# Spain Data Protection Agency enforcement

> Live situation record from CLSTR: https://clstr.news/situations/spain-data-protection-agency-enforcement
> Updated: 2026-08-01T03:00:00.000Z. Sources: 12. Developments: 3.

In early July 2026 the AEPD announced fines up to €100,000 for unauthorized copying of personal ID documents. Later that month it opened a sanctioning procedure against the Catalan outlet La Directa, proposing a €7,000 penalty and ordering the removal or pixelation of faces, names and fabricated identifiers of four National Police officers it had identified as infiltrators. La Directa, journalists and civil‑society groups condemned the move as intimidation that threatens investigative reporting, citing European human‑rights jurisprudence.

On 29 July the agency reiterated the demand that La Directa erase the identifying material, noting parallels with a UK case where authorities later apologized for similar disclosures. On 1 August the AEPD formalised the €7,000 fine against La Directa and extended an identical sanction to the digital news site VilaWeb after it published a fictitious undercover name, a photograph of an infiltrator’s face and other personal data. VilaWeb’s director warned that such enforcement could compel public officials to demand removal of factual reporting, fostering self‑censorship.

These actions illustrate the AEPD’s 2026 strategy of applying monetary penalties to both commercial firms and media organisations for breaches ranging from illegal ID duplication to alleged misuse of personal identifiers in journalism.

## Claims

- Four police agents filed a complaint with the AEPD alleging violation of their privacy. (disputed by 6 sources)
- The exposed agents were intelligence operatives, not subject to any specific legal coverage for privacy. (disputed)
- The AEPD proposed a €7,000 fine against La Directa for publishing personal data of police infiltrators. (corroborated by 6 sources)
- The AEPD requires La Directa to pixelate faces and remove names and any fabricated ID numbers of the agents. (corroborated by 6 sources)
- A similar case in the United Kingdom resulted in an apology and disclosure of the infiltrators’ data to affected parties. (corroborated by 6 sources)
- Journalists and civil‑rights figures, including Xavier Antich, Xavier Monge and Elisabet Borreda, publicly supported La Directa. (corroborated by 5 sources)
- Irídia’s Sònia Olivella argued that the AEPD’s decision conflicts with European Court of Human Rights rulings protecting journalists. (corroborated by 5 sources)

## Timeline

### 2026-08-01: Spanish Data Protection Agency fines La Directa and VilaWeb over police infiltrator reporting

Spain's Data Protection Agency fined La Directa and VilaWeb €7,000 each for publishing police infiltrator identities, raising press‑freedom concerns.

2 sources. https://clstr.news/cluster/spanish-data-protection-agency-fines-la-directa-and-vilaweb-over-police-infiltrator-reporting

### 2026-07-29: Spain's Data Protection Agency proposes €7,000 fine on La Directa

Spain's data‑protection agency seeks a €7,000 fine on La Directa for publishing identities of police infiltrators, demanding removal of the material and sparking press‑freedom protests.

10 sources. https://clstr.news/cluster/spains-data-protection-agency-proposes-7000-fine-for-la-directa-over-police-infiltrator-disclosures

### 2026-07-03: Spain's Data Protection Agency fines firms up to €100,000 for copying IDs

Spain's data‑protection regulator fines firms up to €100,000 for copying the DNI, citing GDPR rules; penalties include €100,000 on Orange and €30,000 on hotels and a dental clinic.

2 sources. https://clstr.news/cluster/spains-data-protection-agency-fines-firms-up-to-100000-for-copying-ids

---
Cite as: Spain Data Protection Agency enforcement. CLSTR, https://clstr.news/situations/spain-data-protection-agency-enforcement