- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Federación de Balonmano de Castilla y La Mancha – €17,000 Fine (Spain, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Spanish DPA fined Federación de Balonmano de Castilla y La Mancha EUR 17,000 for requiring health data from competitors to participate in a handball competition. This ruling highlights the need for organizations to have a valid legal basis for collecting sensitive health information.
What happened
Federación de Balonmano de Castilla y La Mancha required competitors to submit health data to participate in a sporting event.
Who was affected
The affected individuals were competitors who were asked to provide vaccination or testing certificates to play without a mask.
What the authority found
The DPA ruled that the federation lacked a valid legal basis for processing health data, violating GDPR.
Why this matters
This decision underscores the importance of having a clear legal justification for collecting sensitive health information. Organizations should ensure compliance with data protection rules when handling personal health data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 13 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On November 2021, in order to participate in a handball competition, the data subject was required to upload, on the Federación de Balonmano de Castilla y La Mancha website, a certificate of the complete vaccination against COVID or a certificate of having recovered from the disease or an antigen test with a negative result 48 hours prior to the sporting event. Allegedly, the controller discriminated competitors based on health data they collected, given that only competitors with the presentation of the corresponding certificate of vaccination against COVID-19 or the presentation of antigen tests could play indoors without a mask. Also, the controller also did not provide information on the data retention period and other aspects provided for in Article 13 GDPR. In January 2022, the controller replied and in its response highlighted that due to the evolution of the epidemiological situation and the appearance of variants or the effectiveness, it has stopped processing the data related to COVID in order to participate in the competitions. In its conclusion, the Spanish DPA considered that the requirement of submitting health data in order to participate in the competition without a mask by federated athletes does not fall under the requirements of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021R0953 EU Regulation 2021/953], which created and established the COVID certificate. Also, there is no other legal justification or basis for the processing, violating Article 9 GDPR. AEPD highlighted that Recital 46 GDPR already recognizes that, in exceptional situations, such as an epidemic, the legal basis for processing may be multiple, based on both the public interest and the vital interest of the data subject or another natural person. In this case, the data was collected in the private area of the website managed by the Federation as part of the "safe play without mask protocol-season 21/22". Despite the fact that the website could have provided
Related Enforcement Actions (0)
No other enforcement actions found for Federación de Balonmano de Castilla y La Mancha in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
11 September 2023
Authority
Agencia Española de Protección de Datos
Fine Amount
€17,000
About this data
Cite as: Cookie Fines. Federación de Balonmano de Castilla y La Mancha - Spain (2023). Retrieved from cookiefines.eu
Last updated: