AEPD (Spain) - PS/00339/2024

Summary

The Spanish Data Protection Agency (AEPD) has fined the Royal Spanish Soccer Federation (RFEF) €100,000 for violating the data minimisation principle under GDPR. The RFEF requested more personal data than FIFA guidelines required for minor player registrations, potentially exposing minors to unnecessary risks. The AEPD emphasized the importance of data protection for minors and found the excessive processing unjustified.

Full text

Help AEPD (Spain) - PS/00339/2024: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 07:43, 2 October 2026 view sourceSf (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators108 edits Tag: Decisions [1.0] Latest revision as of 14:50, 6 October 2026 view source Mba (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators991 editsm Tag: Visual edit Line 89: Line 89: === Facts ====== Facts === The father of the data subject, who is a minor, submitted a complaint after registering his daughter with the Royal Spanish Soccer Federation (RFEF). In order to apply, the controller requested the father to provide, amongst other documentation, a certificate of municipal registration and a school certificate (as supporting documentation), to verify the required uninterrupted five-year residence in Spain.The father of the data subject, who is a minor, submitted a complaint after registering his daughter with the Royal Spanish Soccer Federation (RFEF, the controller). In order to apply, the controller requested the father to provide, amongst other documentation, a certificate of municipal registration and a school certificate (as supporting documentation), to verify the required uninterrupted five-year residence in Spain. According to the FIFA guidelines for submitting applications for minors, for first time applications the player must have lived continuously for five years in the country where they are being registered. FIFA’s guidelines require a residence certificate and as an alternative the school certificate of the minor.According to the FIFA guidelines for submitting applications for minors, for first time applications the player must have lived continuously for five years in the country where they are being registered. FIFA’s guidelines require a residence certificate and as an alternative the school certificate of the minor. Line 102: Line 102: Therefore, DPA held that the controller required, for player registration, documentation from the play which contained personal data exceeding what is officially required by FIFA. The DPA emphasised the importance of data protection for minors and how such a requirement involves more processing than necessary which could potentially expose minors to unnecessary risks.Therefore, DPA held that the controller required, for player registration, documentation from the play which contained personal data exceeding what is officially required by FIFA. The DPA emphasised the importance of data protection for minors and how such a requirement involves more processing than necessary which could potentially expose minors to unnecessary risks. In light of the foregoing, the DPA fined the controller €100,000 for the violation of the data minimisation principle, enshrined in [[Article 5 GDPR|Article 5(1)(c) GDPR]].In light of the foregoing, the DPA fined the controller €100,000 for the violation of the data minimisation principle, enshrined in [[Article 5 GDPR|Article 5(1)(c) GDPR]]. Latest revision as of 14:50, 6 October 2026 AEPD - PS/00339/2024 Authority: AEPD (Spain) Jurisdiction: Spain Relevant Law: Article 5(1)(c) GDPR Type: Complaint Outcome: Upheld Started: 29.11.2023 Decided: Published: Fine: 100000.0 EUR Parties: REAL FEDERACIÓN ESPAÑOLA DE FÚTBOL National Case Number/Name: PS/00339/2024 European Case Law Identifier: n/a Appeal: n/a Original Language(s): Spanish Original Source: AEPD (in ES) Initial Contributor: sf The DPA fined a controller €100,000 for violating the principle of data minimisation as a result of excessive personal data collection from minors and a failure to justify such processing. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The father of the data subject, who is a minor, submitted a complaint after registering his daughter with the Royal Spanish Soccer Federation (RFEF, the controller). In order to apply, the controller requested the father to provide, amongst other documentation, a certificate of municipal registration and a school certificate (as supporting documentation), to verify the required uninterrupted five-year residence in Spain. According to the FIFA guidelines for submitting applications for minors, for first time applications the player must have lived continuously for five years in the country where they are being registered. FIFA’s guidelines require a residence certificate and as an alternative the school certificate of the minor. The controller explained that this procedure and the requested documents is a result of a long-established procedure by FIFA, which required both the residence certificate and the minors school certificate. Holding The DPA found the requirement by FIFA of proof of residence for a player whose registration is sought through a certificate of residence, a logical and reasonable exception to the prohibition of international transfers of minors. Nonetheless, according to the controller the school transcripts were required as supporting documentation, which implied that they are required in addition to the certificate of municipal registration. The DPA held that requesting and requiring both documents violated the principle of data minimisation, and deemed the requesting of one of the two documents sufficient to prove uninterrupted residence. This was considered in addition to the fact that FIFA’s guidelines explicitly state the alternative nature of the documents. Therefore, DPA held that the controller required, for player registration, documentation from the play which contained personal data exceeding what is officially required by FIFA. The DPA emphasised the importance of data protection for minors and how such a requirement involves more processing than necessary which could potentially expose minors to unnecessary risks. In light of the foregoing, the DPA fined the controller €100,000 for the violation of the data minimisation principle, enshrined in Article 5(1)(c) GDPR. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. 1/44  Case No.: EXP202318587 DECISION ON DISCIPLINARY PROCEEDINGS Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On November 29, 2023, a complaint was filed with the Spanish Data Protection Agency regarding a possible violation attributable to the ROYAL SPANISH FOOTBALL FEDERATION, Tax ID No. Q2878017I (hereinafter, RFEF or the respondent). The complainant states that he is a citizen (…) and the father of a minor under 14 years of age, who applied for a license from the respondent Federation to register with a soccer club in the province of ***PROVINCE.1. In response to this request, he was asked to provide documentation containing information regarding the minor’s academic history; documentation which he considers excessive. Upon contacting his daughter’s club, they informed him that such documentation is only requested from players who do not hold Spanish nationality and is intended to prevent the purchase of young talent in accordance with FIFA regulations. She points out that Spanish players need only provide a certificate of historical residency and that, although her daughter has (...) nationality, she was born and raised in Spain, and this can be easily demonstrated with the same evidence required of a player with Spanish nationality She states that she has contacted the respondent Federation to make a complaint about the request for documentation, and they cite FIFA regulations; however, she considers that these impose excessive requirements that are discriminatory in terms of the treatment of individuals based on their different nat

Entities