BULLETIN №081Last updated · 28 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 01 Jan 2019 | XFERA MÓVILES, S.A. (MASMOVIL)XFERA MÓVILES, S.A. (MASMOVIL) was fined by the AEPD €60,000 for changing a customer's contract details without proper consent. The authority found that the processing lacked a valid legal basis under GDPR Article 6(1)(a). | ES | AEPD | GDPR | €60,000 | ↗ |
| 01 Jan 2013 | NOVOPRINT, C.B.NOVOPRINT, C.B. was fined by the AEPD 1,800 EUR for sending unsolicited commercial emails. The emails did not include an unsubscribe mechanism, which breached Article 21 of the LSSI. | ES | AEPD | ePrivacy | €1,800 | ↗ |
| 25 Jul 2021 | CYNGASA, S.L.CYNGASA, S.L. was fined by the AEPD EUR 5,000 for transferring an employee’s personal data to another company without consent. The authority found this conduct to be a breach of Article 6 of the GDPR. | ES | AEPD | GDPR | €5,000 | ↗ |
| 05 May 2022 | THOMAS INTERNATIONAL SYSTEMS, S.A.THOMAS INTERNATIONAL SYSTEMS, S.A. was fined by the AEPD 50,000 EUR for processing special categories of personal data without proper legal justification. The company requested sensitive information, including disability and ethnicity, in psychometric questionnaires. | ES | AEPD | GDPR | €50,000 | ↗ |
| 02 Jul 2019 | XFERA MÓVILES, S.A. (YOIGO)XFERA MÓVILES, S.A. (YOIGO) was fined by the AEPD EUR 60,000 for failing to implement adequate security measures. This allowed unauthorized access to personal data through its website. | ES | AEPD | GDPR | €60,000 | ↗ |
| 01 Sept 2021 | ORANGE ESPAGNE, S.A.U.ORANGE ESPAGNE, S.A.U. was fined by the AEPD 50,000 EUR for making unsolicited marketing calls and sending messages without consent. The conduct breached data protection principles. | ES | AEPD | GDPR | €50,000 | ↗ |
| 14 Dec 2022 | MÁRMOLES Y GRANITOS MEJIAS, S. L.The company was fined by the AEPD in the amount of 600 EUR for operating a video surveillance system without proper signage and required authorization. This may have infringed the rights of third parties and data protection rules. | ES | AEPD | GDPR | €600 | ↗ |
| 13 Nov 2023 | RECICLAJES LOGROÑO, S.L.RECICLAJES LOGROÑO, S.L. was fined by the AEPD 10,000 EUR for photocopying a customer's ID without consent and for failing to provide privacy policy information. The authority found breaches of GDPR data minimization and transparency principles. | ES | AEPD | GDPR | €10,000 | ↗ |
| 12 Jan 2023 | ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L.ASNEF-EQUIFAX was fined by the AEPD EUR 5,000 for including personal data in a credit file without prior notice. The company also failed to respond to access requests, which constitutes a breach of GDPR Article 15. | ES | AEPD | GDPR | €5,000 | ↗ |
| 23 Jun 2020 | SALBEGAP, S.L.SALBEGAP, S.L. was fined by the AEPD EUR 2,000 for installing surveillance cameras in common areas without authorization from the homeowners' association. The authority found that this breached data protection principles. | ES | AEPD | GDPR | €2,000 | ↗ |
| 01 Jan 2014 | EL CORTE INGLES, S.A.EL CORTE INGLES, S.A. was fined by the AEPD 1,000 EUR for sending unsolicited commercial emails. The conduct breached Article 21.1 of Spain’s LSSI, which restricts marketing communications without recipient consent. | ES | AEPD | ePrivacy | €1,000 | ↗ |
| 16 Oct 2013 | FRANCE TELECOM ESPAÑA, S.A.FRANCE TELECOM ESPAÑA, S.A. was fined by the AEPD for sending commercial emails to a complainant despite a request not to use personal data for advertising purposes. The authority found a breach of Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €33,001 | ↗ |
| 19 Jan 2022 | DISPLAY CONNECTORS, S.L.DISPLAY CONNECTORS, S.L. was fined by the AEPD EUR 50,000 for processing excessive personal data, including the name of a minor, that was not necessary for the intended purpose. The authority found this to be a breach of data protection principles. | ES | AEPD | GDPR | €50,000 | ↗ |
| 22 Feb 2023 | B.B.B.The entity was fined by the AEPD 300 EUR for installing a surveillance camera that could capture images of a neighboring property without authorization. The authority treated this as a breach of data protection rules. | ES | AEPD | GDPR | €300 | ↗ |
| 01 Mar 2017 | ESPASA CALPE, S.A.ESPASA CALPE, S.A. was fined EUR 2,500 by the AEPD for continuing to send commercial emails to a customer after confirming deletion of the customer’s personal data. The authority found this to be a breach of electronic communications and data protection rules. | ES | AEPD | ePrivacy | €2,500 | ↗ |
| 23 Apr 2023 | GRIMEY WEAR, S.L.GRIMEY WEAR, S.L. did not delete the complainant’s personal data after a request and continued sending promotional emails. The AEPD found this to be a breach of Article 17 GDPR and imposed a fine of 10,000 EUR. | ES | AEPD | GDPR | €10,000 | ↗ |
| 08 May 2024 | CREMA GAMES, S.L.CREMA GAMES, S.L. was fined EUR 5,000 by the AEPD for breaching Article 15 of the GDPR. The company obstructed the complainant’s exercise of the right of access to their personal data. | ES | AEPD | GDPR | €5,000 | ↗ |
| 31 May 2024 | MEDIOS DE PREVENCIÓN EXTERNOS, S.L.MEDIOS DE PREVENCIÓN EXTERNOS, S.L. was fined by the AEPD for leaving medical documentation of police and civil guard agents in a public place. The authority found this to be a breach of data protection rules. | ES | AEPD | GDPR | €100,000 | ↗ |
| 27 May 2022 | B.B.B.B.B.B. was fined EUR 2,000 by the AEPD for failing to provide adequate data protection information in rental contract documentation. The authority found a breach of Article 13 GDPR. | ES | AEPD | GDPR | €2,000 | ↗ |
| 01 Jan 2022 | Telefónica Móviles España, S.A.U.Telefónica Móviles España, S.A.U. was fined by the AEPD EUR 15,000 for processing personal data without a legal basis. The case involved a contract fraudulently created in the complainant's name without consent. | ES | AEPD | GDPR | €15,000 | ↗ |