Spain

Resolución AEPD PS/00598/2025 contra Respondent (PS/00598/2025)

Resolución AEPD PS/00643/2025 contra Respondent (PS/00643/2025)

Resolución AEPD PS/00354/2024 contra Respondent (PS/00354/2024)

Resolución AEPD PS/00278/2025 contra Respondent (PS/00278/2025)

Resolución AEPD PS/00352/2024 contra Respondent (PS/00352/2024)

Resolución AEPD PS/00613/2025 contra Respondent (PS/00613/2025)

Resolución AEPD PS/00259/2025 contra Respondent (PS/00259/2025)

The AEPD fined CaixaBank €6 million for processing the biometric data of employees using a fingerprint access control system without adequate legal basis. The fine was later reduced to €3 million following voluntary payment and acknowledgement of responsibility.

The AEPD fined Yoigo/Xfera Móviles €900,000 for making unsolicited commercial communications to customers who had not given consent, violating LOPDGDD provisions on the use of contact data for direct marketing purposes.

The AEPD fined Endesa €3 million for processing customers' personal data without a valid legal basis for direct marketing, and for failing to adequately handle data subjects' objections to marketing communications.

The AEPD fined BBVA €5 million for tracking customers' location data and processing personal data for profiling purposes without adequate transparency and without providing clear consent mechanisms in the BBVA mobile banking application.

The AEPD fined Vodafone España €8.15 million for multiple GDPR violations including unlawful processing of personal data for commercial communications without consent, obstructing customer requests to exercise data protection rights, and inadequate data security measures.