- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Equifax Iberica S.L. – €1,000,000 Fine (Spain, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Equifax Iberica was fined 1 million euros for including people's personal data about debts in a public file without their permission. This matters because it shows that companies must get consent before sharing personal information. It also highlights the importance of keeping data accurate and transparent.
What happened
Equifax Iberica included personal data of individuals associated with alleged debts in a public file without their consent.
Who was affected
Individuals whose personal data about debts was included in the Judicial Claims and Public Entities File without their permission.
What the authority found
The Spanish data protection authority found that Equifax processed personal data unlawfully, violating principles of lawfulness and transparency under GDPR.
Why this matters
This case emphasizes that companies must obtain consent and ensure data accuracy when handling personal information. It sets a precedent for holding companies accountable for improper data practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 5 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA (AEPD) has imposed a fine of EUR 1,000,000 on Equifax Ibérica, SL. A total of 96 complaints were filed with the DPA against the controller because it had included personal data of individuals associated with alleged debts in the Judicial Claims and Public Entities File ('FIJ') without their consent. In some cases, these data were not even correct. According to the DPA, the processing of the data subjects' personal data involving the FIJ file had been unlawful and violated several data protection principles of data processing (lawfulness and transparency, purpose limitation, data minimization, and accuracy). In addition, the controller had not properly informed the data subjects about the processing of their data, thus violating its duty to inform them.
Related Enforcement Actions (0)
No other enforcement actions found for Equifax Iberica S.L. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
23 April 2021
Authority
Agencia Española de Protección de Datos
Fine Amount
€1,000,000
Enforcement Tracker ID
ETid-656
About this data
Cite as: Cookie Fines. Equifax Iberica S.L. - Spain (2021). Retrieved from cookiefines.eu
Last updated: