ADEVINTA SPAIN, S.L. – Order (Spain, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
ADEVINTA SPAIN, S.L. was ordered by the Spanish data authority to provide information to a job applicant about their application assessment. The job portal claimed they had no data to share, but the authority ruled that they still needed to inform the applicant about who received their data. This ruling reinforces the right to access personal information.
What happened
A job applicant requested access to her assessment data from ADEVINTA SPAIN, S.L.
Who was affected
The job applicant who applied through a blind job offer.
What the authority found
The Spanish data authority ruled that the job portal must provide information about the recipients of the applicant's data, even if they do not store it.
Why this matters
This decision highlights the importance of transparency in job applications. Companies must be prepared to share information about how and with whom personal data is shared.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject made an access request to a job portal for accessing the assessment that the company had carried out on her regarding her application to a job. The job offer was a blind offer, so the claimant did not know which company was behind the offer. The job portal alleged that they did not store any of the data from the candidates or the companies, and that the companies were not allowed either to store or process any data outside the portal. Therefore, they could not give the data subject any data, given that they did not have any. They said, however, that they could help the data subject contact the company that made the offer. The AEPD concluded that, even if the portal did not have any data per se, the right to access includes the communications of such data and the recipients to which it is disclosed. Therefore, the controller should at least provide this information. In their holding, they ordered the controller to comply with the right to access in this sense.
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for ADEVINTA SPAIN, S.L. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. ADEVINTA SPAIN, S.L. - Spain (2021). Retrieved from cookiefines.eu
Last updated: