The Spanish Data Protection Agency (AEPD) has sanctioned the company STAR LIGHT PUERTO BANUS SL with a fine of €6,000 for failing to respond to its information requests, constituting an obstruction to its investigative powers in violation of Article 58(1) of the GDPR.

Facts and context

The Spanish data protection authority (AEPD) published a sanction decision against STAR LIGHT PUERTO BANUS SL, including the imposition of a €6,000 fine, for a breach related to its obligation to cooperate with the supervisory authority.

The case originated from a complaint that led the authority to initiate an investigation and send several information requests to the data controller to clarify the facts.

Grounds for the decision

• Obligation to provide the information requested by the supervisory authority (Article 58(1) of the GDPR): The authority found that the company did not respond to three successive information requests, notified in accordance with applicable administrative procedures between June and July 2025. By doing so, the company obstructed the investigative powers granted to the supervisory authority by Article 58(1)(a) of the GDPR. The authority emphasized that this obstruction hinders its mission to supervise the effective application of the regulation and protect the rights of data subjects, constituting a serious infringement within the meaning of Article 83(5)(e) of the GDPR. To determine the amount of the sanction, the authority notably took into account the European Data Protection Board's Guidelines 04/2022 on the calculation of administrative fines.

Authority's decision

Consequently, the authority imposed a fine of €6,000 on STAR LIGHT PUERTO BANUS SL.

Furthermore, the authority ordered the company to provide, within ten working days from the enforceability of the decision, the information that had been requested during the initial investigation.

Lessons learned

This decision reminds that:

• Failure to respond to an information request from a supervisory authority constitutes a separate and serious infringement, regardless of the merits of the initial complaint.
• Obstruction of the investigative powers of an authority is classified among the most severe infringements under the GDPR (Article 83(5)), justifying deterrent financial penalties even for companies with modest turnover.
• A data controller cannot rely on its inaction to escape its obligations; supervisory authorities use all legal means of notification, including publication in the official journal, to ensure procedures are validly conducted.
• A financial penalty for failure to cooperate may be accompanied by an injunction to provide the requested information, under threat of further sanctions.