Fine Tracker — Compliwatch

Imposed	Company	Country	Authority	Type	Amount	↗
28 Jun 2022	AUDIO STOCK, S.L.AUDIO STOCK, S.L. was fined €2,000 by the AEPD for sending commercial SMS messages despite the recipient's objection. The authority found this conduct breached Article 21 of the LSSI on unsolicited commercial communications.	ES	AEPD	ePrivacy	€2,000	↗
17 Apr 2023	VODAFONE ESPAÑA, S.A.U.Vodafone España was fined by the AEPD 200,000 EUR for a data protection breach involving unauthorized SIM card duplication. The incident led to identity theft and fraudulent bank charges.	ES	AEPD	GDPR	€200,000	↗
08 Nov 2024	AECORP 005, S.L.AECORP 005, S.L. was fined EUR 6,000 by the AEPD for failing to provide access to information requested during an investigation. The authority found a breach of Article 58.1 GDPR.	ES	AEPD	GDPR	€6,000	↗
06 Feb 2024	GESTIÓN DE PATRIMONIOS ANFIPOLIS SOCIEDAD DE RESPONSABILIDAD LIMITADAThe AEPD fined GESTIÓN DE PATRIMONIOS ANFIPOLIS SOCIEDAD DE RESPONSABILIDAD LIMITADA EUR 2,000 for sending unsolicited commercial communications without the recipient's consent. The authority noted that the messages were sent despite the recipient's opposition.	ES	AEPD	ePrivacy	€2,000	↗
08 Nov 2012	G.L. GISOFT ANALISIS Y DISEÑO S.L.G.L. GISOFT ANALISIS Y DISEÑO S.L. was fined by the AEPD EUR 600 for sending unsolicited commercial emails without recipient consent. This conduct breached Article 21.1 of the LSSI.	ES	AEPD	ePrivacy	€600	↗
05 Jul 2022	CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. was fined 70,000 EUR by the AEPD. The company continued to demand payment of a debt that had been annulled by a court ruling, which breached data protection rules.	ES	AEPD	GDPR	€70,000	↗
24 Feb 2025	UNICAJA BANCO, S.A.U.UNICAJA BANCO, S.A.U. was fined by the AEPD EUR 3,500,000 for inadequate security measures in its video surveillance system. The authority found a breach of data protection requirements.	ES	AEPD	GDPR	€3,500,000	↗
11 Aug 2025	FUNDACIÓN PARA EL DESARROLLO DE LA ENFERMERÍA y SINDICATO DE ENFERMERÍA, SATSESATSE and FUDEN were fined by the AEPD EUR 15,000 after a ransomware incident affected personal data. The authority also found that the parties had not properly formalized a joint controllership agreement under the GDPR.	ES	AEPD	GDPR	€15,000	↗
19 May 2021	TNT EXPRESS WORLDWIDE SPAIN, S.L.TNT Express Worldwide Spain, S.L. was fined by the AEPD €10,000 for incorrectly linking a personal delivery service to a corporate account. This resulted in the unauthorized sharing of personal data with the complainant’s employer.	ES	AEPD	GDPR	€10,000	↗
28 Oct 2013	LEGALITAS ASISTENCIA LEGAL, S.L.LEGALITAS ASISTENCIA LEGAL, S.L. was fined by the AEPD 33,000 EUR for sending unsolicited commercial communications. The conduct continued despite requests for data cancellation, which breached Article 21 of the LSSI.	ES	AEPD	ePrivacy	€33,000	↗
11 Sept 2025	ATRESMEDIA CORPORACIÓN DE MEDIOS DE COMUNICACIÓN, S.A.ATRESMEDIA was fined by the AEPD for disclosing personal data, including a handwritten signature, in a news broadcast without necessity. The authority found that the disclosure breached data protection principles because it was not proportionate to the purpose of the publication.	ES	AEPD	GDPR	€10,000	↗
19 Jul 2011	A.A.A.A.A.A. was fined EUR 1,200 by the AEPD. The authority found that the entity sent unsolicited commercial emails without the recipient's prior consent, in breach of Article 21 of the LSSI.	ES	AEPD	ePrivacy	€1,200	↗
12 Sept 2022	ROMESTONE, S.L.ROMESTONE, S.L. was fined by the AEPD 6,000 EUR for installing a surveillance camera in a shared rental property without tenant consent. The case concerns a privacy breach in the context of personal data processing.	ES	AEPD	GDPR	€6,000	↗
01 Dec 2023	ENDESA, S.A.The Spanish data protection authority imposed a EUR 6.1 million fine on ENDESA in December 2023. The case involved a security breach that led to the sale of customer personal data through Facebook ads.	ES	Agencia Española de Protección de Datos	GDPR	€6,100,000	↗
01 Jan 2017	ROCK INTERNET, S.L.ROCK INTERNET, S.L. was fined by the AEPD EUR 5,000 for sending unsolicited commercial emails. The conduct breached Article 21.1 of the LSSI, which prohibits such communications without prior recipient consent.	ES	AEPD	ePrivacy	€5,000	↗
06 Mar 2020	IBERDROLA CLIENTES, SAUIBERDROLA CLIENTES, SAU was fined by the AEPD in the amount of EUR 5,000 for failing to provide requested information to the data protection authority. The conduct breached Article 58(1) of the GDPR.	ES	AEPD	GDPR	€5,000	↗
10 Sept 2012	GRUPO ENLACE FOCAM S.L.U.GRUPO ENLACE FOCAM S.L.U. was fined by the AEPD EUR 600 for sending an unsolicited commercial email without the recipient’s consent. The case concerned Article 21.1 of the LSSI, which prohibits this type of marketing communication without prior consent.	ES	AEPD	ePrivacy	€600	↗
28 Jun 2022	DIGI SPAIN TELECOM, S.L.DIGI SPAIN TELECOM, S.L. was fined EUR 70,000 by the AEPD for a SIM card duplication incident. The incident enabled unauthorized attempts to access the complainant's bank accounts and was treated as a breach of Article 6(1) GDPR.	ES	AEPD	GDPR	€70,000	↗
01 Jan 2019	Vodafone España, S.A.U.Vodafone España, S.A.U. was fined EUR 75,000 by the AEPD for a data protection breach. The case involved unauthorized contract portability using a customer's personal data without consent.	ES	AEPD	GDPR	€75,000	↗
01 Jan 2015	IMPROCONSULTEX FORMACION INFORMATICA S.L.IMPROCONSULTEX FORMACION INFORMATICA S.L. was fined by the AEPD EUR 1,000 for sending commercial communications by electronic means without prior consent. The case concerns a breach of Article 21.1 of the LSSI and indicates insufficient legal basis for electronic marketing.	ES	AEPD	ePrivacy	€1,000	↗

Fine Tracker.