News

🚨 ❌ AEPD – No illegal data repurposing:
€1,200 penalty after acknowledgment of responsibility

Regulator: AEPD
Decision: PS-00181-2025, 2025-09-01

An entity used the data of at least six individuals (name, DNI) without their knowledge or consent to deliver copper materials, identifying them as sellers of those materials.

This information had been obtained through prior relationships (contracts, employment, etc.). The AEPD found processing without a legal basis (Art. 6 GDPR): a different purpose, with no consent or other valid ground.

⚖️ 🛑 Penalty: €2,000 fine, reduced to €1,200 via acknowledgment of responsibility and voluntary payment (Art. 85 LPACAP) → case closed. Ref.: EXP202412625.

Takeaways:
• 🔒 Ring-fence your purposes: no “opportunistic” reuse.
• 📚 Document the legal basis (contract, legitimate interest, consent, etc.) for each purpose.
• 🧩 Manage the data lifecycle (customers, partners, former employees).
• 🧭 Traceability & evidence: records, internal procedures.