Unknown – €1,000 Fine (Spain, 2026)

€1,000

Agencia Española de Protección de Datos

1 March 2026

Spain

final

Fine

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

An unknown company in Spain was fined €1,000 for asking for a full copy of a person's ID card when issuing an energy performance certificate. This request violated data protection rules because it collected more information than necessary. Businesses should remember to only ask for the information they truly need to protect people's privacy.

What happened

The company requested a full copy of a person's ID card when issuing an energy performance certificate.

Who was affected

The person whose ID card was requested by the unknown company.

What the authority found

The authority found that the company violated the principle of data minimization by asking for unnecessary information.

Why this matters

This case highlights the importance of only collecting necessary information from users. Companies should review their data collection practices to ensure they comply with privacy rules.

GDPR Articles Cited

AI-verified

Art. 5(1)(c) GDPR

View original scraped data

Art. 5(1) c) GDPR

Original data from scraper before AI verification against source document.

Source verified 23 April 2026

articles corrected

national law identified

authority corrected

date discrepancy

Spain enforcement Agencia Española de Protección de Datos actions All Unknown actions

Full Legal Summary

Detailed

The Italian DPA has imposed a fine of EUR 1,000 on a unknown data controller. The controller had been appointed to issue an energy performance certificate for a data subject. In that context, the controller requested a full copy of the front of their ID card alongside other information. Requesting a full copy of the ID card infringed the principle of data minimisation, as a full copy includes data that is not necessary for the purpose of authorising a natural person.

Show full summary

Related Enforcement Actions (11)

Other enforcement actions involving Unknown in ES

Fine

Dec 2020· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) imposed a fine of 10,000 EUR on a company for violating Art. 5 GDPR. The company sent an e-mail to a third party with the dismi...

€10K

Fine

Mar 2021· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) imposed a fine of EUR 9,000 on a website operator. The controller had published photos of the data subject on its website witho...

€9K

Fine

Jul 2021· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on a company. The controller had used the personal data of a third party in order to obtain a m...

€1K

Fine

Sept 2021· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a company. The company had requested various personal data from customers for appointment bo...

€3K

Fine

Nov 2021· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a company. The company had requested various personal data from customers for appointment bo...

€3K

Fine

Jan 2023· Agencia Española de Protección de Datos

The Spanish DPA has imposed a fine on a data controller. The data controller had failed to provide a notice with information about video surveillance ...

€180

Fine

Jan 2023· Agencia Española de Protección de Datos

The Spanish DPA has imposed a fine on a data controller. The data controller had failed to provide a notice with information about video surveillance ...

€180

Fine

Jun 2023· Agencia Española de Protección de Datos

The Spanish DPA has imposed a fine of EUR 600 on a controller for failing to comply with an order issued by the DPA.

€400

Fine

Jun 2023· Agencia Española de Protección de Datos

The Spanish DPA has imposed a fine of EUR 2,000 on a controller for failing to provide data subjects with sufficient information to exercise their rig...

€2K

Fine

Apr 2025· Agencia Española de Protección de Datos

The Spanish DPA imposed a fine on an unknown data controller. The controller stored full copies of personal IDs for verification purposes. In this cas...

€600

Fine

Dec 2025· Agencia Española de Protección de Datos

The Spanish DPA has imposed a fine of EUR 300 on an unkonwn person/entity. The controller failed to react to requests made by the DPA.

€300

Current

Mar 2026

Fine

€1K