A thousand euros for a missing sign

A thousand euros for a missing sign. In AEPD case PS/00226/2021, a hair salon had video surveillance without the information sign. Spain's Data Protection Agency imposed a €1,000 fine for breaching Article 13 of the GDPR and ordered the system to be brought into compliance.

When setting the penalty, the Agency considered the small size of the establishment and the absence of recorded previous infringements. It also noted the time elapsed since the GDPR had entered into force. Being small was part of the assessment; it did not prevent a penalty in that case.

What the duty requires, and why a sign is not enough

The duty is to provide information about data processing. For video surveillance, a visible sign is one specific part of that information. The AEPD factsheet for premises open to the public states what it should contain and requires the remaining information to be kept available. Putting up just any “cameras in use” notice does not fulfil the duty on its own.

The practical check is to look at the entrance as a first-time visitor would: whether the sign is visible, whether it identifies the controller and whether it explains where to exercise rights and obtain more information. This does not replace reviewing the rest of the camera system.

The reception desk is another place to separate duties

In PS/00562/2025, a gym visitor reported providing details for a one-day visit and then receiving advertising SMS messages. The case records that she followed the stated opt-out instruction and received further messages. The penalty concerns Article 21.1 of Spain's LSSI-CE.

There are two different questions here. One is what information someone receives when they provide their data. The other is whether you can use their contact details to send advertising. Providing proper information does not make every later use lawful. And a complaint describing a lack of information does not mean that the decision also penalised that fact: you need to read which infringement it declares.

For email and equivalent electronic means, Article 21 of the LSSI-CE requires a prior request or authorisation, except for the previous contractual relationship exception with its conditions: lawfully obtained contact details, similar products or services from the same business, and a simple, free way to object. Merely having the number is not enough.

The opt-out has to reach the sending system

PS/00411/2024, concerning an energy advisory business, records WhatsApp messages after requests for erasure. The infringement examined under Article 21.1 concerns the sending of electronic communications; it should not simply be extended to the phone calls mentioned in the complaint.

In PS/00424/2021, concerning online courses, the AEPD imposed €2,000 for commercial emails contrary to Article 21 of the LSSI-CE. There was also another penalty concerning the right to erasure under Article 17 of the GDPR. The €2,000 was not the total for the case.

The four cases do not involve the same duty or channel. They do encourage a review of three parts often managed separately: information when data is collected, the basis permitting the intended use and implementation of opt-outs.

What to check on the next form

Check that the information matches the actual processing and is accessible when the data is collected. A sentence explaining who keeps it does not always contain all the necessary information; there can be a clear first layer and a second with the detail.

If you ask for advertising consent, use a separate, voluntary option that is not preselected. Someone declining it should not be prevented from requesting an appointment for that reason. Keep evidence of what they accepted and when.

Then test the opt-out with a fictional contact: they should stop receiving what they have declined across all the systems involved. Saying “done” while leaving them on another list does not resolve the problem.

What these decisions do not tell us

A penalty is a case, not a statistic. These cases do not tell us how many businesses receive fines or how likely you are to receive one. Nor can they calculate your amount: each procedure's circumstances and reductions matter.

I have separated what the documents show from the checks I suggest. No short list guarantees compliance with every rule or supports saying it can all be sorted in an afternoon. To decide what your specific processing requires, it needs to be examined with its data, uses and channels in view.