Who was sanctioned, and for what?

The car rental company charged customers an "administration fee" of 33.88 to 45 EUR when a rental car incurred a traffic offence – even though naming the driver is a statutory obligation of the rental company. Spain's Ministry of Social Rights, Consumer Affairs and 2030 Agenda classified this as a very serious infringement and imposed the maximum fine of 1 million EUR; a court had already declared the clause void in 2020.

Authority / court

Ministerio de Derechos Sociales, Consumo y Agenda 2030

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Artt. 82, 87.5 y 87.6 TRLGDCU (Real Decreto Legislativo 1/2007)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Repeat case

yes

Published

29 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The manufacturer of solar tracking systems disseminated its results for 2023 by way of an "Otra Información Relevante" announcement containing inaccurate information. Spain's National Securities Market Commission (CNMV) imposed a fine of 190,000 EUR for a serious infringement; the company waived administrative appeals.

Authority / court

Comisión Nacional del Mercado de Valores (CNMV)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 297.1.e i. V. m. 297.2.d Ley 6/2023; Art. 17 i. V. m. Art. 7 MAR

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Published

3 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Ministerio de Derechos Sociales, Consumo y Agenda 2030 (Spanish Ministry of Social Rights, Consumer Affairs and 2030 Agenda) imposed fines totalling 3,600,902 EUR (1,000,000, 990,900, three times 500,000, 100,001 and 10,001 EUR) on the rental agency Alquiler Seguro for six very serious and one serious breach of tenants' consumer rights. Among other things, the company had required tenants to pay for a tenant service as management and contract costs, to take out home insurance for the landlord's benefit and to bear debt collection and court costs, used a clause allowing reporting to debtor registers and excluded the right of withdrawal. The clauses must be removed and the sanction published.

Authority / court

Ministerio de Derechos Sociales, Consumo y Agenda 2030

Area of law

Consumer protection and online retail

Legal basis

Verbraucherschutzrecht (in der Pressemitteilung nicht einzeln zitiert); Ley 12/2023, de 24 de mayo, por el derecho a la vivienda (Verbot, Verwaltungs- und Vertragskosten auf Mieter abzuwälzen)

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Published

8 Apr 2026

Checked against the official source on 28 Sep 2026 · Direct link

In February 2023 there was external, unauthorised access to a system operated by a processor containing data on users and employees. As lead authority, the AEPD imposed 650,000 EUR for breaching Art. 5(1)(f) GDPR, dropped the charges under Art. 32 and 34 and ordered appropriate security measures within six months. The amount and the facts have not been confirmed against the primary source.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Checked against the official source on 7 Oct 2026 · Version 2 · Direct link

The Comisión Nacional de los Mercados y la Competencia (CNMC, Spanish competition and markets authority) imposed a fine of 20,500,000 EUR on Repsol group companies, for which Repsol S.A. and Repsol Customer Centric are also jointly and severally liable as parent companies: between April and December 2022 Repsol used its dominant position in the wholesale supply of motor fuels to service stations to squeeze the diesel margins of independent stations by raising wholesale prices while granting additional discounts to professional drivers at its own stations. In addition, three companies are barred for six months from public tenders for the supply of diesel fuel.

Authority / court

Comisión Nacional de los Mercados y la Competencia (CNMC)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 2 und Art. 62.4.b) Ley 15/2007 de Defensa de la Competencia; Art. 102 AEUV; Vergabeverbot nach Art. 71.1.b) Ley 9/2017 de Contratos del Sector Público

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Employees

10,000 or more

Published

3 Feb 2026

Checked against the official source on 28 Sep 2026 · Direct link

An employee of the customer service provider was serving two customers in chat at the same time and assigned one customer's e-mail address to the other; as a result, the complainant received the name, debts and billing data of a stranger. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) saw the cause in the process design, which allowed parallel chats, and imposed 500,000 EUR for lack of data protection by design; the request for reconsideration was rejected.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data processors

Legal basis

Art. 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

The Ministerio de Derechos Sociales, Consumo y Agenda 2030 (Spanish Ministry of Social Rights, Consumer Affairs and 2030 Agenda) imposed fines totalling 64,055,311 EUR on the holiday rental platform Airbnb, mainly because 65,122 listings advertised holiday homes without a licence, with a non-matching registration number or without accurate information on the legal status of the hosts (63,980,311 EUR, six times the unlawful profit). In addition, 10,000 EUR were imposed for missing information on distance contracts, 10,000 EUR for unanswered information requests and 55,000 EUR for failing to comply with interim orders; Airbnb must also remove the unlawful content and publish the sanction. The decision is not final.

Authority / court

Ministerio de Derechos Sociales, Consumo y Agenda 2030

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 47.1 Buchst. m), t), i) und o) Texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios (Real Decreto Legislativo 1/2007)

Action

Fine

Status of proceedings

under appeal

Sector

Media and online platforms

Published

15 Dec 2025

Checked against the official source on 28 Sep 2026 · Direct link

Following a cyber attack involving unauthorised access to data, which according to the decision may have affected up to around 6.38 million people (including around 4.67 million customers in Spain as well as employees and former employees), the AEPD as lead authority found inadequate security measures (Art. 5(1)(f) GDPR). The sanction of 2,600,000 EUR was reduced by 40% to 1,560,000 EUR because liability was acknowledged and payment made voluntarily; remedial measures were also ordered.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f DSGVO

Action

Fine

Status of proceedings

final

Sector

Retail and e-commerce

Employees

1,000 to 9,999

Mitigating circumstances

40% reduction for acknowledgement of liability and voluntary payment (Art. 85 LPACAP).

Published

19 Dec 2025

Checked against the official source on 28 Sep 2026 · Direct link

A hospital of the group had removed from its archive earlier MRI scans that a patient had brought in for comparison once an internal collection period had expired, so that they were no longer available. The AEPD imposed 100,000 EUR each for processing health data without a legal basis (Art. 9 and Art. 6) and 1,000,000 EUR for lack of data protection by design in the procedure (Art. 25), 1,200,000 EUR in total.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 6, 9, 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

20 Mar 2026

Checked against the official source on 28 Sep 2026 · Direct link

The airport operator AENA used a biometric facial recognition system for access, transit and boarding at several airports without presenting a data protection impact assessment meeting the legal requirements. The AEPD imposed 10,043,002 EUR for breaching Art. 35 GDPR and confirmed the provisional suspension of all biometric processing until a proper impact assessment is in place.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection

Legal basis

Art. 35 DSGVO (Art. 83 Abs. 4 lit. a DSGVO)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Employees

1,000 to 9,999

Published

20 Mar 2026

Checked against the official source on 28 Sep 2026 · Direct link

The Comisión Nacional del Mercado de Valores (CNMV, Spanish securities market supervisor) fined Twitter International Unlimited Company 5,000,000 EUR for a continuing very serious breach of its duties to assist the supervisor. For the advertisements listed in a CNMV request of 8 November 2023, the company did not check whether the advertiser Quantum AI was authorised to provide investment services in Spain or appeared on warning lists of the CNMV or foreign supervisors; it waived administrative appeals.

Authority / court

Comisión Nacional del Mercado de Valores (CNMV)

Area of law

Capital markets and financial supervision

Legal basis

Art. 290.1.n) i. V. m. Art. 290.2.f) Ley 6/2023 de los Mercados de Valores y de los Servicios de Inversión

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

13 Nov 2025

Checked against the official source on 28 Sep 2026 · Direct link

The operator of a sports facility rented a Bluetooth system with which swimmers were located in the pool via tags and their training was recorded. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) imposed 8,000 EUR for the processing of special categories of data and – after a 20% reduction for immediate payment – 4,000, 2,400 and 3,200 EUR for lack of a legal basis, insufficient information and a deficient impact assessment (17,600 EUR in total); the request for reconsideration was unsuccessful.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 13, Art. 35 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Mitigating circumstances

Partial immediate payment (20% reduction under Art. 85 LPACAP).

Checked against the official source on 25 Sep 2026 · Direct link

In December 2023 an attacker used credentials leaked elsewhere to retrieve customer data, including partial payment method data, through a service of the financial services provider. The AEPD found a breach of Art. 5(1)(f) GDPR; the sanction of 2,500,000 EUR was reduced by 40% to 1,500,000 EUR because liability was acknowledged and payment made voluntarily.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f DSGVO

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

40% reduction for acknowledgement of liability and voluntary payment (Art. 85 LPACAP).

Published

19 Dec 2025

Checked against the official source on 28 Sep 2026 · Direct link

The Comisión Nacional de los Mercados y la Competencia (CNMC, Spanish competition and markets authority) fined Telefónica de España 20,000,000 EUR because from August 2021 to April 2023 it tied its Movistar Fusión and MiMovistar bundles including pay TV and device rental to minimum contract periods and early termination penalties. This breached the commitments under which the acquisition of DTS had been cleared in 2015; the CNMC treated the repeated breaches of these commitments as an aggravating factor.

Authority / court

Comisión Nacional de los Mercados y la Competencia (CNMC)

Area of law

Competition law · Merger control

Legal basis

Art. 62.4.c) und Art. 64.2.a) Ley 15/2007 de Defensa de la Competencia; Zusagen 1.1 und 1.1.2 einer früheren Fusionsfreigabe

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

yes

Published

30 Jul 2025

Checked against the official source on 28 Sep 2026 · Direct link

The Comisión Nacional del Mercado de Valores (CNMV, Spanish securities market supervisor) imposed two fines totalling 1,000,000 EUR on Grifols: 800,000 EUR because the consolidated financial statements for 2021 to 2023 and the 2023 half-year report contained inaccurate or incomplete information under IFRS, and 200,000 EUR for misleading information on the calculation of alternative performance measures (APMs) in the management reports. The company waived administrative appeals.

Authority / court

Comisión Nacional del Mercado de Valores (CNMV)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 282.1.b) und Art. 292.1.f) Ley 6/2023 de los Mercados de Valores y de los Servicios de Inversión

Action

Fine

Status of proceedings

unknown

Sector

Chemicals and pharmaceuticals

Employees

10,000 or more

Liability of senior managers

Measures against individuals are not reported here.

Published

6 Aug 2025

Checked against the official source on 28 Sep 2026 · Direct link

A person who was not (or no longer) a customer received a letter from CaixaBank about an update to its privacy statement, announcing that she would be contacted about her advertising preferences. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) considered the continued storage of her data to be an infringement of the principle of storage limitation and imposed 200,000 EUR; the bank's request for reconsideration was dismissed as inadmissible.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

A customer's mobile number was ported to MásMóvil without the customer having requested it; the new SIM card was handed over to a third party who did not identify themselves. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) found processing without a legal basis, imposed 200,000 EUR and ordered measures against such incidents; the company's request for reconsideration was unsuccessful.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 6 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

Because another customer's switching request with an almost identical name was recorded in the complainant's customer account, gas and electricity contracts for a supply point unknown to her ran under her data, and a third party, as contract holder, gained access to that data. The AEPD imposed 130,000 EUR for breaching the accuracy principle (Art. 5(1)(d)) and 1,250,000 EUR for inadequate security measures (Art. 32), 1,380,000 EUR in total.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. d, Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 28 Sep 2026 · Direct link

Informa D&B processed data on sole traders that originated from the business census kept by the chambers of commerce and had been acquired through a contract with Camerdata, without a legal basis and without informing the data subjects. The AEPD imposed 900,000 EUR each for breaching Art. 6(1) and Art. 14 GDPR, 1,800,000 EUR in total, and ordered the processing to stop and the data to be erased; the request for reconsideration was dismissed.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 6 Abs. 1, Art. 14 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

19 Dec 2025

Checked against the official source on 28 Sep 2026 · Direct link

Since 2008, Iberinform had obtained data on sole traders through a supply contract with Camerdata and used it to enrich its own files for commercial information services. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) found no legal basis for this and no information of the data subjects, and imposed 360,000 EUR for each (720,000 EUR in total) as well as an order to bring the processing into compliance; the request for reconsideration (recurso de reposición) was rejected.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 6 Abs. 1, Art. 14 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link