- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Madrileña Red De Gas, S.A.U. – Court Ruling (Spain, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Spanish court overturned a fine against a gas distribution company because the GDPR was applied retroactively to an incident that occurred before it came into effect. This decision is crucial as it reinforces the principle that laws should not be applied retroactively, protecting companies from unexpected penalties. It emphasizes the need for clear legal frameworks.
What happened
The court annulled a fine imposed by the Spanish DPA, stating that the GDPR should not apply to actions taken before its enforcement.
Who was affected
The gas distribution company that was fined for an incident that occurred before the GDPR took effect.
What the authority found
The court ruled that applying the GDPR retroactively violated the constitutional principle of non-retroactivity of the law.
Why this matters
This ruling highlights the importance of clear timelines for legal compliance. Companies should be aware of when regulations take effect to avoid penalties for past actions.
Source checks
Linked-source text retrieved.
Automated check recorded — 21 March 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A gas distribution company appealed the decision PS/00188/2019 of the Spanish DPA (AEPD) for considering that it was against the constitutional principle of non-retroactivity of the law, enshrined in Article 9(3) of the [https://www.boe.es/buscar/act.php?id=BOE-A-1978-31229 Spanish Constitution], as the the Spanish DPA fined the controller in accordance with the GDPR, and the alleged infringement had occurred in April 2018, before the GDPR came into effect. Therefore, GDPR should not had applied. The Spanish National High Court (AN) analysed Recital 171 GDPR and noted that the Regulation had entered into force 20 days after its publication in the Official Journal of the European Union, that is, on May 24, 2016, However, the Regulation only became directly applicable and mandatory in all its elements in each Member State as of May 25, 2018, therefore providing, the Member States and their respective Supervisory Authorities, of a period of 2 years for their preparation, application and interpretation of the different rights and obligations that it establishes. Therefore, both Directive 95/46 and the [https://www.boe.es/buscar/act.php?id=BOE-A-1999-23750 former Spanish Data Protection Act] were fully valid and applicable to the case at hand at the time of the infringement, while the AEPD applied the GDPR to the case. The AN held that the GDPR was not applicable when the alleged infringement happened, in April 2018, and that it had been retroactively applied by the AEPD, what goes against the constitutional principle of non-retroactivity of the law, enshrined in Article 9(3) of the [https://www.boe.es/buscar/act.php?id=BOE-A-1978-31229 Spanish Constitution]. The Court further clarified that the GDPR only could have been applicable if it had been more favourable to the infringer than the law that was in effect at the moment. Consequently, the AN upheld the appeal and annulled the sanction imposed by the AEPD on the controller, ordering the refund of the amount of the fine.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Madrileña Red De Gas, S.A.U. in ES
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Madrileña Red De Gas, S.A.U. - Spain (2021). Retrieved from cookiefines.eu
Last updated: