AEPD Resolutions (Spain DPA)

AEPD Resolution on GDPR Rights Procedure

The Spanish Data Protection Agency (AEPD) has issued a resolution regarding a GDPR rights procedure. The resolution addresses a complaint where a data subject exercised their right of access, and the data controller failed to provide a legally established response within the stipulated timeframe. The AEPD admitted the claim for processing.

GDPR Rights Procedure Resolution Against CaixaBank Payments

The Spanish Data Protection Agency (AEPD) has issued a resolution regarding a GDPR rights procedure against CaixaBank Payments & Consumer. The case involves a consumer's complaint about inclusion in a debt collection file without proper notification or justification of debt assignment.

GDPR Resolution: No Fine for DILCAR Gestión S.L.

The Spanish Data Protection Agency (AEPD) has closed an investigation into DILCAR Gestión S.L. regarding the misuse of municipal resources for private business, which involved personal client data. No fine was imposed on the company.

GDPR Resolution: School Used Health Data Without Consent

The Spanish Data Protection Agency (AEPD) initiated a sanctioning procedure against HOLY MARY CATHOLIC SCHOOL, S.L. for allegedly using student health data without proper consent. The procedure was initiated following a complaint filed on April 24, 2024, regarding the use of 'Google Workspace for Education' and its potential access to non-educational content.

AEPD Fines ORNITOLÓGICA DE ANDALUCÍA FOA 131,801 Euros for GDPR Violation

The Spanish Data Protection Agency (AEPD) has issued a resolution imposing a fine of 131,801 euros on ORNITOLÓGICA DE ANDALUCÍA FOA for a data breach. The violation involved the mass emailing of personal data, including names and national identification numbers, to federated associations and individuals.

AEPD Archives Proceedings Against Orange Spain Regarding Portability

The Spanish Data Protection Agency (AEPD) has archived proceedings against Orange Spain concerning a data portability issue. A consumer filed a complaint alleging unauthorized portability of their fixed-line number, leading to service suspension and subsequent restoration. The AEPD closed the case after reviewing the evidence and Orange's response.

GDPR Resolution Fines Company 1,400 Euros for Unsolicited Email

The Spanish Data Protection Agency (AEPD) has issued a resolution fining JOMAFRAN 2013, S. L. 1,400 euros for violating data protection laws. The company sent unsolicited marketing emails referencing a judicial proceeding without prior consent or relationship with the recipient.

GDPR Fine of €4,000,000 Imposed on MODEL REYNA, C.B.

The Spanish Data Protection Agency (AEPD) has imposed a fine of €4,000,000 on MODEL REYNA, C.B. for violations of the GDPR. The company failed to respond to information requests from the agency during an investigation, leading to the sanction.

AEPD Rejects TALENTO MOTOR S.L. Appeal

The Spanish Data Protection Agency (AEPD) has rejected an appeal filed by TALENTO MOTOR S.L. against a prior resolution. The appeal was deemed inadmissible due to being filed outside the legal time limit. This decision upholds the original resolution from November 23, 2025.

Spanish DPA Resolution on Voluntary Payment

The Spanish Data Protection Agency (AEPD) has issued a resolution initiating a sanctioning procedure against EMPRESA.1 for alleged data protection violations. The case involves a complaint regarding the improper acquisition and use of personal data for a contract. The resolution details the initial findings and the company's response.