- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
CÍTRICOS TANTA, S.L. – €5,000 Fine (Spain, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
CÍTRICOS TANTA, S.L. was fined EUR 5,000 for entering an employee's personal data into a government register without them ever having worked there. This matters because it shows the importance of having a valid reason to process personal data.
What happened
CÍTRICOS TANTA, S.L. entered personal data of an employee into the Social Security General Employee Register without the employee ever having worked.
Who was affected
The employee whose personal data was improperly registered.
What the authority found
The Spanish DPA ruled that the company failed to delete the data, violating GDPR's requirement for lawful processing.
Why this matters
This case highlights the need for companies to ensure they have a valid legal basis for processing personal data. Businesses should regularly review their data handling practices to avoid similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 15 March 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA has imposed a fine of EUR 5,000 on CÍTRICOS TANTA, S.L.. The controller had entered personal data of an employee in the Social Security General Employee Register without the employee ever having actually worked. For this reason, the controller would have been obliged to cancel the entry of the data subject in the register within 72 hours, which the controller failed to do. In the absence of the data subject's work performance, the controller no longer had a legal basis to upload the data to the register. Therefore, the DPA found that the failure to delete the data constituted an unlawful processing of the data subject's personal data.
Related Enforcement Actions (0)
No other enforcement actions found for CÍTRICOS TANTA, S.L. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
2 November 2022
Authority
Agencia Española de Protección de Datos
Fine Amount
€5,000
Enforcement Tracker ID
ETid-1484
About this data
Cite as: Cookie Fines. CÍTRICOS TANTA, S.L. - Spain (2022). Retrieved from cookiefines.eu
Last updated: