Spanish Data Protection Authority Imposes an Administrative Fine of €260,000 on a Company Operating a Financial Information Database for Processing Self-Employed Persons’ Data Without Legal Basis and Failing to Inform Data Subjects

The Spanish Data Protection Authority (“AEPD”) has published its decision (“Decision”) stating that a commercial and financial data provider company has violated its obligations under the General Data Protection Regulation (“GDPR”) by processing the personal data of self-employed persons without a legal basis and by failing to inform the data subjects accordingly.

The Decision can be summarised as follows:

• Under national law, the register maintained by the Chamber of Commerce does not contain the Tax Identification Number, thereby complying with the principle of data minimisation. However, the database transferred to the company contained more personal data than the publicly available register.
• The transfer of Tax Identification Numbers was found to be contrary to the agreement between the Chamber of Commerce and the Tax Authority, and it was stated that the “legitimate interest” ground under Article 6(1)(f) GDPR is limited to contact information and cannot extend beyond this scope.
• The Tax Identification Number was emphasised as not being publicly available and, even when encrypted, as retaining its character as personal data within the meaning of Article 4(5) GDPR.
• It was established that the information obligation under Article 14 GDPR had not been fulfilled and that the information provided on the website was incomplete. Reliance on the disproportionate effort exemption was not accepted.

In this context:

• An administrative fine of €200,000 was imposed for the processing of personal data without a legal basis.
• An administrative fine of €60,000 was imposed for the failure to fulfil the information obligation towards the data subjects, resulting in a total fine of €260,000.
• It was further decided that all personal data of self-employed persons obtained from the Chamber of Commerce be deleted, that the processing of such data without a legal basis be ceased, and that the necessary information be provided to the data subjects.

You can access the full text of the Decision here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr

All information and documents on our website have been prepared by Zumbul Attorneys at Law for general informational purposes only, in accordance with the Attorneyship Law, other relevant legislation and the Professional Rules of Attorneyship of the Union of Turkish Bar Associations. These publications are not intended for advertising or commercial purposes. The information and documents provided are of a general nature and under no circumstances, do they guarantee or warrant that the content is complete, accurate, up-to-date, or reliable. You should not rely on the information and documents on this website without first consulting a lawyer or expert. The links included in our website’s publications are sourced from publicly available materials and are provided solely for the convenience of visitors in accessing additional information. These links do not constitute any form of recommendation or endorsement of the linked persons, institutions or organizations. The information on this website does not in any way constitute legal advice or establish an attorney-client relationship with visitors to the site. All content on this website is the property of by Zumbul Attorneys at Law, and no content may be copied, reproduced, or used without prior written permission.