Nº
|
Keywords
|
Facts
|
Section of GDPR infringed
|
Company /individual
|
Penalty
|
Link
|
1
|
Apps, breach of transparency principle
|
The accused entity collected, through a mobile app, information of geolocation and microphones from users' mobile phones. The objective was to detect fraud in the consumption of televised football in unauthorized locations.
The AEPD understands that the access to the microphone and location data is opaque and that the app should warn the user each time the controversial feature is activated.
The LFP argues that it obtained the informed consent of the users and has announced that it will appeal the decision to the competent court (“Audiencia Nacional”).
|
Art. 5.1.a) GDPR, typified in art. 83.5 a) GDPR
|
Liga Nacional de Fútbol Profesional (LFP)
|
250.000€
|
https://www.aepd.es/resoluciones/PS-00326-2018_ORI.pdf
|
2
|
Energy, breach of integrity and confidentiality principle
|
ENDESA disclosed a third party's personal data by charging the claimant's bank account with a gas receipt that did not correspond to her, but to the third party.
|
Art. 5.1.f) GDPR, typified in art. 83.5 a) GDPR
|
ENDESA ENERGÍA XXI, S.L.U.
|
Initial proposed fine: 100.000€
Final fine: 60.000€ due to responsibility recognition and prompt payment.
|
https://www.aepd.es/resoluciones/PS-00074-2019_ORI.pdf
|
3
|
Financial solvency/ Creditworthiness Files, breach of accuracy principle
|
Due to an error in the entry of the telephone number, the claimant received calls from XFERA MÓVILES, S.A. requiring a debt of which it was not the owner and warning it that it would be recorded in a creditworthiness file.
|
Art. 5 GDPR, typified in art. 83.5 GDPR
|
XFERA MÓVILES, S.A. (YOIGO)
|
65.000€
|
https://www.aepd.es/resoluciones/PS-00094-2019_ORI.pdf
|
4
|
Financial solvency/ creditworthiness files, lack of lawfulness
|
AVON issued invoices with the personal data of the claimant and these were included in a financial solvency/creditworthiness files. AVON could not prove its lawfulness for the processing of such data, since the contract that would serve as a basis was not signed and its formalization was denied by the data subject.
|
Art. 6 GDPR, typified in art. 83.5 GDPR
|
AVON COSMETICS S.A.U
|
60.000€
|
https://www.aepd.es/resoluciones/PS-00159-2019_ORI.pdf
|
5
|
Financial solvency/
creditworthiness files, breach of accuracy principle
|
The company included the claimant's personal data in a creditworthiness file (BADEXCUG) although the claimant had already settled its debt.
|
Art. 5.1 d) GDPR, typified in art. 83.5 GDPR
|
XFERA MÓVILES, S.A. (YOIGO)
|
60.000€
|
https://www.aepd.es/resoluciones/PS-00011-2019_ORI.pdf
|
6
|
Debts’ recovery, breach of integrity and confidentiality principle
|
The entity (dedicated to collecting debts) sent emails to the email addresses that the claimant provided when contracting the credit, but also to the institutional email address of her workplace, which could be accessed by other people besides her.
|
Art. 5.1.f) GDPR, typified in art. 83.2 GDPR
|
GESTIÓN DE COBROS, YO COBRO, S.L.
|
60.000€
|
https://www.aepd.es/resoluciones/PS-00121-2019_ORI.pdf
|
7
|
Telecommunications, lack of lawfulness (consent)
|
Processing of the claimant's ID number without his consent, because it was associated with another client. In addition, he could access the profile of that third client without authorization and due to VODAFONE’s negligence.
|
Art.6.1.a) GDPR, typified in art. 83.5 a) GDPR
|
VODAFONE ESPAÑA, S.A.U.
|
Initial proposed fine: 60.000€
Final fine: 36.000€ due to responsibility recognition and prompt payment.
|
https://www.aepd.es/resoluciones/PS-00056-2019_ORI.pdf
|
8
|
Breach of security of processing
|
The claimant, when accessing the company's customer area through her mother's username and password, was presented with the data of a third party without the latter's consent.
|
Art. 32 GDPR, typified in art. 83. 4 a) GDPR
|
VODAFONE ONO, S.A.U
|
Initial proposed fine: 60.000€
Final fine: 48.000€ due to prompt payment.
|
https://www.aepd.es/resoluciones/PS-00212-2019_ORI.pdf
|
9
|
Telecommunications, breach of integrity and confidentiality principle
|
VODAFONE ONO sent an email to a large number of clients without making use of the blind copy mechanism.
|
Art. 5.1.f) GDPR, typified in art. 83.5 a) GDPR
|
VODAFONE ONO, S.A.U.
|
Initial proposed fine: 60.000€
Final fine: 36.000€ due to responsibility recognition and prompt payment.
|
https://www.aepd.es/resoluciones/PS-00092-2019_ORI.pdf
|
10
|
Telecommunications, breach of integrity and confidentiality principle
|
VODAFONE did not respect the precautionary period between the cancellation of a user of a telephone number and the assignment of the same number to a new user. Therefore, in the "My Vodafone" application, the personal data of the old client continued to appear despite the fact that the telephone number corresponds to a new user.
|
Art. 5.1.f) GDPR, typified in art. 83.5 a) GDPR
|
VODAFONE ESPAÑA S.A.U.
|
Initial proposed fine: 60.000€
Final fine: 36.000€ due to responsibility recognition and prompt payment.
|
https://www.aepd.es/resoluciones/PS-00215-2019_ORI.pdf
|
11
|
Breach of lawfulness, fairness and transparency principle
|
TELEFONICA charged the claimant's bank account with two invoices for the services he had contracted, showing the personal details and address of another client. The entity has not rectified the error yet.
|
Art. 5.1.a) GDPR, typified in art. 83.2 GDPR
|
TELEFONICA MOVILES ESPAÑA, S.A.U.
|
Initial proposed fine: 60.000€
Final fine: 48.000€ due to responsibility recognition and prompt payment.
|
https://www.aepd.es/resoluciones/PS-00173-2019_ORI.pdf
|
12
|
Breach of integrity and confidentiality principle
|
VODAFONE disclosed the claimant's personal data to a third party via an SMS containing a link to the claimant's "Purchase Summary" where her data could be accessed.
|
Art. 5.1.f) GDPR, typified in art. 83.5 a) GDPR
|
VODAFONE ESPAÑA, S.A.U.
|
Initial proposed fine: 48.000€
Final fine: 30.000€ due to responsibility recognition and prompt payment.
|
https://www.aepd.es/resoluciones/PS-00205-2019_ORI.pdf
|
13
|
Telecommunications, breach of accuracy principle
|
The complainant received more than 200 SMS because VODAFONE associated his phone number with other customers and used it, by mistake, to test the sending of messages and check the quality of the online store.
|
Art. 5.1.d) GDPR, typified in art. 83.5 GDPR
|
VODAFONE ESPAÑA, S.A.U.
|
Initial proposed fine: 45.000€
Final fine: 27.000€ due to responsibility recognition and prompt payment.
|
https://www.aepd.es/resoluciones/PS-00411-2018_ORI.pdf
|
14
|
Telecommunications, lack of lawfulness (consent)
|
The entity charged the claimant for a Netflix service that it had not contracted. VODAFONE was not able to prove that the affected party had given its consent, nor conducted the minimum diligence required to verify the identity of the signatory.
|
Art. 6.1 GDPR, typified in art. 83.5 GDPR
|
VODAFONE ESPAÑA, S.A.U.
|
40.000€
|
https://www.aepd.es/resoluciones/PS-00064-2019_ORI.pdf
|
15
|
Telecommunications, lack of lawfulness
|
VODAFONE invoiced a mobile phone user, who was not any longer customer of such entity.
|
Art. 6.1 GDPR, typified in art. 83.5 GDPR
|
VODAFONE ESPAÑA, S.A.U.
|
Initial proposed fine: 35.000€
Final fine: 21.000€ due to responsibility recognition and prompt payment.
|
https://www.aepd.es/resoluciones/PS-00087-2019_ORI.pdf
|
16
|
Video surveillance, breach of minimisation principle
|
Installation of video surveillance system inside a building without an informative sign.
The employees had not been informed about their data protection rights. The establishment did not have a form available for clients to exercise their rights.
|
Art. 5.1 c) GDPR, typified in art. 83.5 GDPR
|
Individual
|
20.000€
|
https://www.aepd.es/resoluciones/PS-00150-2019_ORI.pdf
|
17
|
Breach of lawfulness, fairness and transparency principle
|
The claimant was recorded at his workplace using another employee's mobile phone and without his consent.
These recordings were provided as evidence to justify the disciplinary sanction imposed on him.
|
Art. 5.1 a) GDPR, typified in art. 83.5 GDPR
|
SANTI 3000, S.L. (RESTAURANTE LA OLIVA)
|
Initial proposed fine: 12.000€
Final fine: 9.600€ due to prompt payment.
|
https://www.aepd.es/resoluciones/PS-00401-2018_ORI.pdf
|
18
|
Video surveillance, breach of minimisation principle
|
After an inspection by the Local Police, they found an image-recording device in the corridor area of a building in order to control the workers inside the residence. In addition, there was no informative sign.
|
Art. 5.1.c) GDPR, typified in art. 83.5 a) GDPR
|
Individual
|
9.000€
|
https://www.aepd.es/resoluciones/PS-00050-2019_ORI.pdf
|
19
|
Video surveillance, breach of minimisation principle
|
Installation of a video surveillance system consisting of a series of security cameras oriented to the public road without just cause.
|
Art. 5.1.c) GDPR, typified in art. 83.5 a) GDPR
|
AMADOR RECREATIVOS, S.L. (Playroom TIKI TAKA)
|
Initial proposed fine: 6.000€
Final fine: 3.600€ due to responsibility recognition and prompt payment.
|
https://www.aepd.es/resoluciones/PS-00135-2019_ORI.pdf
|
20
|
Telecommunications, financial solvency/creditworthiness files, breach of accuracy principle
|
VODAFONE included the claimant's data in a financial solvency/creditworthiness files, despite the existence of a complaint previously filed by the data subject to the Telecommunications Authority ("Secretaría de Estado para el Avance Digital - SEAD") for discrepancies in the application of a call voucher signed with the operator. Such claim had been confirmed by SEAD.
|
Art. 5.1.d) GDPR, typified in art. 83.5 GDPR
|
VODAFONE ESPAÑA S.A.U.
|
5.000€
|
https://www.aepd.es/resoluciones/PS-00331-2018_ORI.pdf
|
21
|
No purpose limitation, breach of integrity and confidentiality principle
|
The claimant filled out a form with his personal data to request information about an offer, and was added to a WhatsApp group without his consent.
|
Art.5.1.b) and f) GDPR, typified in art. 83.5 a) GDPR
|
DESSAU ARTE INMOBILIARIO, S.L. (CENTURY 21 ARQUITECTURA)
|
Warning
|
https://www.aepd.es/resoluciones/PS-00195-2019_ORI.pdf
|
22
|
Video surveillance, breach of minimisation principle
|
Installation of a recording device that expressly directed the claimant's workplace in a disproportionate manner, affecting the claimant´s privacy.
|
Art.5.1.c) GDPR, typified in art. 83.5 a) GDPR
|
ELECTROMECANICA REYES, S.L
|
Warning
|
https://www.aepd.es/resoluciones/PS-00123-2019_ORI.pdf
|
23
|
Video surveillance, breach of minimisation principle
|
Installation of a video surveillance system that disproportionately captured images of public space.
|
Art. 5 GDPR, typified in art. 83.5 GDPR
|
METROPOLITAN SPAIN, SL
(Gym)
|
Warning
|
https://www.aepd.es/resoluciones/PS-00341-2018_ORI.pdf
|
24
|
Breach of integrity and confidentiality principle
|
An information note showing a neighbour's debts was published in a place of the Community accessible by neighbours and third parties.
|
Art. 5.1.f) GDPR, typified in art. 83.5 GDPR
|
Community of neighbours
|
Warning
|
https://www.aepd.es/resoluciones/PS-00084-2019_ORI.pdf
|
25
|
Communication of personal data, lack of lawfulness (consent)
|
The owners of a workshop communicated the claimant's details to the third party without his consent, regarding some irregularities of an invoice. The third party contacted him to “resolve the situation” by means of coercion.
|
Art. 6.1.a) GDPR, typified in art. 83.5 a) GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00105-2019_ORI.pdf
|
26
|
Video surveillance, lack of information
|
Installation of a video surveillance system in a vehicle workshop without having the informative sign that notifies the data subjects that there is a processing of personal data.
|
Art. 13 GDPR, typified in art. 83.5 b) GDPR
|
FORMAUTO ALVAREZ FERNANDEZ, S.L.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00136-2019_ORI.pdf
|
27
|
Telecommunications lack of lawfulness
|
The company assigned the claimant a payment for a telephone line to the claimant without his consent. Some personal data concerning the claimant in the entity's database did not belong to him, but to an unknown third party.
|
Art. 6.1 GDPR, typified in art. 83.5 a) GDPR
|
VODAFONE ESPAÑA, S.A.U.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00086-2019_ORI.pdf
|
28
|
Communication for marketing purposes, lack of lawfulness (consent)
|
The company used the complainant's email address to send her newsletters when she had already withdrawn her consent and the company confirmed that the unsubscription had been completed.
|
Art.6.1.a) GDPR, typified in art. 83.5 a) GDPR
|
ANIMA NATURALIS
|
Warning
|
https://www.aepd.es/resoluciones/PS-00400-2018_ORI.pdf
|
29
|
Lack of information
|
The website portaenrere.cat did not offer any information on privacy policy, legal notice, or the way in which it carried out the processing of personal data of people who subscribed to it.
|
Art. 13 GDPR, typified in art. 83.5 b) GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00100-2019_ORI.pdf
|
30
|
Video surveillance, breach of minimisation principle
|
The claimed installed a video surveillance system on the balcony of his home in order with security purposes, which captured images of the public road disproportionately and unnecessarily in relation to the purpose.
|
Art. 5.1.c) GDPR, typified in art. 83.5 a) GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00416-2018_ORI.pdf
|
31
|
Video surveillance, breach of minimisation principle
|
The claimed installed a video surveillance system in their dwelling that could capture images of the public road and the neighbouring dwelling.
|
Art. 5.1.c) GDPR, typified in art. 83.5 a) GDPR
|
Individuals
|
Warning
|
https://www.aepd.es/resoluciones/PS-00349-2018_ORI.pdf
|
32
|
Lack of information
|
The claimed collected personal data from users to send them confirmation of the products selected in the shopping cart and to contact them in case of incidents, without providing the information required by the GDPR.
|
Art. 13 GDPR, typified in art. 83.5 b) GDPR
|
LIVING TERRITORIWEB, S.L.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00419-2018_ORI.pdf
|
33
|
Video surveillance, breach of minimisation principle
|
Installation of cameras that obtained images of a traffic area for vehicles on a public road.
|
Art. 5.1.c) GDPR, typified in art. 83.5 a) GDPR
|
DUNNES STORES ANDALUCIA S.A
|
Warning
|
https://www.aepd.es/resoluciones/PS-00130-2019_ORI.pdf
|
34
|
Video surveillance, out-of-date information
|
Installation of a video surveillance system that recorded images on a continuous basis. There was an informative sign with a link to the page of the company that carried out the installation on it; but the website did not include the information required by the GDPR.
|
Arts. 12.1 and 13 GDPR, typified in art. 83.5 b) GDPR
|
KIOROMAR, S.L.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00352-2018_ORI.pdf
|
35
|
Video surveillance, breach of minimisation principle
|
Installation of a video surveillance system to obtain images of the public road due to a "bad relationship" between the claimed and his neighbour, which does not justify the recording of the public road, which also affects third parties.
|
Art. 5.1 c) GDPR, typified in art. 83.5 a) GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00077-2019_ORI.pdf
|
36
|
Minors, lack of lawfulness (consent)
|
The association photographed the claimant's children to commercialize calendars without asking for the specific consent of their parents.
|
Arts. 6.1 a) and 8 GDPR, typified in art. 83 GDPR
|
ASOCIACIÓN DE MADRES Y PADRES DEL COLEGIO MARÍA BLANCHARD
(Parents’ association of a school)
|
Warning
|
https://www.aepd.es/resoluciones/PS-00089-2019_ORI.pdf
|
37
|
Public entity, breach of integrity and confidentiality principle
|
The fined entity exposed in its notice board (located in the public road) a list of fourteen people with their corresponding ID numbers and signatures without their consent.
|
Art. 5.1.f) GDPR, typified in art. 83.5 a) GDPR
|
CONCEJO DE GARISOAIN
(Public regional administration)
|
Warning
|
https://www.aepd.es/resoluciones/PS-00066-2019_ORI.pdf
|
38
|
Video surveillance, breach of minimisation principle
|
Installation of a video surveillance system that recorded images of the holder’s porch and the public street, but the only purpose was receiving images of the private surroundings.
|
Art. 5.1.c) and 6 GDPR, typified in art. 83.5 a) GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00003-2019_ORI.pdf
|
39
|
Video surveillance, breach of minimisation principle
|
Installation of a video surveillance system, with one of the cameras focusing disproportionately on the dwelling that borders the one of the defendant, without the appropriate informative sign.
|
Art. 5.1.c) GDPR, typified in art. 83.5 a) GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00090-2019_ORI.pdf
|
40
|
Video surveillance, breach of minimisation principle
|
Installation of a video surveillance system that recorded images both from the public street and the establishment’s terrace.
|
Art. 5.1.c) GDPR, typified in art. 83.5 a) GDPR
|
GURMELIA S.C. (TAPERÍA ALBEDRÍO)
|
Warning
|
https://www.aepd.es/resoluciones/PS-00354-2018_ORI.pdf
|
41
|
Video surveillance, breach of minimisation principle, lack of lawfulness
|
Installation of a video surveillance system outside of the owner’s dwelling, focusing on the balconies of the adjoining dwellings and the public street.
|
Art. 5.1 c) and 6 GDPR, typified in art. 83.5 a) GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00010-2019_ORI.pdf
|
42
|
Communication for marketing purposes, lack of transparency and information
|
The controller, when collecting personal information, did not provide an option to object the processing of personal data for direct marketing purposes.
|
Art. 12 GDPR, typified in art. 83.5 b) GDPR
|
TALLERES AUTOPINTURA JIMENEZ, S.L.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00429-2018_ORI.pdf
|
43
|
Workplace, breach of integrity and confidentiality principle
|
The entity sent an email to the claimant and three other colleagues about a work-related issue, without making use of the blind copy mechanism.
|
Art. 5.1. f) GDPR, typified in art. 83.5 a) GDPR
|
QUALITY TECHNOLOGY SOLUTIONS
ALPE, S.L.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00040-2019_ORI.pdf
|
44
|
Workplace, breach of accuracy principle
|
Claimant’s image was still linked to the company’s web page and web browsers despite the fact that he did not work there since two years before.
|
Art. 5.1 d) GDPR, typified in art. 83.5 a) GDPR
|
CIBES LIFT IBERICA, S.L.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00054-2019_ORI.pdf
|
45
|
Breach of integrity and confidentiality principle
|
The entity gave its partners access to documentation with personal data of the complainant and the partners he proposed as witnesses in the disciplinary proceedings that the entity initiated against him.
|
Art. 5.1 f) GDPR, typified in art. 83.5 a) GDPR
|
CLUB RECREATIVO DEPORTIVO PARQUE CARTUJA
(Sports club)
|
Warning
|
https://www.aepd.es/resoluciones/PS-00037-2019_ORI.pdf
|
46
|
Video surveillance, breach of minimisation principle
|
Installation of a camouflaged video surveillance system with cameras looking at the public street, monitoring the entrance of the claimant’s building and without the proper informative sign.
|
Art. 5 and 6 GDPR, typified in art. 83.5 a) GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00334-2018_ORI.pdf
|
47
|
Video surveillance, lack of information, breach of minimisation principle
|
Installation of unmarked video surveillance system filming people passing through the street without just cause.
|
Art. 5.1.c) and 6 GDPR, typified in art. 83.5 a) GDPR
|
CALVADOS 14, S.L.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00022-2019_ORI.pdf
|
48
|
Breach of integrity and confidentiality principle, security measures, security breach
|
The employees of the cleaning service of the school threw documents into a container, including student’s examinations with personal data on them, without taking appropriate measures for the destruction of such documents.
|
Art. 5.1. f) GDPR, typified in art. 83.5 a) GDPR
|
NOBELIS, SOCIEDAD COOPERATIVA MADRILEÑA (Private educational center)
|
Warning
|
https://www.aepd.es/resoluciones/PS-00002-2019_ORI.pdf
|
49
|
Breach of integrity and confidentiality principle
|
The entity sent an email to 24 people without making use of the blind copy mechanism.
|
Art. 5.1. f) GDPR, typified in art. 83.5 a) GDPR
|
THE OLIVER GROUP TORREVIEJA, S.L.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00405-2018_ORI.pdf
|
50
|
Video surveillance, breach of minimisation principle
|
Installation of a video surveillance system on his façade without authorization.
|
Art. 5.1 c) and 6 GDPR, typified in art. 83.5 a) GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00376-2018_ORI.pdf
|
51
|
Video surveillance, breach of minimisation principle
|
Installation of a camera in a dwelling that took disproportionate images of the public road without authorization.
|
Art. 5.1 c) and 6 GDPR, typified in art. 83.5 a) GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00418-2018_ORI.pdf
|
52
|
Lack of information
|
The web collected personal data from people who accessed and registered on it without been provided with the relevant information.
|
Art. 13 GDPR, typified in art. 83.5 GDPR
|
WWW.YELLOWELEPHANT.ES
|
Warning
|
https://www.aepd.es/resoluciones/PS-00015-2019_ORI.pdf
|
53
|
Video surveillance, breach of minimisation principle, lack of lawfulness
|
Installation of a video surveillance system in a building, focusing on the public road without any informative sign.
|
Art. 5.1 c) and 6 GDPR, typified in art. 83.5 a) and b) GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00335-2018_ORI.pdf
|
54
|
Financial solvency/creditworthiness files, breach of accuracy principle
|
Inclusion of the claimant's personal data in a financial solvency/creditworthiness files (ASNEF), regarding a debt that was not certain, due or enforceable.
|
Art. 5.1 d) GDPR, typified in art. 83.5 a) GDPR
|
SISTEMAS FINANCIEROS MOVILES SL
|
Warning
|
https://www.aepd.es/resoluciones/PS-00330-2018_ORI.pdf
|
55
|
Workplace, video surveillance, breach of minimisation principle
|
Installation of video surveillance system in the hotel premises that obtained images of the staff canteen, toilet door for staff, etc.
|
Art. 5.1 c) GDPR, typified in art. 83.5 GDPR)
|
HOTEL ROYAL AL ANDALUS S.A.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00346-2018_ORI.pdf
|
56
|
Video surveillance, breach of minimisation principle
|
Installation of a video surveillance system on the façade of the entity focusing the entrance to it, that captured images of people passing through the street and vehicles circulating on the roadway.
|
Art. 5.1 c) GDPR, typified in art. 83.5 GDPR
|
SANCHEZ JOYEROS TEMPO 2016, S.L.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00348-2018_ORI.pdf
|
57
|
Video surveillance, breach of minimisation principle
|
Installation of a video surveillance system which focused on the complainant's home.
|
Art. 5.1 c) GDPR, typified in art. 83.5 GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00347-2018_ORI.pdf
|
58
|
Video surveillance, breach of minimisation principle
|
Installation of a panoramic video surveillance camera at the entrance of its facilities, capturing images of people passing through the street.
|
Art. 5.1 c) GDPR, typified in art. 83.5 GDPR
|
TODOFUNDICION, S.L.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00375-2018_ORI.pdf
|
59
|
Video surveillance,
breach of minimisation principle, lack of lawfulness
|
Installation of a video surveillance system on the private property of the claimed but with orientation towards the public street in order to obtain images of her vehicle without having any informative sign.
|
Art. 5.1 c) and 6.1 GDPR, typified in art. 83.5 a) and b) GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00378-2018_ORI.pdf
|
60
|
Breach of data minimisation principle
|
The complainant applied for the selection process of the Superior Corps of Technicians in Penitentiary Institutions.
By typing her name and surname in the Google search engine, there is a reference to BOE where it contains the resolution of admitted and excluded.
The resolution contains the claimant's personal data (Name/Surname/ID number/disability degree).
|
Art. 5.1 c) and 9. 1 GDPR, typified in art. 83.5 a) and b) GDPR
|
Secretaría General de Instituciones Penitenciarias
(Body of Penitentiary Institutions)
|
Warning
|
https://www.aepd.es/resoluciones/PS-00361-2018_ORI.pdf
|
61
|
Video surveillance, breach of lawfulness principle
|
Placement of a video camera that focused directly on the entrance of the Headquarters without informing the agents of the placement or its purpose and without any informative sign.
|
Art. 6.1 c) GDPR, typified in art. 83.5 a) GDPR
|
Ayuntamiento de Corita del Ebro
(Corita del Ebro City Council)
|
Warning
|
https://www.aepd.es/resoluciones/PS-00359-2018_ORI.pdf
|
62
|
Lack of information
|
Collection of personal data of users through a web form without being provided with the information required by Article 13 GDPR correctly and completely.
|
Art. 13 GDPR, typified in art. 83.5 b) GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00377-2018_ORI.pdf
|
63
|
Video surveillance, breach of minimisation principle
|
Installation of two video surveillance cameras on the façade of an establishment facing the street and the entrance to a building.
|
Art. 5.1.c) GDPR, typified in art. 83.5 a) GDPR
|
VENDING Y DISTRIBUCIÓN 2017, S.L
|
Warning
|
https://www.aepd.es/resoluciones/PS-00353-2018_ORI.pdf
|
64
|
Video surveillance, breach of minimisation principle
|
Installation of a video surveillance system pointing at the public road and without the proper informative sign. In addition, the images were stored indefinitely.
|
Art. 5.1 c) GDPR, typified in art. 83.5 GDPR
|
Individual
|
Warning
|
https://www.aepd.es/resoluciones/PS-00120-2019_ORI.pdf
|
65
|
Video surveillance, breach of minimisation principle
|
Installation of a video surveillance system both inside and outside a bar, recording external public areas.
Inside the bar there was no informative sign, and outside there was a small sign that could not be easily seen.
|
Art. 5.1 c) GDPR, typified in art. 83.5 GDPR
|
BAR TARIQUEJO
|
Warning
|
https://www.aepd.es/resoluciones/PS-00117-2019_ORI.pdf
|
66
|
Lack of information
|
The company processed personal data without providing the data subjects with the information required by data protection regulations.
|
Art. 13 GDPR, typified in art. 83.5 GDPR
|
CHAPAUTO SPORT, S.L.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00408-2018_ORI.pdf
|
67
|
Breach of integrity and confidentiality principle, public administration
|
Processing of personal information of citizens who went to the Department of Social Services of the City Council in offices shared by several professionals.
|
Arts. 5.1.f) and art. 32.1.b) GDPR, typified in art. 83.4 a) GDPR
|
AYUNTAMIENTO DE PARLA
(Parla City Council)
|
Warning
|
https://www.aepd.es/resoluciones/PS-00365-2018_ORI.pdf
|
68
|
Breach of security of processing
|
Defective configuration of an email account dedicated to internal management of the store. The emails that were sent from that account were visible on the devices exposed in the store.
|
Art. 32 GDPR, typified in art. 83.4 a) GDPR
|
BALMORE ATLANTIC, S.L.
|
Warning
|
https://www.aepd.es/resoluciones/PS-00431-2018_ORI.pdf
|
69
|
Communication for marketing purposes, withdrawing of consent
|
The complainant continued to receive communications for marketing purposes of Vodafone via SMS despite having expressed his wish not to receive them.
|
Art. 21.1 E-commerce Act, typified in art. 38.4.d)
|
VODAFONE ESPAÑA, S.A.U.
|
Initial proposed fine: 10.000€
Final fine: 6.000€ due to responsibility recognition and prompt payment.
|
https://www.aepd.es/resoluciones/PS-00189-2019_ORI.pdf
|
70
|
Communication for marketing purposes, lack of lawfulness (consent)
|
The complainant received communications for marketing purposes from the Company without having had any commercial relationship in the past.
|
Art. 21.1 E-commerce Act, typified in art. 38.4.d)
|
MAPEX AGENCIA CONSULTING, S.L.
|
1.000€
|
https://www.aepd.es/resoluciones/PS-00169-2019_ORI.pdf
|