ARES CAPITAL, S.A. – €200,000 Fine (Spain, 2026)

ARES CAPITAL, S.A. (the controller) is a company that offers transport services. In 2024, a data subject brought a complaint to the DPA. According to the data subject, the controller obliged the data subject to use four apps that continuously monitored their activity, including their location, messages and calls. These apps were used regardless of whether the data subjects used company phones or their personal phones for work related purposes. The controller claimed that data subjects had the choice of using company or personal phones. However, it also admitted that the availability of company phones was subject to budgetary restrictions, and that it encouraged data subjects to use their personal phones. The controller argued that data subjects were informed of the data processing through the mandatory apps. In addition, the controller argued that the processing was lawful as an essential part of the employment contract with the data subjects. Finally, the controller argued that the apps ceased processing data subjects’ data once they closed the apps. During its investigations, the DPA found that the apps processed data constantly. Two apps contained permissions to process additional data, such as location, information on the physical status of the data subject and photos and videos. The DPA found a violation of Article 5(1)(c) GDPR. The DPA stated any app used in personal phones for work-related purposes must limit their data processing activities to those that are strictly necessary. The DPA found that the apps did not comply with this requirement, and therefore the controller did not comply with the principle of data minimisation. The DPA referred to case law from the Spanish High Court,See SAN 136/2019 de 6 de febrero de 2019 (p. 15), ECLI:ES:AN:2019:136 https://www.poderjudicial.es/search/AN/openDocument/8ed60e51766c4e3e/20190219 in which the court highlighted that such measures to track employees were not proportionate and the company’s objectives could be