Chamber of Commerce, Industry, Services and Navigation of Spain – €500,000 Fine (Spain, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Spain's data protection authority fined the Chamber of Commerce for sharing company data without a proper legal reason. This matters because it shows that even government bodies must follow strict rules about data privacy. Small business owners should ensure they have valid reasons before sharing any personal information.
What happened
The Chamber of Commerce shared personal data of Spanish companies and self-employed individuals without a valid legal basis.
Who was affected
Spanish companies and self-employed individuals whose data was shared publicly.
What the authority found
The authority ruled that the Chamber of Commerce violated GDPR by failing to have a valid legal basis for processing personal data.
Why this matters
This case highlights the importance of having a valid reason for sharing personal data. It serves as a reminder for businesses to review their data-sharing practices to avoid similar penalties.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The Spanish DPA has imposed a fine of EUR 500,000 on the Chamber of Commerce, Industry, Services and Navigation of Spain. Due to its function within the Spanish Executive, the controller has access to the basic data of all Spanish companies, including information regarding solvency, contact details, tax numbers and more. Self-employed persons are also included. The controller has decided to make this information available to the public. For this purpose, the controller created the legal entity CAMERDATA S.A. (ETid: 2838), which acts as a data processor. The controller transferred the aforementioned data to the processor so that it could be distributed. However, the transfer was not based on a valid legal basis. The amount and kind of data transferred infringed the principles of data minimisation and confidentiality. Furthermore, the manner in which the data was transferred infringed the principle of fairness, and the controller failed to inform the data subjects regarding the data processing.
Related Enforcement Actions (0)
No other enforcement actions found for Chamber of Commerce, Industry, Services and Navigation of Spain in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
15 April 2025
Authority
Agencia Española de Protección de Datos
Fine Amount
€500,000
About this data
Cite as: Cookie Fines. Chamber of Commerce, Industry, Services and Navigation of Spain - Spain (2025). Retrieved from cookiefines.eu
Last updated: