Spain’s AEPD fines Iberinform €720,000 for improper data processing

Spain’s data protection authority (AEPD) fined Iberinform Internacional S.A. €720,000 after concluding the company processed personal data of self-employed professionals without adequately informing them as required by law. The company claimed that informing all relevant users would have demanded hefty budgets, a claim the regulator has rejected. 

‍

The data in question included personal details such as the subject’s name, ID number, contact information, and address. The AEPD held that collecting and processing this data must comply with the GDPR's requirements for fairness, purpose limitation, and transparency. This fine, yet again, signals the current heightened scrutiny of data use and access to personal information. Companies are expected to inform users and obtain consent, even if the process is relatively costly.

‍