Clinic owner – €10,000 Fine (Spain, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A plastic surgery clinic owner in Spain was fined EUR 10,000 for posting before-and-after photos of a patient on social media without their permission. This matters because it highlights the importance of getting consent before sharing personal images online. Businesses should ensure they have clear permission from individuals before using their photos.
What happened
The clinic owner posted patient photos on Facebook and Instagram without obtaining consent.
Who was affected
The individual patient whose surgery photos were shared without permission.
What the authority found
The Spanish DPA ruled that the clinic owner violated GDPR by not having valid consent to share the patient's images.
Why this matters
This case underscores the need for businesses to prioritize user consent when sharing personal information. It serves as a reminder that failing to do so can lead to significant fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 14 March 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA has fined the owner of a plastic surgery clinic EUR 10,000. The controller posted before-and-after pictures of an individual who had undergone surgery at the clinic on social media (Facebook and Instagram) without obtaining the individual’s consent.
Related Enforcement Actions (0)
No other enforcement actions found for Clinic owner in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
5 July 2024
Authority
Agencia Española de Protección de Datos
Fine Amount
€10,000
Enforcement Tracker ID
ETid-2462
About this data
Cite as: Cookie Fines. Clinic owner - Spain (2024). Retrieved from cookiefines.eu
Last updated: