AEPD (Spain) - PS-00008-2025
Spain's AEPD fines Ramona Films for failing to comply with a previous GDPR order.
Spain's data protection authority (AEPD) has fined Ramona Films, S.L. for failing to comply with a corrective order issued in previous GDPR proceedings. The company was initially fined for lacking a data processing agreement with a payment service provider and was ordered to provide the agreement. Instead, Ramona Films claimed joint controllership, providing an unsigned and undated agreement, which it later admitted was never signed. The AEPD found this to be a violation of Article 58(2) GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonRamona Films failed to comply with a corrective order from Spain's AEPD requiring a formal data processing agreement with their payment service provider, ultimately submitting an unsigned and undated document they later admitted was never executed. This case highlights that attempting to reframe a compliance obligation (shifting from processor to joint controller status) without proper legal basis compounds the original violation. Regulators treat non-compliance with corrective orders as a serious aggravating factor, demonstrating that procedural follow-through on GDPR obligations is just as critical as the initial compliance. Organizations must treat regulatory orders as binding legal deadlines, not suggestions, and ensure any agreements submitted as evidence are legally valid and verifiable.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- url — https://www.aepd.es/documento/ps-00308-2023.pdf