Spanish Data Protection Authority (AEPD) · 20 June 2025
COLEGIO VIRGEN DE EUROPA, S.L.
Insufficient legal basis for data processing
Fine€24,000Fine issued
- Regulator
- Spanish Data Protection Authority (AEPD)
- Decided
- 20 June 2025
- Country
- Spain
- Sector
- Public Sector and Education
- Regulator’s reference
- Not recorded
- Fino case number
- 2025/ES/054
What happened
The DPA fined a school €24,000 for recording students without the knowledge or consent of neither the students nor their parents. A pedestrian found footage of an underage student in a backpack on the road, and law enforcement found additional recordings of that student in the home of one of the teachers.
Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 5Principles relating to processing of personal data5(1)(f)Read →
- Art. 6Lawfulness of processing6(1)Read →
- Art. 13Information to be provided where personal data are collected from the data subjectRead →
- Data principles
- Transparency
- Unlawful processing
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2025/ES/054.