for sending a commercial email after a data deletion request. The authority found this conduct to be in breach of Article 6 of the GDPR. | ES | AEPD | GDPR | €10,000 | ↗ |