BULLETIN №082Last updated · 01 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -21.1%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 31 May 2024 | LABORATORIO PEDRO PERALES, S.L.P.LABORATORIO PEDRO PERALES, S.L.P. was fined by the AEPD 5,000 EUR for failing to comply with data protection rules in relation to cookie management on its website. The case concerned deficiencies in how users were informed and how consent was handled. | ES | AEPD | ePrivacy | €5,000 | ↗ |
| 25 Sept 2020 | SINDICATO DE TRABAJADORES DE LA ADMINISTRACIÓN PÚBLICA (STAP-CGT)The labor union STAP-CGT was fined EUR 3,000 by the AEPD for unlawful processing of personal data. The case concerned publishing a video of a court hearing on YouTube without proper consent, in breach of GDPR Article 6(1)(a). | ES | AEPD | GDPR | €3,000 | ↗ |
| 29 Apr 2022 | ECOZONO Y CULTURA, S.L.ECOZONO Y CULTURA, S.L. collected personal data through surveys without a valid legal basis. The data were intended for later marketing contact with the individuals concerned. The authority found a breach of Article 6(1) GDPR. | ES | AEPD | GDPR | €6,000 | ↗ |
| 06 May 2024 | DQG NORTE A.I.E.DQG NORTE A.I.E. was fined by the AEPD for collecting copies of identity documents and personal data of minors and their guardians without proper data protection information. The authority found breaches of GDPR data minimization and transparency principles. | ES | AEPD | GDPR | €5,000 | ↗ |
| 19 Feb 2021 | SERVICIOS LOGÍSTICOS MARTORELL SIGLO XXI, S.L.The company was fined by the AEPD for deploying a biometric fingerprint system for employee attendance control without carrying out a data protection impact assessment. The authority found this to be a breach of Article 35 GDPR because the processing involved biometric data requiring prior risk assessment. | ES | AEPD | GDPR | €20,000 | ↗ |
| 20 Sept 2016 | CEPSA COMERCIAL PETROLEO, S.A.U.CEPSA COMERCIAL PETROLEO, S.A.U. was fined EUR 4,100 by the AEPD for sending commercial emails to a customer after the customer had requested to unsubscribe. The authority found this to be a breach of Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €4,100 | ↗ |
| 24 Nov 2021 | FRUTAS Y VERDURAS LOS CAMPEONES, S.L.The company was fined by the AEPD EUR 1,500 for installing surveillance cameras without the required informational signage. The case concerned Article 13 GDPR, which requires data subjects to be informed about the processing. | ES | AEPD | GDPR | €1,500 | ↗ |
| 01 Jan 2016 | ORANGE ESPAGNE S.A.U.ORANGE ESPAGNE S.A.U. was fined by the AEPD 2,500 EUR for sending unsolicited commercial communications by electronic means without the recipient's consent. The case indicates a breach of electronic marketing rules and the requirement for prior consent. | ES | AEPD | ePrivacy | €2,500 | ↗ |
| 25 Jul 2019 | VODAFONE ONO, S.A.U.VODAFONE ONO, S.A.U. was fined EUR 60,000 by the AEPD for a security breach in its customer portal. The incident allowed unauthorized access to a third party's personal data, indicating insufficient access controls. | ES | AEPD | GDPR | €60,000 | ↗ |
| 01 Jan 2013 | SEARCH TASK S.L.U.SEARCH TASK S.L.U. was fined EUR 40,000 by the AEPD for sending commercial communications without the required consent. The case concerned a breach of Article 21 of the LSSI and unlawful use of personal data for marketing purposes. | ES | AEPD | ePrivacy | €40,000 | ↗ |
| 19 Oct 2020 | PREDASE SERVICIOS INTEGRALES SOCIEDAD LIMITADAPREDASE SERVICIOS INTEGRALES S.L. was fined EUR 5,000 by the AEPD for failing to publish a privacy policy on its website and for misleadingly using the AEPD logo. The conduct could imply an association with the authority and influence user decisions. | ES | AEPD | GDPR | €5,000 | ↗ |
| 01 Jan 2024 | EDA TV CONSULTING S.L.EDA TV CONSULTING S.L. was fined 5,000 EUR by the AEPD for publishing a minor’s image without consent. The case concerns a breach of data protection rules and the child’s privacy rights. | ES | AEPD | GDPR | €5,000 | ↗ |
| 01 Jan 2023 | NATURGY IBERIA, S.A.Naturgy Iberia was fined for changing a customer's gas and electricity supplier without authorization. The authority found that this breached Article 6(1) of the GDPR because there was no lawful basis for the processing. | ES | AEPD | GDPR | €100,000 | ↗ |
| 20 Sept 2019 | IBERDROLA CLIENTES, SAUIBERDROLA CLIENTES, SAU was fined by the AEPD 10,000 EUR for including personal data in the SOLCENT file without the required authorization. The authority found this to be a breach of data protection rules. | ES | AEPD | GDPR | €10,000 | ↗ |
| 21 Nov 2011 | PUBLIACCION, PUBLICIDAD Y COMUNICACION S.L.U.PUBLIACCION, PUBLICIDAD Y COMUNICACION S.L.U. was fined by the AEPD €1,200 for sending unsolicited SMS messages without recipient consent. The conduct breached Article 21 of the LSSI on unsolicited electronic communications. | ES | AEPD | ePrivacy | €1,200 | ↗ |
| 18 Dec 2025 | TELCOM BUSINESS SOLUTIONS S.L.TELCOM BUSINESS SOLUTIONS S.L. was fined by the AEPD for attempting to process live and biometric data without prior consent. After a purchase, users were redirected to a US-based company for identity verification. | ES | AEPD | GDPR | €25,000 | ↗ |
| 13 Jun 2024 | RETSINNAL GROUP, S.L.U.RETSINNAL GROUP, S.L.U. was fined by the AEPD in the amount of 10,000 EUR for failing to comply with cookie management rules on its website. The breach concerned Article 22.2 of the LSSI. | ES | AEPD | ePrivacy | €10,000 | ↗ |
| 18 Mar 2023 | TOTALENERGIES CLIENTES, S.A.TOTALENERGIES CLIENTES, S.A. was fined EUR 200,000 by the AEPD for linking a customer’s personal data to a third party during gas supply service registration. The authority found this breached data protection principles. | ES | AEPD | GDPR | €200,000 | ↗ |
| 01 Jan 2020 | DESOLASOL RESTAURACIÓN, S.L.The restaurant disclosed a customer's complaint form to other patrons, breaching data protection principles. The case involved unauthorized disclosure of personal information contained in the complaint document. | ES | AEPD | GDPR | €6,000 | ↗ |
| 15 Jul 2013 | ENTABAN SERVICIOS, S.C.ENTABAN SERVICIOS, S.C. was fined by the AEPD EUR 600 for sending unsolicited commercial emails. The messages did not include a means for recipients to opt out, which breached Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €600 | ↗ |