- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Terra, Brasa Y Mar – €500 Fine (Spain, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Terra, Brasa Y Mar, a restaurant, was fined for adding over 200 people to a WhatsApp group without their consent. This action violated data protection laws by exposing personal phone numbers to others in the group.
What happened
The restaurant added users to a promotional WhatsApp group without obtaining their consent.
Who was affected
Over 200 individuals who were added to the WhatsApp group without their permission were affected.
What the authority found
The Spanish DPA ruled that Terra, Brasa Y Mar processed personal data without a legal basis, violating GDPR.
Why this matters
This ruling serves as a reminder that businesses must obtain consent before using personal data for marketing purposes. Companies should review their practices to ensure compliance with data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 17 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In December 2023, the data subject, along with over 200 others, was added to a WhatsApp group by the owner of Terra, Brasa Y Mar (data controller), a restaurant. No consent was sought for the inclusion of the data subjects in the WhatsApp group. The WhatsApp group was used to promote a New Years Eve celebration taking place in the restaurant. The messages included information about the menu that would be served on the occasion and the price. In December 2023, the data subject filed a complaint with the AEPD (Spanish DPA). The DPA found that the controller had infringed Article 6(1) GDPR for processing personal data without a legal basis. The DPA noted that the impact of the infringement was relatively serious, as each data subject’s phone number was exposed to everyone else in the group. Accordingly, the DPA imposed an administrative fine of €500 on the controller.
Related Enforcement Actions (0)
No other enforcement actions found for Terra, Brasa Y Mar in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
2 April 2025
Authority
Agencia Española de Protección de Datos
Fine Amount
€500
About this data
Cite as: Cookie Fines. Terra, Brasa Y Mar - Spain (2025). Retrieved from cookiefines.eu
Last updated: