- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
CTC EXTERNALIZACIÓN, S.L – €365,000 Fine (Spain, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
CTC EXTERNALIZACIÓN, S.L. was fined EUR 365,000 by the Spanish DPA for not informing employees that their fingerprints would be stored in a staff portal. This case highlights the importance of clear communication about data collection practices. Companies must ensure they inform employees about how their data will be used and stored.
What happened
CTC EXTERNALIZACIÓN, S.L. was fined for failing to inform employees that their fingerprints would be stored in a staff portal.
Who was affected
Employees whose fingerprints were collected for a time and attendance system were affected.
What the authority found
The DPA found that CTC EXTERNALIZACIÓN, S.L. violated its duty to inform employees and lacked sufficient security measures for processing fingerprints.
Why this matters
This ruling emphasizes the need for companies to be transparent about data collection and storage practices. Businesses should review their data handling procedures to ensure compliance with privacy laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 6 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA has imposed a fine of EUR 365,000 on CTC EXTERNALIZACIÓN, S.L.. An employee had filed a complaint with the DPA due to the fact that the controller had requested fingerprints of employees in order to implement a new time and attendance system. However, it was not communicated that the fingerprints would also be stored in the staff portal. For this reason, the DPA found that the controller had violated its duty to inform. The DPA also found that the controller was unable to demonstrate sufficient security measures for the processing of fingerprints. Finally, the DPA found that the controller had failed to carry out a required data protection impact assessment.
Related Enforcement Actions (0)
No other enforcement actions found for CTC EXTERNALIZACIÓN, S.L in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
12 February 2024
Authority
Agencia Española de Protección de Datos
Fine Amount
€365,000
Enforcement Tracker ID
ETid-2267
About this data
Cite as: Cookie Fines. CTC EXTERNALIZACIÓN, S.L - Spain (2024). Retrieved from cookiefines.eu
Last updated: