[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyirnlv_zlrXlRBpJetTZzKFB947xPw2yIQ6fNnlaIT4":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":54},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"08dd4e06-3a5a-4067-87d8-a9d7ee6e1811","AEPD (Spain) - PS\u002F00339\u002F2024","aepd-spain-ps-00339-2024-da30f1","Created page with \"{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color= |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS\u002F00339\u002F2024 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00339-2024.pdf |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint...\" Show changes","The Spanish Data Protection Agency (AEPD) has fined the Royal Spanish Football Federation (RFEF) €100,000 for violating the GDPR's data minimisation principle. The RFEF excessively collected personal data from minors during registration, requiring both a municipal registration certificate and a school certificate to prove residency, when FIFA guidelines allowed for either document. The AEPD deemed this collection unnecessary and potentially exposing minors to risks.","Spain's AEPD fines RFEF €100,000 for violating GDPR's data minimisation principle.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00339\u002F2024&diff=53280&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-10-02T07:43:17+00:00","2026-10-02T08:00:23.421893+00:00",7,[17,20,23,25],{"name":18,"type":19},"AEPD","vendor",{"name":21,"type":22},"GDPR","product",{"name":24,"type":19},"FIFA",{"name":26,"type":22},"RFEF","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":27,"icon":29,"name":30,"slug":31},null,"Policy","policy",[33,37,42,44],{"category":34},{"id":35,"icon":29,"name":21,"slug":36},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":38},{"id":39,"icon":29,"name":40,"slug":41},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":43},{"id":27,"icon":29,"name":30,"slug":31},{"category":45},{"id":46,"icon":29,"name":47,"slug":48},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,24,21],{"controls":52,"vendors":53},[],[],{"slug":55,"title":56,"body":57,"framework_refs":58,"framework_notes":67},"rfef-fined-100000-for-excessive-data-collection-from-minors","RFEF Fined €100,000 for Excessive Data Collection from Minors","The Royal Spanish Football Federation violated GDPR's data minimisation principle by requiring minors to submit two residency documents when governing rules (FIFA guidelines) explicitly permitted either one alone. Collecting more personal data than necessary — especially from children — amplifies privacy risks, including unnecessary exposure of sensitive information. This case underscores that organisations must continuously audit what data they collect, why they collect it, and whether a less invasive alternative exists. Regulatory bodies like the AEPD treat children's data with heightened scrutiny, making over-collection a high-risk compliance failure with significant financial consequences.",[59,60,61,62,63,64,65,66],"GDPR Article 5(1)(c) – Data Minimisation Principle","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 8 – Conditions Applicable to Child's Consent","NIST Privacy Framework PR.DS-P1 – Data Minimisation","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management","CNIL\u002FAEPD Guidelines on Children's Data Processing",{"CIS Control 3 – Data Protection":68,"ISO\u002FIEC 27701 – Privacy Information Management":69,"CNIL\u002FAEPD Guidelines on Children's Data Processing":70,"GDPR Article 5(1)(c) – Data Minimisation Principle":71,"NIST Privacy Framework PR.DS-P1 – Data Minimisation":72,"GDPR Article 8 – Conditions Applicable to Child's Consent":73,"GDPR Article 25 – Data Protection by Design and by Default":74,"GDPR Article 35 – Data Protection Impact Assessment (DPIA)":75},"Knowing what personal data is collected and why helps spot when a process gathers more documents than required.","A privacy management system includes reviews of collection practices, which would have caught the duplicate document requirement.","Regulator guidance stresses minimal collection from children, which the federation's two-document requirement ignored.","Data minimisation would have limited the RFEF to the one residency document FIFA rules required, rather than demanding two from minors.","Calls for limiting data collection to what the purpose needs, here a single proof of residency for each minor.","Highlights that children's data needs extra care, reinforcing why collecting excess documents from minors was a serious failing.","Data protection by default means forms collect only what is needed, so the registration process should have asked for a single document.","A DPIA on processing children's data would have questioned why two residency documents were needed when one sufficed."]