BULLETIN №081Last updated · 28 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 05 Jan 2022 | CONTIMAG INVEST, S.L.CONTIMAG INVEST, S.L. was fined by the AEPD 1,200 EUR for operating a video surveillance system without the required informational signage. The authority found a breach of Article 13 GDPR on transparency and information duties. | ES | AEPD | GDPR | €1,200 | ↗ |
| 01 Jan 2018 | CAFETERÍA NAGASAKICAFETERÍA NAGASAKI was fined by the AEPD 1,500 EUR for using surveillance cameras to capture images of public sidewalks without justification. The authority found this to be a breach of data protection rules. | ES | AEPD | GDPR | €1,500 | ↗ |
| 21 Jun 2023 | B.B.B.The entity installed a video surveillance system that captured images beyond its property boundaries. This infringed the privacy of neighboring properties and led to a fine by the AEPD. | ES | AEPD | GDPR | €300 | ↗ |
| 08 Jan 2021 | C.C.C.C.C.C. was fined EUR 2,000 by the AEPD. The authority found that the company failed to provide a written contract and did not inform the complainant about the processing of personal data, in breach of Article 13 GDPR. | ES | AEPD | GDPR | €2,000 | ↗ |
| 11 Feb 2021 | ZCALL LEVANTE, S.L.ZCALL LEVANTE, S.L. was fined by the AEPD 20,000 EUR for making a commercial call to a number registered on the Robinson List. This conduct breached telecommunications and consumer protection rules. | ES | AEPD | GDPR | €20,000 | ↗ |
| 27 Jul 2011 | HN LOGISTICA FERIAL EVENTOS Y CONGRESOS S.L.HN LOGISTICA FERIAL EVENTOS Y CONGRESOS S.L. was fined by the AEPD 600 EUR for sending unsolicited commercial emails without recipient consent. The conduct breached Article 21 of the LSSI. | ES | AEPD | ePrivacy | €600 | ↗ |
| 01 Jan 2023 | CARSO TRADING, S.L.CARSO TRADING, S.L. was fined by the AEPD in the amount of 1,000 EUR for sending unsolicited commercial emails. The company also failed to respond to a data access request, which constitutes a breach of Article 15 GDPR. | ES | AEPD | GDPR | €1,000 | ↗ |
| 09 Aug 2023 | AUTOFER, S.L.AUTOFER, S.L. was fined EUR 10,000 by the AEPD for sending multiple unsolicited advertising SMS messages. The messages were sent despite the recipient’s prior request not to receive further communications, breaching Article 21 of the LSSI. | ES | AEPD | ePrivacy | €10,000 | ↗ |
| 01 Jan 2018 | LIGA NACIONAL DE FÚTBOL PROFESIONALThe Spanish Data Protection Agency (AEPD) fined LIGA NACIONAL DE FÚTBOL PROFESIONAL for using a mobile app to indiscriminately capture ambient sounds. This could have resulted in the processing of personal data without the consent of the individuals concerned. | ES | AEPD | GDPR | €500,000 | ↗ |
| 22 Nov 2019 | MEGASTAR, S.L.MEGASTAR, S.L. was fined by the AEPD EUR 2,000 for surveillance cameras that were improperly oriented and captured disproportionate images. The authority also found that the required informational signage was missing, constituting a breach of Article 5(1)(c) GDPR. | ES | AEPD | GDPR | €2,000 | ↗ |
| 24 Mar 2021 | IBERDROLA CLIENTES, SAUIberdrola Clientes, SAU was fined EUR 70,000 by the AEPD for changing the contracted power in a supply agreement without the consent of the contract holder. The authority found that this conduct breached data protection rules. | ES | AEPD | GDPR | €70,000 | ↗ |
| 01 Jan 2022 | FUNDACIÓN CIPRI GÓMESFUNDACIÓN CIPRI GÓMES was fined EUR 4,000 by the AEPD for failing to provide information on personal data processing to athletes or their guardians. The authority also found unlawful processing of a minor's personal data after the parents had withdrawn him from the gym. | ES | AEPD | GDPR | €4,000 | ↗ |
| 22 Mar 2023 | GRUPO MASSIMO DUTTI, S.A.The AEPD fined GRUPO MASSIMO DUTTI, S.A. EUR 5,000 for failing to provide sufficient information and adequate options regarding cookie consent on its website. The authority found a breach of Article 22.2 of the LSSI. | ES | AEPD | ePrivacy | €5,000 | ↗ |
| 30 Nov 2022 | INMARAN ASESORES S.L.INMARAN ASESORES S.L. was fined by the AEPD 1,000 EUR for failing to comply with data protection authority resolutions. The breach concerned the obligation to inform data subjects under Article 13 of the GDPR. | ES | AEPD | GDPR | €1,000 | ↗ |
| 01 Jan 2016 | TRAVELGENIO, S.L.TRAVELGENIO, S.L. was fined by the AEPD in the amount of €1,500 for sending unsolicited commercial emails to a customer. The conduct breached Article 21.1 of the LSSI, which governs marketing communications without prior consent. | ES | AEPD | ePrivacy | €1,500 | ↗ |
| 01 Jan 2021 | COMUNIDAD DE PROPIETARIOS R.R.R.The community of property owners was fined by the AEPD for collecting excessive personal data in connection with access to the community pool. The authority also found that users were not properly informed about the processing of their personal data. | ES | AEPD | GDPR | €6,000 | ↗ |
| 23 Feb 2023 | TECH TALENTS, S.L.TECH TALENTS, S.L. was fined EUR 2,000 by the AEPD for sending unsolicited commercial emails. The conduct breached Article 21 of the LSSI, which governs marketing communications sent without prior consent. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 01 Feb 2019 | CAIXABANK, S.A.CAIXABANK was fined by the AEPD for introducing new data protection conditions that required consent for sharing data within its group. The authority found the measure disproportionate and lacking a proper legal basis. | ES | AEPD | GDPR | €6,500,000 | ↗ |
| 01 Jan 2017 | WEWI MOBILE, S.L.WEWI MOBILE, S.L. was fined by the AEPD in the amount of €5,000 for sending unsolicited commercial messages to individuals without their prior consent. This conduct breached the LSSI rules on marketing communications. | ES | AEPD | ePrivacy | €5,000 | ↗ |
| 27 Jun 2023 | OPTIME 2016 SLOPTIME 2016 SL was fined EUR 500 by the AEPD for failing to provide requested information. The authority treated this as a breach of Article 58(1) GDPR. | ES | AEPD | GDPR | €500 | ↗ |