AEPD (Spain) - PS/00339/2024
Spain's AEPD fines RFEF €100,000 for excessive data collection from minors.
The Spanish Data Protection Agency (AEPD) has fined the Royal Spanish Soccer Federation (RFEF) €100,000 for violating the data minimisation principle under GDPR. The RFEF requested more personal data than FIFA guidelines required for minor player registrations, potentially exposing minors to unnecessary risks. The AEPD emphasized the importance of data protection for minors and found the excessive processing unjustified.
AI summary of the linked source. Not reviewed by an editor. How this works
Run FIFA?
Get an email when a new story names FIFA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Royal Spanish Soccer Federation violated GDPR's data minimisation principle by collecting more personal information from minor players than FIFA's own guidelines required, demonstrating a fundamental misunderstanding of lawful data processing obligations. This case highlights that organisations must only collect data that is strictly necessary for the specified purpose — collecting 'more than needed just in case' is not a legally defensible position under GDPR. The involvement of minors significantly elevates the risk and regulatory scrutiny, as children represent a specially protected category of data subjects. Regulators across the EU are increasingly enforcing data minimisation proactively, meaning organisations cannot rely on vague justifications to legitimise excessive collection.