INFORMA D&B, S.A. – €1,800,000 Fine (Spain, 2025)

In December 2022, an organisation filed a complaint with the DPA. To register with Spain’s Tax Authority, self employed individuals were required to provide personal details including name, national ID number, address, phone, and email. If no business address exists, the person’s home address is recorded, making it personally identifiable. The complaint noted that self-employed workers with lower incomes had disproportionately more of their data published online. Under Spanish law, the Tax Authority is required to share this data with the Chamber of Commerce, which creates a "public business census" that is made accessible online. Separate to its legal obligation, the Chamber of Commerce then transfers the data to CAMERDATA S.A., a commercial entity owned by Spanish Chambers of Commerce, which processes information from approximately 1.6 million self-employed individuals. CAMERDATA enriches this database with additional information and distributes it to other companies such as INFORMA D&B, S.A. (the controller). The controller is a The Xnet argued that self employed persons' data was used for purposes beyond those originally specified, including marketing, they were not properly informed about all recipients of their data and that the publication of this information disproportionately affected self-employed individuals with fewer resources. Under national law, [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673#a1-11 Article 19(2) LOPDGDD] establishes a presumption of a legitimate interest legal basis, however, this is limited to the contact information of individual entrepreneurs. Therefore, the processing of personal data of self-employed persons by the Tax Authority, Chamber of Commerce, Camerdata and others is lawful when it is limited to professional or business-related data, is necessary for maintaining professional/business relationships, and is obtained from public sources. [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673#a1-11 Article 19(2) L