The Spanish data protection authority issued a warning against an individual for collecting data from over 228,000 event participants via a website whose privacy policy did not comply with the transparency requirements of Article 13 of the GDPR, notably regarding purposes and retention periods.

Facts and context

The Spanish Data Protection Authority (AEPD) today published a sanction decision against A.A.A. (including the issuance of a warning) for breaches related to the obligation to inform data subjects.

The case originated from an ex officio investigation conducted by the AEPD concerning the collection of personal data via a website for event registration, which gathered information from 228,231 individuals.

Grounds for the decision

• Information obligation at the time of data collection (Article 13 of the GDPR): The authority found that the privacy policy associated with the registration form did not meet transparency requirements. Indeed, it did not specify the purposes of the processing precisely enough, nor the international data transfers. Furthermore, the retention period was phrased too generally ("for a period not exceeding that necessary to achieve the purpose of the processing"), without specifying a concrete timeframe or the criteria used to determine it.

Authority's decision

Under its corrective powers provided in Article 58, paragraph 2 of the GDPR, the authority issued a warning against A.A.A.

Lessons learned

This decision reminds that:

• A generic statement indicating that data is retained "for a period not exceeding that necessary" is insufficient to satisfy the information obligation on retention periods.
• The information provided to data subjects under Article 13 of the GDPR must be complete and explicitly include all required details, including specific purposes, retention periods, and any international transfers.
• The purposes of processing must be described clearly and specifically, and not limited to general objectives such as "managing participation" without further details.
• Large-scale data collection, even for a one-time event, is subject to particular scrutiny by supervisory authorities regarding compliance with transparency obligations.