Order report
BULLETIN №083Last updated · 09 Aug 2026

Fine Tracker.

A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.

5,273 entries

Total fines
€8.6bn
Decisions
5,273
Jurisdictions
33
Regulators
74
Avg monthly
€162.5m
YoY volume
-23.1%
Country
Type
Date range
ImposedCompanyCountryAuthorityTypeAmount↗
01 Jan 2025AMADEUSAMADEUS was fined EUR 9,000,000 by the AEPD for breaching GDPR Articles 14 and 6. The authority found that the company failed to inform data subjects about the processing of their personal data.ESAEPDGDPR€9,000,000↗
05 Dec 2024TMETME was fined EUR 200,000 by the AEPD for changing the ownership of a mobile line without consent and for issuing a duplicate SIM card without a valid legal basis. The authority found that these actions failed to meet the requirements for lawful processing and proper authorization of subscriber account changes.ESAEPDGDPR€200,000↗
02 Jun 2022B.B.B.The entity was fined by the AEPD for improperly positioning surveillance cameras toward public areas without proper signage. This conduct breached data protection requirements.ESAEPDGDPR€1,000↗
02 Jun 2016TELEFONICA MOVILES ESPAÑA, S.A.U.Telefónica Móviles España was fined €20,000 by the AEPD for using “supercookies” without properly informing users or obtaining their consent. The authority found this conduct to be in breach of Article 22.2 of the LSSI.ESAEPDePrivacy€20,000↗
03 Dec 2024BANCO BILBAO VIZCAYA ARGENTARIA, S.A.The AEPD imposed a EUR 200,000 fine on Banco Bilbao Vizcaya Argentaria, S.A. for processing personal data without a legal basis. The conduct included signing documents without consent and marking consent checkboxes for commercial purposes without authorization.ESAEPDGDPR€200,000↗
16 Apr 202520 MINUTOS EDITORA, S.L.20 MINUTOS EDITORA, S.L. was fined by the AEPD for the unauthorized dissemination of a video containing personal data. The authority found a breach of the data minimization principle under Article 5(1)(c) GDPR.ESAEPDGDPR€30,000↗
04 Feb 2020VODAFONE ESPAÑA, S.A.U.The AEPD imposed a 50,000 EUR fine on VODAFONE ESPAÑA, S.A.U. for sending an SMS indicating a contract using incorrect personal data. The authority found a breach of Article 6 GDPR concerning the lawful basis for processing.ESAEPDGDPR€50,000↗
17 Oct 2019VODAFONE ESPAÑA, S.A.U.The AEPD fined Vodafone España, S.A.U. EUR 75,000 for incorrectly charging a customer's account and retaining inaccurate personal data. The case concerns breaches of data protection principles, including data accuracy and proper processing.ESAEPDGDPR€75,000↗
07 Aug 2024EXPANSION CONSULTING 2020, S.L.EXPANSION CONSULTING 2020, S.L. was fined by the AEPD in the amount of €4,000 for failing to provide access to personal data and the information requested by the data protection authority. The case concerned non-compliance with Article 58(1) GDPR.ESAEPDGDPR€4,000↗
29 Jan 2020COLEGIO ARENALES CARABANCHELThe school was fined by the AEPD 5,000 EUR for unlawfully sharing and publishing images of children without consent. The case involved a breach of data protection rules and the need for valid consent to process minors’ images.ESAEPDGDPR€5,000↗
01 Jan 2021Dña. B.B.B.The entity was fined for publishing personal images and contact numbers on a dating website without proper consent. The authority found a breach of Article 6(1) of the GDPR.ESAEPDGDPR€2,000↗
30 May 2012ESCUELA HIPICA OLIMPIA, S.L.ESCUELA HIPICA OLIMPIA, S.L. was fined by the AEPD EUR 1,200 for sending commercial emails after the individual requested deletion of personal data and cessation of advertising communications. The case concerns failure to respect the recipient’s opt-out and data erasure request.ESAEPDePrivacy€1,200↗
26 Jan 2021VODAFONE ESPAÑA, S.A.U.Vodafone España was fined by the AEPD 100,000 EUR for unlawfully registering a prepaid phone line under the complainant’s ID and accessing credit information without a legitimate interest. The company also failed to properly comply with requests for access to and deletion of personal data.ESAEPDGDPR€100,000↗
27 Apr 2023B.B.B.The entity installed a surveillance camera without informing tenants or obtaining their consent. The camera captured shared areas, which constituted a breach of data protection rules.ESAEPDGDPR€5,000↗
01 Jan 2016PROSAD CONSULTORES S.L.PROSAD CONSULTORES S.L. was fined by the AEPD EUR 800 for sending unsolicited commercial emails. The recipient had not given prior consent and was listed on the Robinson List, which breached Article 21.1 of the LSSI.ESAEPDePrivacy€800↗
22 Feb 2023CONGREGACIÓN DEL SANTÍSIMO REDENTOR CURIA PROVINCIALThe entity was fined 500 EUR by the AEPD for installing a video surveillance system that could capture public areas without prior administrative authorization. The authority found this to be a breach of Article 5(1)(c) GDPR.ESAEPDGDPR€500↗
14 Sept 2011Asociación de Comerciantes, Empresarios y Profesionales ACTIVAThe entity was fined by the AEPD for sending unsolicited commercial emails without prior consent from recipients. This conduct breached Article 21 of the LSSI.ESAEPDePrivacy€1,200↗
02 Oct 2025EMAGISTER SERVICIOS DE FORMACIÓN, S.L.EMAGISTER SERVICIOS DE FORMACIÓN, S.L. was fined EUR 80,000 by the AEPD for a data security incident involving unauthorized processes on its web servers. The authority found a breach of data protection principles.ESAEPDGDPR€80,000↗
02 Apr 2020XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined EUR 52,000 by the AEPD for sending SMS messages to a complainant about another customer's unpaid bills. The authority found that this disclosure breached data protection rules.ESAEPDGDPR€52,000↗
23 Dec 2024HYUNDAI MOTOR ESPAÑA S.L.U.HYUNDAI MOTOR ESPAÑA S.L.U. was fined EUR 2,000,000 by the AEPD for a data security incident. Unauthorized access to customer data occurred, breaching data protection principles.ESAEPDGDPR€2,000,000↗