The Spanish Data Protection Authority Imposes an Administrative Fine of €500,000 on the Spanish Chamber of Commerce for Transferring Data to Private Companies Without a Legal Basis

The Spanish Data Protection Authority (“AEPD”), following an investigation into the unlawful transfer of personal data of self-employed persons to private companies, has decided to impose an administrative fine of EUR 500,000 on the Spanish Chamber of Commerce (“Chamber of Commerce”).

The Decision can be summarised as follows:

It was established that the Chamber of Commerce transferred to private companies the information contained in the publicly available business census created with the data obtained from the Tax Authority.

In particular, the transfer of self-employed persons’ tax identity numbers to these companies, even in hashed form, was considered a transfer of personal data and found to be unlawful.

It was held that the Chamber of Commerce, by disclosing data for commercial purposes beyond its obligation to maintain a public census, infringed the principle of purpose limitation.

In addition, it was stated that such transfer could not be justified under “legal obligation” or “public interest,” and that the ground of “legitimate interest” does not extend to the processing of self-employed persons’ tax identity numbers.

It was further found that the obligation to inform data subjects was violated, as they were not made aware of the processing activity, and the Chamber of Commerce’s defence of disproportionate effort was considered invalid.

It was assessed that the transfer of data to third parties was also contrary to the agreement concluded with the Tax Authority, and therefore constituted a violation of the principle of integrity and confidentiality.

In this context:

• An administrative fine of EUR 100,000 for each infringed provision, amounting to a total of EUR 500.000 was imposed.
• In addition, it was decided that the Chamber of Commerce shall immediately cease transferring data to the private companies concerned.

You can access the full text of the Decision here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr

All information and documents on our website have been prepared by Zumbul Attorneys at Law for general informational purposes only, in accordance with the Attorneyship Law, other relevant legislation and the Professional Rules of Attorneyship of the Union of Turkish Bar Associations. These publications are not intended for advertising or commercial purposes. The information and documents provided are of a general nature and under no circumstances, do they guarantee or warrant that the content is complete, accurate, up-to-date, or reliable. You should not rely on the information and documents on this website without first consulting a lawyer or expert. The links included in our website’s publications are sourced from publicly available materials and are provided solely for the convenience of visitors in accessing additional information. These links do not constitute any form of recommendation or endorsement of the linked persons, institutions or organizations. The information on this website does not in any way constitute legal advice or establish an attorney-client relationship with visitors to the site. All content on this website is the property of by Zumbul Attorneys at Law, and no content may be copied, reproduced, or used without prior written permission.