Sanction RGPD Spanish Data Protection Authority (aepd) — Homeowners Association : 2 k€ (2022)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- Homeowners Association
- Montant de l'amende
- 2 k€
- Date de la décision
- 28 décembre 2022
- Fondement juridique
- Art. 6 (1), Art. 15
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Spanish DPA has imposed a fine of EUR 2,000 on a homeowners' association. An individual who did cleaning work in the residential complex had filed a complaint with the DPA because members of the association had added them to a WhatsApp group without their consent. The data subject was required to upload pictures of the cleaning they had done for documentation purposes. The DPA concluded that adding their phone number to the WhatsApp group without their consent violated Art. 6 GDPR and was therefore unlawful. The DPA also found that the controller had not complied with the data subject's request for access to personal data in a timely manner, therefore violating Art. 15 GDPR.