GSMA LTD. – €200,000 Fine (Spain, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Spain fined GSMA LTD. €200,000 for not doing a privacy impact check when collecting sensitive data like ID cards for event registration. This matters because businesses must assess privacy risks when handling sensitive information to avoid penalties.
What happened
GSMA LTD. collected sensitive personal data for event registration without conducting a data protection impact assessment.
Who was affected
Individuals who registered for events and had to provide sensitive personal data like ID card information.
What the authority found
The Spanish data protection authority found that GSMA LTD. violated GDPR by not assessing privacy risks when processing sensitive data.
Why this matters
This case highlights the importance of conducting privacy impact assessments when handling sensitive data. Businesses should ensure they evaluate privacy risks to comply with GDPR and avoid fines.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The Spanish DPA has imposed a fine of EUR 200,000 against GSMA LTD.. An individual had filed a complaint with the DPA because they had to transfer special categories of personal data (e.g., ID card data) to the controller in order to register for an event. In the course of its investigation, the DPA found that the controller had failed to conduct a data protection impact assessment for these processing operations.
Related Enforcement Actions (0)
No other enforcement actions found for GSMA LTD. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
3 May 2023
Authority
Agencia Española de Protección de Datos
Fine Amount
€200,000
Enforcement Tracker ID
ETid-1806
About this data
Cite as: Cookie Fines. GSMA LTD. - Spain (2023). Retrieved from cookiefines.eu
Last updated: