Unknown – €1,000 Fine (Spain, 2026)

€1,000

Agencia Española de Protección de Datos

1 March 2026

Spain

final

Fine

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

An unknown company in Spain was fined €1,000 for asking for too much personal information when issuing an energy performance certificate. They requested a full copy of a person's ID card, which was unnecessary for the task. This case serves as a reminder to businesses about the importance of only collecting necessary information.

What happened

An unknown company requested a full copy of a person's ID card when issuing an energy performance certificate.

Who was affected

The individual who needed the energy performance certificate was affected by the excessive data request.

What the authority found

The Spanish DPA found that the company violated data minimization principles by asking for more information than needed.

Why this matters

This case highlights the need for companies to limit data collection to what is strictly necessary, reinforcing the principle of data minimization.

GDPR Articles Cited

AI-verified

Art. 5(1)(c) GDPR

View original scraped data

Art. 5(1) c) GDPR

Original data from scraper before AI verification against source document.

National Law Articles

AI-identified

Art. 65.4 LOPDGDD

Source verified 23 April 2026

articles corrected

national law identified

authority corrected

date discrepancy

Spain enforcement Agencia Española de Protección de Datos actions All Unknown actions

Full Legal Summary

Detailed

The Italian DPA has imposed a fine of EUR 1,000 on a unknown data controller. The controller had been appointed to issue an energy performance certificate for a data subject. In that context, the controller requested a full copy of the front of their ID card alongside other information. Requesting a full copy of the ID card infringed the principle of data minimisation, as a full copy includes data that is not necessary for the purpose of authorising a natural person.

Show full summary

Related Enforcement Actions (11)

Other enforcement actions involving Unknown in ES

Fine

Dec 2020· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) imposed a fine of 10,000 EUR on a company for violating Art. 5 GDPR. The company sent an e-mail to a third party with the dismi...

€10K

Fine

Mar 2021· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) imposed a fine of EUR 9,000 on a website operator. The controller had published photos of the data subject on its website witho...

€9K

Fine

Jul 2021· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on a company. The controller had used the personal data of a third party in order to obtain a m...

€1K

Fine

Sept 2021· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a company. The company had requested various personal data from customers for appointment bo...

€3K

Fine

Nov 2021· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a company. The company had requested various personal data from customers for appointment bo...

€3K

Fine

Jan 2023· Agencia Española de Protección de Datos

The Spanish DPA has imposed a fine on a data controller. The data controller had failed to provide a notice with information about video surveillance ...

€180

Fine

Jan 2023· Agencia Española de Protección de Datos

The Spanish DPA has imposed a fine on a data controller. The data controller had failed to provide a notice with information about video surveillance ...

€180

Fine

Jun 2023· Agencia Española de Protección de Datos

The Spanish DPA has imposed a fine of EUR 600 on a controller for failing to comply with an order issued by the DPA.

€400

Fine

Jun 2023· Agencia Española de Protección de Datos

The Spanish DPA has imposed a fine of EUR 2,000 on a controller for failing to provide data subjects with sufficient information to exercise their rig...

€2K

Fine

Apr 2025· Agencia Española de Protección de Datos

The Spanish DPA imposed a fine on an unknown data controller. The controller stored full copies of personal IDs for verification purposes. In this cas...

€600

Fine

Dec 2025· Agencia Española de Protección de Datos

The Spanish DPA has imposed a fine of EUR 300 on an unkonwn person/entity. The controller failed to react to requests made by the DPA.

€300

Current

Mar 2026

Fine

€1K