Terra, Brasa Y Mar – €500 Fine (Spain, 2025)

In December 2023, the data subject, along with over 200 others, was added to a WhatsApp group by the owner of Terra, Brasa Y Mar (data controller), a restaurant. No consent was sought for the inclusion of the data subjects in the WhatsApp group. The WhatsApp group was used to promote a New Years Eve celebration taking place in the restaurant. The messages included information about the menu that would be served on the occasion and the price. In December 2023, the data subject filed a complaint with the AEPD (Spanish DPA). The DPA found that the controller had infringed Article 6(1) GDPR for processing personal data without a legal basis. The DPA noted that the impact of the infringement was relatively serious, as each data subject’s phone number was exposed to everyone else in the group. Accordingly, the DPA imposed an administrative fine of €500 on the controller.