The Spanish data protection authority has sanctioned the Royal Spanish Football Federation for systematically requiring a school certificate in addition to a residence certificate for the registration of foreign minor players, whereas FIFA regulations present these documents only as alternatives, thus violating the data minimization principle.

Facts and context

The Spanish data protection authority (AEPD) has today published a sanction decision against the Royal Spanish Football Federation (RFEF) (including the imposition of a €100,000 fine) for breaches related to the data minimization principle during the registration of minor players.

The case originated from a complaint by a mother whose minor daughter was required to provide a school certificate in addition to a residence certificate to obtain a football license, a requirement she considered excessive.

Reasons for the decision

• Data minimization obligation (Article 5(1)(c) of the GDPR): The authority found that to register foreign minor players residing in Spain for at least five years, the RFEF systematically required both a residence certificate and a school certificate. The RFEF justified this dual requirement by a consolidated practice of the Fédération Internationale de Football Association (FIFA) aimed at protecting minors. However, the AEPD's analysis of FIFA's "Guide for submitting requests concerning minor players" (2020 and 2026 versions) revealed that these two documents are presented as alternative, not cumulative, means to prove uninterrupted five-year residence. By requiring both documents when only one was sufficient under the applicable regulations, the RFEF collected personal data that were not necessary for the purpose of the processing, thus violating the minimization principle.

Authority's decision

Consequently, the authority imposed a €100,000 fine on the Royal Spanish Football Federation.

Furthermore, the authority ordered the federation to adjust its registration procedures within two months to comply with the data minimization principle.

Lessons learned

This decision reminds that:

• The cumulative collection of documents presented as alternatives by sectoral regulation to prove the same fact constitutes a violation of the data minimization principle.
• A controller cannot hide behind an alleged "consolidated practice" of a umbrella organization to justify excessive data collection, especially when the official written rules of that same organization do not impose it.
• The low evidential value of a document does not automatically justify the systematic collection of a second document if the latter is not strictly necessary in all cases to achieve the intended purpose.