Spanish Data Protection Authority (AEPD) · 4 October 2024

ROCA & ASOCIADOS ABOGADOS Y ECONOMISTAS, S.L.P.

Insufficient legal basis for data processing

Fine€5,000Fine issued

Regulator: Spanish Data Protection Authority (AEPD)
Decided: 4 October 2024
Country: Spain
Sector: Finance, Insurance and Consulting
Regulator’s reference: Not recorded
Fino case number: 2024/ES/001

Export as PDF

What happened

The DPA fined a controller €5,000 for unlawfully publishing an employee’s image and personal data on the company’s website. Posing for a picture and providing data from a CV did not meet the consent requirements under Article 4(11) GDPR.

Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

Art. 6Lawfulness of processing6(1)Read →

Unlawful processing

Sources

The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.

Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2024/ES/001.