- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Private Party (A.A.A) – €3,000 Fine (Spain, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A small football club in Spain was fined for not having a privacy policy on its website. The Spanish data protection authority found that the club collected personal data without informing users about how it would be used. This case highlights the importance of having clear privacy policies for any business that collects personal information.
What happened
The Spanish data protection authority fined a football club for lacking a privacy policy on its website.
Who was affected
Website visitors who were required to provide personal data to the football club without proper disclosures.
What the authority found
The authority ruled that the club violated GDPR requirements by not providing necessary information about data processing.
Why this matters
This ruling emphasizes that all businesses must have clear privacy policies when collecting personal data. It serves as a reminder for small companies to ensure compliance with data protection rules.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Linked-source text retrieved.
Automated check recorded — 15 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject filed a complaint with the Spanish DPA regarding the website of a football club. The DPA's investigation confirmed that controller's website required users to fill in forms with personal data but did not have a privacy policy. The DPA reiterated that when personal data are collected, there must be accompanying disclosures per Article 13 GDPR, including identifying the means and purposes of processing, the identity and contact details of the controller, and the existence of data subjects' rights under the GDPR. The DPA considered as mitigating factors that (a) the controller was a small company (b) had not profited from its violations, and (c) had no prior violations; it therefore assessed a fine of €3,000 and ordered an appropriate privacy policy be added to the controller's website.
Related Enforcement Actions (0)
No other enforcement actions found for Private Party (A.A.A) in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
6 July 2022
Authority
Agencia Española de Protección de Datos
Fine Amount
€3,000
GDPRhub ID
gdprhub-5050About this data
Cite as: Cookie Fines. Private Party (A.A.A) - Spain (2022). Retrieved from cookiefines.eu
Last updated: