- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case PS/00043/2020 – Violation Found (Spain, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Spanish citizen reported that a website collecting personal data did not have a privacy policy. The Spanish Data Protection Agency confirmed this was a breach of the law but only issued a warning since the individual stopped collecting data after being notified. This case emphasizes the importance of having clear privacy policies on websites.
What happened
The agency found that the website did not provide a privacy policy while collecting personal data.
Who was affected
Visitors to the website who provided personal information without being informed about data processing.
What the authority found
The authority decided that the lack of a privacy policy violated GDPR's requirement to inform users about data processing.
Why this matters
This case highlights the necessity for all websites to have a privacy policy, reminding operators to ensure compliance to avoid potential issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A citizen brought to the attention of the AEPD that the website that the respondent used as a platform for the position of president of a professional association in Madrid in 2019, did not have a privacy policy or legal notice, and therefore could be in breach of the right to information of visitors to the website. The website contained a form to collect personal data (name, telephone number, and e-mail address) from those interested in the project led by the defendant. The respondent stopped the data processing when it was warned of the possible unlawfulness of the conduct, and the AEPD was able to verify that the personal data collection form had been removed. Is collecting personal data without the required privacy policy a breach of Article 13 GDPR? The AEPD considered that, in the present case, it was sufficient to impose a warning sanction for breach of the duty to provide information on the processing of data, as set out in article 13 GDPR. In order to determine the level of the sanction, the AEPD took into account the fact that this is a natural person whose main activity is not linked to the processing of personal data and that there is no evidence of recidivism, as there is no record of the commission of previous infringements.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case PS/00043/2020 in ES
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case PS/00043/2020 - Spain (2020). Retrieved from cookiefines.eu
Last updated: