- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Agency – €1,800 Fine (Spain, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An agency in Spain received a fine of €1,800 for throwing away documents that contained personal data without proper security measures. This is important because it shows that companies must take steps to protect personal information, even when disposing of documents.
What happened
The Spanish DPA fined an agency for improperly disposing of documents containing personal data.
Who was affected
Clients of the agency whose personal data was included in the discarded documents.
What the authority found
The DPA ruled that the agency lacked adequate security measures for protecting personal data, violating Article 32 of the GDPR.
Why this matters
This ruling highlights the need for businesses to implement strong data protection practices, including secure disposal methods for documents. Companies should review their data handling and disposal procedures to avoid similar penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 16 March 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA (AEPD) has imposed a fine on an agency. The controller had disposed of documents containing personal data of its clients in the garbage. The AEPD considered this to be a lack of security and data protection measures in the sense of Art. 32 GDPR, which states that 'the controller and processor shall implement appropriate technical and organizational measures to ensure an adequate level of security.' The original fine of EUR 3,000 was reduced to EUR 1,800 due to voluntary payment and acknowledgement of responsibility.
Related Enforcement Actions (0)
No other enforcement actions found for Agency in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
23 August 2021
Authority
Agencia Española de Protección de Datos
Fine Amount
€1,800
Enforcement Tracker ID
ETid-822
About this data
Cite as: Cookie Fines. Agency - Spain (2021). Retrieved from cookiefines.eu
Last updated: