INFORMA D&B, S.A. – €1,800,000 Fine (Spain, 2025)

In December 2022, an organisation filed a complaint with the DPA. To register with Spain’s Tax Authority, self employed individuals were required to provide personal details including name, national ID number, address, phone, and email. If no business address exists, the person’s home address is recorded, making it personally identifiable. The complaint noted that self-employed workers with lower incomes had disproportionately more of their data published online. Under Spanish law, the Tax Authority is required to share this data with the Chamber of Commerce, which creates a "public business census" that is made accessible online. Separate to its legal obligation, the Chamber of Commerce then transfers the data to CAMERDATA S.A., a commercial entity owned by Spanish Chambers of Commerce, which processes information from approximately 1.6 million self-employed individuals. CAMERDATA enriches this database with additional information and distributes it to other companies such as INFORMA D&B, S.A. (the controller). The controller is a The Xnet argued that self employed persons' data was used for purposes beyond those originally specified, including marketing, they were not properly informed about all recipients of their data and that the publication of this information disproportionately affected self-employed individuals with fewer resources. Under national law, [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673#a1-11 Article 19(2) LOPDGDD] establishes a presumption of a legitimate interest legal basis, however, this is limited to the contact information of individual entrepreneurs. Therefore, the processing of personal data of self-employed persons by the Tax Authority, Chamber of Commerce, Camerdata and others is lawful when it is limited to professional or business-related data, is necessary for maintaining professional/business relationships, and is obtained from public sources. [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673#a1-11 Article 19(2) LOPDGDD] must be interpreted strictly, as a broad interpretation allowing all personal data of a self-employed person would be “radically contrary to the spirit of the GDPR”. The DPA held that while the Spanish Tax Agency (AEAT) could lawfully communicate certain data to the Chamber of Commerce under Article 6(1)(c) GDPR (legal obligation), the subsequent transfer to Camerdata and the use of that data for commercial and marketing purposes lacked a valid legal basis. In particular, Camerdata’s reliance on legitimate interest did not outweigh the significant risks to the rights and freedoms of self-employed individuals whose personal data was disclosed. The DPA found a violation of Article 14 GDPR. Here, the DPA relied on the CJEU's reasoning in case C-201/14, Bara, to reinforce that data subjects must be informed when their personal data is shared between public bodies; otherwise, the processing lacks a lawful basis. The controller tried to rely on Article 14(5)(b) GDPR (disproportionate effort), merely publishing a generic privacy notice on its website. The DPA considered this insufficient; controllers must do more than post a hidden or obscure clause—mass scale does not in itself exempt them from notification obligations. The DPA fined the controller €1,800,000 in total: €900,000 for the violation of Article 6 GDPR, and €900,000 for the violation of Article 14 GDPR.