- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
GSMA Limited – €600,000 Fine (Spain, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
GSMA Limited was fined for requiring employees to upload proof of COVID-19 vaccination without proper legal justification. This ruling is significant because it shows that companies must have a clear legal basis for processing personal health data. Businesses should be cautious when handling sensitive information.
What happened
GSMA Limited required employees to upload vaccination proof without a valid legal basis.
Who was affected
Employees of suppliers who were asked to provide proof of vaccination.
What the authority found
The Spanish DPA determined that GSMA Limited's processing of vaccination data was unlawful due to lack of a specific legal basis.
Why this matters
This ruling serves as a reminder for companies to ensure they have valid reasons for processing sensitive personal data, especially in health-related matters.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 6 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA has imposed a fine of EUR 600,000 on GSMA Limited. In 2022, GSMA Limited required employees of its suppliers to register on an online platform and upload proof of vaccination against COVID-19. One of the data subjects filed a complaint with the DPA as they considered the data processing to be unlawful. GSMA referred to a legal obligation and public interest, but could not provide a specific legal basis. The DPA found that less invasive safeguards would have been possible and that the affected workers were not sufficiently informed about the data processing.
Related Enforcement Actions (0)
No other enforcement actions found for GSMA Limited in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
31 May 2024
Authority
Agencia Española de Protección de Datos
Fine Amount
€600,000
Enforcement Tracker ID
ETid-2545
About this data
Cite as: Cookie Fines. GSMA Limited - Spain (2024). Retrieved from cookiefines.eu
Last updated: