Sanction RGPD Spanish Data Protection Authority (aepd) — HOLY MARY CATHOLIC SCHOOL, S.L. : 12 k€ (2026)
Le 1 mars 2026, Spanish Data Protection Authority (aepd) a prononcé une sanction RGPD de 12 k€ à l'encontre de HOLY MARY CATHOLIC SCHOOL, S.L. (secteur : Secteur public et éducation), sur le fondement de Art. 5 (1) a), Art. 6 (1), Art. 35, pour base légale insuffisante pour le traitement. Référence de décision : PS-00607-2025.
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- HOLY MARY CATHOLIC SCHOOL, S.L.
- Montant de l'amende
- 12 k€
- Date de la décision
- 1 mars 2026
- Fondement juridique
- Art. 5 (1) a), Art. 6 (1), Art. 35
- Manquement
- Base légale insuffisante pour le traitement
- Référence de décision
- PS-00607-2025
Résumé des faits
The Spanish DPA has imposed a fine of EUR 12,000 on the HOLY MARY CATHOLIC SCHOOL, S.L. The controller, an educational institute, used Google Workspace for Education within its school environment. While the use of the tool may be justifiable under the GDPR, the controller failed to implement it adequately. The controller was unable to ensure that pupils only had access to the tools necessary for study purposes. The controller also failed to adequately inform data subjects and their parents, and to carry out a sufficient DPIA. The original fine of EUR 20,000 was reduced to EUR 12,000 due to immediate payment and admission of responsibility by the controller.