AEPD (Spain) - PS/00339/2024
Spain's AEPD fines RFEF €100,000 for violating GDPR's data minimisation principle.
The Spanish Data Protection Agency (AEPD) has fined the Royal Spanish Football Federation (RFEF) €100,000 for violating the GDPR's data minimisation principle. The RFEF excessively collected personal data from minors during registration, requiring both a municipal registration certificate and a school certificate to prove residency, when FIFA guidelines allowed for either document. The AEPD deemed this collection unnecessary and potentially exposing minors to risks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Royal Spanish Football Federation violated GDPR's data minimisation principle by requiring minors to submit two residency documents when governing rules (FIFA guidelines) explicitly permitted either one alone. Collecting more personal data than necessary — especially from children — amplifies privacy risks, including unnecessary exposure of sensitive information. This case underscores that organisations must continuously audit what data they collect, why they collect it, and whether a less invasive alternative exists. Regulatory bodies like the AEPD treat children's data with heightened scrutiny, making over-collection a high-risk compliance failure with significant financial consequences.