Sanction RGPD Spanish Data Protection Authority (aepd) — FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA : 17 k€ (2023)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA
- Montant de l'amende
- 17 k€
- Date de la décision
- 25 septembre 2023
- Fondement juridique
- Art. 9, Art. 13
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Spanish DPA has imposed a fine of EUR 17,000 on FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA. Athletes were required to upload the vaccination certificate against COVID with the complete vaccination schedule or a certificate of recovery from the disease or an antigen test with a negative result to the controller's website 48 hours before sports events in order to participate in sports competitions. During its investigation, the DPA found that the controller did not have a valid legal basis for processing this sensitive health data. The DPA also found that the controller had not provided sufficient information about the processing of personal data.