Order report
BULLETIN №082Last updated · 31 Jul 2026

Fine Tracker.

A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.

5,273 entries

Total fines
€8.6bn
Decisions
5,273
Jurisdictions
33
Regulators
74
Avg monthly
€162.7m
YoY volume
-21.4%
Country
Type
Date range
ImposedCompanyCountryAuthorityTypeAmount↗
16 Apr 2021CREATOR ENERGY, S.L.CREATOR ENERGY, S.L. was fined by the AEPD 6,000 EUR for using personal data without consent to contract gas, electricity, and maintenance services. The authority found this conduct breached Article 6(1)(b) GDPR.ESAEPDGDPR€6,000↗
02 Dec 2019IMNOVA RESORT, S.L.IMNOVA RESORT, S.L. was fined by the AEPD EUR 3,000 for installing cookies on its online store without obtaining user consent. The authority found this conduct to be in breach of the LSSI.ESAEPDePrivacy€3,000↗
02 Mar 2022FUENTES VISIÓN, S.L.FUENTES VISIÓN, S.L. was fined by the AEPD 500 EUR for continuing to send marketing emails despite requests to unsubscribe and delete personal data. The authority found a breach of Article 21 of the LSSI.ESAEPDePrivacy€500↗
23 May 2022MH VILASECA S.L.MH VILASECA S.L. was fined by the AEPD 400 EUR for installing a video surveillance system without the required informational signage. The authority found this to be a breach of Article 13 GDPR.ESAEPDGDPR€400↗
04 Aug 2022AUTOBIZ, S.A. SUCURSAL EN ESPAÑAAUTOBIZ, S.A. Sucursal en España was fined by the AEPD €800 for sending unsolicited marketing messages. The authority also found that the company failed to provide a functional opt-out mechanism, breaching Article 21 of the LSSI.ESAEPDePrivacy€800↗
21 Jan 2019XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined by the AEPD in the amount of 2,500 EUR for sending unsolicited commercial SMS messages. The authority found that this conduct breached Article 21.1 of the LSSI.ESAEPDePrivacy€2,500↗
05 Jul 2024PUBLICACIONES Y EDICIONES BARACA 208, S.L.The company published personal data, including health information, in a digital newspaper article. The authority found a breach of data minimisation and the rules on special category data under GDPR Articles 5(1)(c) and 9.ESAEPDGDPR€10,000↗
26 May 2023B.B.B.The entity was fined EUR 300 by the AEPD for operating a video surveillance system that captured public areas without proper informational signage. The authority treated this as a breach of data protection rules.ESAEPDGDPR€300↗
06 Jan 2022B.B.B.A fine was imposed for the mass dissemination of a video recorded without the victim’s consent on social media and via WhatsApp. The authority found a breach of Article 6(1) GDPR.ESAEPDGDPR€10,000↗
04 Feb 2020BAZAR SUSANABAZAR SUSANA was fined EUR 4,000 by the AEPD for improperly obtaining and disseminating personal images from a video surveillance system. The case concerns a breach of data protection rules and the unlawful processing of CCTV footage.ESAEPDGDPR€4,000↗
08 Jan 2026MEDIOS DE PREVENCIÓN EXTERNOS SUR, S.L.The company suffered a ransomware attack that caused a breach of the confidentiality and availability of personal data. AEPD found a violation of Article 5(1)(f) GDPR.ESAEPDGDPR€60,000↗
01 Jan 2016VODAFONE ONO, S.A.U.Vodafone Ono, S.A.U. was fined by the AEPD 6,000 EUR for sending unsolicited advertising SMS messages to a complainant. The complainant's data had previously been canceled, indicating a breach of data handling and marketing communication rules.ESAEPDePrivacy€6,000↗
05 Jul 2023BILBAO AD INFINITUM, S.L.BILBAO AD INFINITUM, S.L. was fined by the AEPD EUR 500 for installing surveillance cameras directed at a public square without prior administrative authorization. The authority found that this conduct breached GDPR requirements on lawful processing.ESAEPDGDPR€500↗
16 Jul 2020TELEFÓNICA DE ESPAÑA, S.A.U.TELEFÓNICA DE ESPAÑA, S.A.U. was fined EUR 55,000 by the AEPD for processing personal data without consent. The company registered phone lines and charged invoices to an individual who had not authorized these actions.ESAEPDGDPR€55,000↗
06 Apr 2020PETROLIS INDEPENDENTS, S.L.PETROLIS INDEPENDENTS, S.L. was fined by the AEPD in the amount of 3,000 EUR for failing to comply with data protection rules regarding cookie policies on its website. The case concerned information requirements and the compliance of cookie mechanisms with privacy rules.ESAEPDePrivacy€3,000↗
29 Nov 2022B.B.B.The entity was fined by the AEPD EUR 300 for installing surveillance cameras that recorded images and sound in public and communal areas without the required authorization. This constituted a breach of data protection rules.ESAEPDGDPR€300↗
01 Jan 2023QUALITY-PROVIDER S.A.QUALITY-PROVIDER S.A. was fined 20,000 EUR by the AEPD for unlawfully obtaining personal data from a website. The data was then used for promotional purposes without the consent of the data subjects.ESAEPDGDPR€20,000↗
01 Jan 2014DIVER KARTING, S.L.DIVER KARTING, S.L. was fined by the AEPD in the amount of EUR 2,300 for continuing to send commercial communications after the individual exercised the right to object and requested to unsubscribe. The case concerns failure to respect a valid opt-out from direct marketing.ESAEPDePrivacy€2,300↗
04 Jul 2023BALLESPE, S.LBALLESPE, S.L was fined by the AEPD in the amount of 500 EUR for installing surveillance cameras that captured public areas without proper signage. The case concerns a breach of data protection rules and the duty to inform individuals being recorded.ESAEPDGDPR€500↗
18 Jan 2022MAJESTIC SOLUTIONS S.L.MAJESTIC SOLUTIONS S.L. was fined by the AEPD 10,000 EUR for failing to provide all required information to affected individuals after a personal data security breach. The authority found a breach of Article 34(2) GDPR.ESAEPDGDPR€10,000↗