BULLETIN №082Last updated · 31 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -21.4%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 26 Oct 2021 | OPEN BANK, S.A.OPEN BANK, S.A. was fined by the AEPD for using non-essential third-party cookies without prior user consent. The authority also found that the cookies could not be removed, which breached Article 22.2 of the LSSI. | ES | AEPD | ePrivacy | €5,000 | ↗ |
| 15 Nov 2022 | GESTIÓN DE PATRIMONIOS ANFIPOLIS SL.The entity was fined for sending unsolicited commercial emails despite the recipient's explicit objection. The authority found a breach of Article 21 of the LSSI. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 29 Jul 2022 | COMUNIDAD DE PROPIETARIOSA community of property owners was fined by the AEPD €300 for installing a surveillance camera without proper signage. The notice did not identify the data controller or provide contact details for exercising data subject rights. | ES | AEPD | GDPR | €300 | ↗ |
| 22 Oct 2019 | IBERDROLA COMERCIALIZACIÓN DE ÚLTIMO RECURSO, S.A.U. (CURENERGIA COMERCIALIZADORA DE ULTIMO RECURSO, S.A.U.)CURENERGIA was fined EUR 75,000 by the AEPD for using a former client's personal data without consent. The data was used to carry out a fraudulent contract registration. The case indicates a breach of lawful processing and personal data protection requirements. | ES | AEPD | GDPR | €75,000 | ↗ |
| 31 May 2024 | LABORATORIO PEDRO PERALES, S.L.P.LABORATORIO PEDRO PERALES, S.L.P. was fined by the AEPD 5,000 EUR for failing to comply with data protection rules in relation to cookie management on its website. The case concerned deficiencies in how users were informed and how consent was handled. | ES | AEPD | ePrivacy | €5,000 | ↗ |
| 25 Sept 2020 | SINDICATO DE TRABAJADORES DE LA ADMINISTRACIÓN PÚBLICA (STAP-CGT)The labor union STAP-CGT was fined EUR 3,000 by the AEPD for unlawful processing of personal data. The case concerned publishing a video of a court hearing on YouTube without proper consent, in breach of GDPR Article 6(1)(a). | ES | AEPD | GDPR | €3,000 | ↗ |
| 29 Apr 2022 | ECOZONO Y CULTURA, S.L.ECOZONO Y CULTURA, S.L. collected personal data through surveys without a valid legal basis. The data were intended for later marketing contact with the individuals concerned. The authority found a breach of Article 6(1) GDPR. | ES | AEPD | GDPR | €6,000 | ↗ |
| 06 May 2024 | DQG NORTE A.I.E.DQG NORTE A.I.E. was fined by the AEPD for collecting copies of identity documents and personal data of minors and their guardians without proper data protection information. The authority found breaches of GDPR data minimization and transparency principles. | ES | AEPD | GDPR | €5,000 | ↗ |
| 19 Feb 2021 | SERVICIOS LOGÍSTICOS MARTORELL SIGLO XXI, S.L.The company was fined by the AEPD for deploying a biometric fingerprint system for employee attendance control without carrying out a data protection impact assessment. The authority found this to be a breach of Article 35 GDPR because the processing involved biometric data requiring prior risk assessment. | ES | AEPD | GDPR | €20,000 | ↗ |
| 20 Sept 2016 | CEPSA COMERCIAL PETROLEO, S.A.U.CEPSA COMERCIAL PETROLEO, S.A.U. was fined EUR 4,100 by the AEPD for sending commercial emails to a customer after the customer had requested to unsubscribe. The authority found this to be a breach of Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €4,100 | ↗ |
| 24 Nov 2021 | FRUTAS Y VERDURAS LOS CAMPEONES, S.L.The company was fined by the AEPD EUR 1,500 for installing surveillance cameras without the required informational signage. The case concerned Article 13 GDPR, which requires data subjects to be informed about the processing. | ES | AEPD | GDPR | €1,500 | ↗ |
| 01 Jan 2016 | ORANGE ESPAGNE S.A.U.ORANGE ESPAGNE S.A.U. was fined by the AEPD 2,500 EUR for sending unsolicited commercial communications by electronic means without the recipient's consent. The case indicates a breach of electronic marketing rules and the requirement for prior consent. | ES | AEPD | ePrivacy | €2,500 | ↗ |
| 25 Jul 2019 | VODAFONE ONO, S.A.U.VODAFONE ONO, S.A.U. was fined EUR 60,000 by the AEPD for a security breach in its customer portal. The incident allowed unauthorized access to a third party's personal data, indicating insufficient access controls. | ES | AEPD | GDPR | €60,000 | ↗ |
| 01 Jan 2013 | SEARCH TASK S.L.U.SEARCH TASK S.L.U. was fined EUR 40,000 by the AEPD for sending commercial communications without the required consent. The case concerned a breach of Article 21 of the LSSI and unlawful use of personal data for marketing purposes. | ES | AEPD | ePrivacy | €40,000 | ↗ |
| 19 Oct 2020 | PREDASE SERVICIOS INTEGRALES SOCIEDAD LIMITADAPREDASE SERVICIOS INTEGRALES S.L. was fined EUR 5,000 by the AEPD for failing to publish a privacy policy on its website and for misleadingly using the AEPD logo. The conduct could imply an association with the authority and influence user decisions. | ES | AEPD | GDPR | €5,000 | ↗ |
| 01 Jan 2024 | EDA TV CONSULTING S.L.EDA TV CONSULTING S.L. was fined 5,000 EUR by the AEPD for publishing a minor’s image without consent. The case concerns a breach of data protection rules and the child’s privacy rights. | ES | AEPD | GDPR | €5,000 | ↗ |
| 01 Jan 2023 | NATURGY IBERIA, S.A.Naturgy Iberia was fined for changing a customer's gas and electricity supplier without authorization. The authority found that this breached Article 6(1) of the GDPR because there was no lawful basis for the processing. | ES | AEPD | GDPR | €100,000 | ↗ |
| 20 Sept 2019 | IBERDROLA CLIENTES, SAUIBERDROLA CLIENTES, SAU was fined by the AEPD 10,000 EUR for including personal data in the SOLCENT file without the required authorization. The authority found this to be a breach of data protection rules. | ES | AEPD | GDPR | €10,000 | ↗ |
| 21 Nov 2011 | PUBLIACCION, PUBLICIDAD Y COMUNICACION S.L.U.PUBLIACCION, PUBLICIDAD Y COMUNICACION S.L.U. was fined by the AEPD €1,200 for sending unsolicited SMS messages without recipient consent. The conduct breached Article 21 of the LSSI on unsolicited electronic communications. | ES | AEPD | ePrivacy | €1,200 | ↗ |
| 18 Dec 2025 | TELCOM BUSINESS SOLUTIONS S.L.TELCOM BUSINESS SOLUTIONS S.L. was fined by the AEPD for attempting to process live and biometric data without prior consent. After a purchase, users were redirected to a US-based company for identity verification. | ES | AEPD | GDPR | €25,000 | ↗ |