[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fF3o4feRyIsosx8dWiqhWDv2YE8d3XrmbbqlmB_epB2Q":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"5bbbdef7-92fe-4996-81e1-ffe50c4f9d00","AEPD (Spain) - PS\u002F00339\u002F2024","aepd-spain-ps-00339-2024-99158e","Facts ← Older revision Revision as of 14:50, 6 October 2026 Line 89: Line 89: === Facts === === Facts === The father of the data subject, who is a minor, submitted a complaint after registering his daughter with the Royal Spanish Soccer Federation (RFEF). In order to apply, the controller requested the father to provide, amongst other documentation, a certificate of municipal registration and a school certificate (as supporting documentation), to verify the required uninterrupted five-year residence in Spain. The father of the data subject, who is a minor, submitted a complaint after registering his daughter with the Royal Spanish Soccer Federation (RFEF, the controller). In order to apply, the controller requested the father to provide, amongst other documentation, a certificate of municipal registration and a school certificate (as supporting documentation), to verify the required uninterrupted five-year residence in Spain. According to the FIFA guidelines for submitting applications for minors, for first time applications the player must have lived continuously for five years in the country where they are being registered. FIFA’s guidelines require a residence certificate and as an alternative the school certificate of the minor. According to the FIFA guidelines for submitting applications for minors, for first time applications the player must have lived continuously for five years in the country where they are being registered. FIFA’s guidelines require a residence certificate and as an alternative the school certificate of the minor. Line 102: Line 102: Therefore, DPA held that the controller required, for player registration, documentation from the play which contained personal data exceeding what is officially required by FIFA. The DPA emphasised the importance of data protection for minors and how such a requirement involves more processing than necessary which could potentially expose minors to unnecessary risks. Therefore, DPA held that the controller required, for player registration, documentation from the play which contained personal data exceeding what is officially required by FIFA. The DPA emphasised the importance of data protection for minors and how such a requirement involves more processing than necessary which could potentially expose minors to unnecessary risks. In light of the foregoing, the DPA fined the controller €100,000 for the violation of the data minimisation principle, enshrined in [[Article 5 GDPR|Article 5(1)(c) GDPR]]. In light of the foregoing, the DPA fined the controller €100,000 for the violation of the data minimisation principle, enshrined in [[Article 5 GDPR|Article 5(1)(c) GDPR]].","The Spanish Data Protection Agency (AEPD) has fined the Royal Spanish Soccer Federation (RFEF) €100,000 for violating the data minimisation principle under GDPR. The RFEF requested more personal data than FIFA guidelines required for minor player registrations, potentially exposing minors to unnecessary risks. The AEPD emphasized the importance of data protection for minors and found the excessive processing unjustified.","Spain's AEPD fines RFEF €100,000 for excessive data collection from minors.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00339\u002F2024&diff=53310&oldid=53280","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-10-06T14:50:29+00:00","2026-10-06T16:00:16.162521+00:00",7,[17,20],{"name":18,"type":19},"FIFA","vendor",{"name":21,"type":19},"RFEF","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":22,"icon":24,"name":25,"slug":26},null,"Policy","policy",[28,33,38,40],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":22,"icon":24,"name":25,"slug":26},{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":63},"rfef-fined-100k-for-collecting-excessive-data-on-minor-soccer-players","RFEF Fined €100K for Collecting Excessive Data on Minor Soccer Players","The Royal Spanish Soccer Federation violated GDPR's data minimisation principle by collecting more personal information from minor players than FIFA's own guidelines required, demonstrating a fundamental misunderstanding of lawful data processing obligations. This case highlights that organisations must only collect data that is strictly necessary for the specified purpose — collecting 'more than needed just in case' is not a legally defensible position under GDPR. The involvement of minors significantly elevates the risk and regulatory scrutiny, as children represent a specially protected category of data subjects. Regulators across the EU are increasingly enforcing data minimisation proactively, meaning organisations cannot rely on vague justifications to legitimise excessive collection.",[55,56,57,58,59,60,61,62],"GDPR Article 5(1)(c) – Data minimisation principle","GDPR Article 25 – Data protection by design and by default","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 8 – Conditions applicable to child's consent","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","NIST Privacy Framework PR.DS-P1 (Data Minimisation)","CIS Control 3 – Data Protection","ISO 27701 Section 7.2.1 – Purpose Limitation and Data Minimisation",{}]