The Spanish supervisory authority (AEPD) has fined Club Deportivo Ritmo De Andalucia

The AEPD’s decision to impose a fine of €4,000 followed a complaint. The complainant was a parent of a underage child enrolled in a dance club who claimed that the controller had failed to implement adequate data protection measures. The club was negligent in its obligations to manage members’ data. In addition, the club’s enrolment form required consent to the recording and dissemination of images of its members, noting that the majority of them were children and adolescents.
The AEPD found that Club Deportivo Ritmo De Andalucia violated Article 13 of the RODO, as it did not provide all the information that should be provided to the data subject at the time of collecting their personal data. In addition, the authority saw that Club Deportivo Ritmo De Andalucia also breached Article 7 of the RODO, as it did not give data subjects the opportunity to give their voluntary consent to the processing of their personal data for each of the purposes for which the personal data collected was used.
As a result, the AEPD imposed an administrative fine on the dance club for failing to provide sufficient information regarding the processing and for failing to obtain the lawful consent of data subjects.