Private Party (A.A.A) – €3,000 Fine (Spain, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Spanish football club's website was fined for not having a privacy policy when collecting personal data. The Spanish data authority stressed the need for transparency about data use. This case highlights the importance of informing users about their data rights.
What happened
The football club's website collected personal data without providing a privacy policy.
Who was affected
Website users who were required to fill out forms with personal data without being informed of their rights.
What the authority found
The Spanish DPA ruled that the website violated GDPR by failing to disclose how personal data was used and users' rights.
Why this matters
This case serves as a reminder that all websites collecting personal data must have a clear privacy policy. Small businesses should ensure they comply with transparency requirements to avoid fines.
GDPR Articles Cited
National Law Articles
Entities Involved
The data subject filed a complaint with the Spanish DPA regarding the website of a football club. The DPA's investigation confirmed that controller's website required users to fill in forms with personal data but did not have a privacy policy. The DPA reiterated that when personal data are collected, there must be accompanying disclosures per Article 13 GDPR, including identifying the means and purposes of processing, the identity and contact details of the controller, and the existence of data subjects' rights under the GDPR. The DPA considered as mitigating factors that (a) the controller was a small company (b) had not profited from its violations, and (c) had no prior violations; it therefore assessed a fine of €3,000 and ordered an appropriate privacy policy be added to the controller's website.
Related Enforcement Actions (0)
No other enforcement actions found for Private Party (A.A.A) in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
6 July 2022
Authority
Agencia Española de Protección de Datos
Fine Amount
€3,000
GDPRhub ID
gdprhub-5050About this data
Cite as: Cookie Fines. Private Party (A.A.A) - Spain (2022). Retrieved from cookiefines.eu
Last updated: