CARTONAJES BAÑERES, S.A – €220,000 Fine (Spain, 2024)

€220,000Agencia Española de Protección de Datos22 November 2024Spain
final
Fine

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

The Spanish data protection authority fined CARTONAJES BAÑERES, S.A. €220,000 for not allowing a former employee to access their personal data and for not assessing the risks of a facial recognition system used to track work hours. This ruling emphasizes the need for companies to comply with data access rights and conduct proper risk assessments. Businesses should take note to avoid similar penalties.

What happened

CARTONAJES BAÑERES, S.A. was fined for failing to grant a former employee access to their personal data and for not conducting a required data protection impact assessment.

Who was affected

A former employee who was denied access to their personal data held by the company.

What the authority found

The Spanish authority found that the company violated data protection rules by not providing access and not assessing the risks of their biometric system.

Why this matters

This fine serves as a strong reminder for businesses to uphold data access rights and perform necessary assessments when implementing new technologies.

GDPR Articles Cited

AI-verified

Art. 15(GDPR)
Art. 35(GDPR)
View original scraped data
Art. 15 GDPR
Art. 35 GDPR

Original data from scraper before AI verification against source document.

Source verified 6 March 2026
verified correct
Full Legal Summary
Detailed

The Spanish DPA has fined CARTONAJES BAÑERES, S.A. EUR 220,000. During its investigation, the DPA found that the controller had failed to grant a former employee access to their personal data. The DPA also found that the controller had failed to carry out a data protection impact assessment regarding the operation of a biometric facial recognition system installed to track working hours.

Related Enforcement Actions (0)

No other enforcement actions found for CARTONAJES BAÑERES, S.A in ES

This is the only recorded action for this entity in this jurisdiction.

Details

Fine Date

22 November 2024

Authority

Agencia Española de Protección de Datos

Fine Amount

€220,000

About this data

Data: CMS GDPR Enforcement Tracker
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. CARTONAJES BAÑERES, S.A - Spain (2024). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: