[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyirnlv_zlrXlRBpJetTZzKFB947xPw2yIQ6fNnlaIT4":3},{"article":4,"iocs":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":28,"category":29,"article_tags":33},"08dd4e06-3a5a-4067-87d8-a9d7ee6e1811","AEPD (Spain) - PS\u002F00339\u002F2024","aepd-spain-ps-00339-2024-da30f1","Created page with \"{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color= |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS\u002F00339\u002F2024 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00339-2024.pdf |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint...\" Show changes","The Spanish Data Protection Agency (AEPD) has fined the Royal Spanish Football Federation (RFEF) €100,000 for violating the GDPR's data minimisation principle. The RFEF excessively collected personal data from minors during registration, requiring both a municipal registration certificate and a school certificate to prove residency, when FIFA guidelines allowed for either document. The AEPD deemed this collection unnecessary and potentially exposing minors to risks.","Spain's AEPD fines RFEF €100,000 for violating GDPR's data minimisation principle.","Help AEPD (Spain) - PS\u002F00339\u002F2024: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 07:43, 2 October 2026 view source Sf (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators108 edits Tag: Decisions [1.0] (No difference) Latest revision as of 07:43, 2 October 2026 AEPD - PS\u002F00339\u002F2024 Authority: AEPD (Spain) Jurisdiction: Spain Relevant Law: Article 5(1)(c) GDPR Type: Complaint Outcome: Upheld Started: 29.11.2023 Decided: Published: Fine: 100000.0 EUR Parties: REAL FEDERACIÓN ESPAÑOLA DE FÚTBOL National Case Number\u002FName: PS\u002F00339\u002F2024 European Case Law Identifier: n\u002Fa Appeal: n\u002Fa Original Language(s): Spanish Original Source: AEPD (in ES) Initial Contributor: sf The DPA fined a controller €100,000 for violating the principle of data minimisation as a result of excessive personal data collection from minors and a failure to justify such processing. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The father of the data subject, who is a minor, submitted a complaint after registering his daughter with the Royal Spanish Soccer Federation (RFEF). In order to apply, the controller requested the father to provide, amongst other documentation, a certificate of municipal registration and a school certificate (as supporting documentation), to verify the required uninterrupted five-year residence in Spain. According to the FIFA guidelines for submitting applications for minors, for first time applications the player must have lived continuously for five years in the country where they are being registered. FIFA’s guidelines require a residence certificate and as an alternative the school certificate of the minor. The controller explained that this procedure and the requested documents is a result of a long-established procedure by FIFA, which required both the residence certificate and the minors school certificate. Holding The DPA found the requirement by FIFA of proof of residence for a player whose registration is sought through a certificate of residence, a logical and reasonable exception to the prohibition of international transfers of minors. Nonetheless, according to the controller the school transcripts were required as supporting documentation, which implied that they are required in addition to the certificate of municipal registration. The DPA held that requesting and requiring both documents violated the principle of data minimisation, and deemed the requesting of one of the two documents sufficient to prove uninterrupted residence. This was considered in addition to the fact that FIFA’s guidelines explicitly state the alternative nature of the documents. Therefore, DPA held that the controller required, for player registration, documentation from the play which contained personal data exceeding what is officially required by FIFA. The DPA emphasised the importance of data protection for minors and how such a requirement involves more processing than necessary which could potentially expose minors to unnecessary risks. In light of the foregoing, the DPA fined the controller €100,000 for the violation of the data minimisation principle, enshrined in Article 5(1)(c) GDPR. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. 1\u002F44  Case No.: EXP202318587 DECISION ON DISCIPLINARY PROCEEDINGS Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On November 29, 2023, a complaint was filed with the Spanish Data Protection Agency regarding a possible violation attributable to the ROYAL SPANISH FOOTBALL FEDERATION, Tax ID No. Q2878017I (hereinafter, RFEF or the respondent). The complainant states that he is a citizen (…) and the father of a minor under 14 years of age, who applied for a license from the respondent Federation to register with a soccer club in the province of ***PROVINCE.1. In response to this request, he was asked to provide documentation containing information regarding the minor’s academic history; documentation which he considers excessive. Upon contacting his daughter’s club, they informed him that such documentation is only requested from players who do not hold Spanish nationality and is intended to prevent the purchase of young talent in accordance with FIFA regulations. She points out that Spanish players need only provide a certificate of historical residency and that, although her daughter has (...) nationality, she was born and raised in Spain, and this can be easily demonstrated with the same evidence required of a player with Spanish nationality She states that she has contacted the respondent Federation to make a complaint about the request for documentation, and they cite FIFA regulations; however, she considers that these impose excessive requirements that are discriminatory in terms of the treatment of individuals based on their different nationalities, and points out that the aforementioned regulations make no mention of the school documentation required by the respondent Federation. He submits email correspondence exchanged with the respondent, FIFA statutes, and the Guide for Applying for the Registration of Underage Players. Specifically, the emails provided are as follows: - Email dated September 26 at 12:26 p.m. from the address ***EMAIL.1 to secretaria@rfef.es, which states the following: (…) My daughter is a citizen of (…) but was born in Spain and has lived in Spain since birth (…). To register her, they asked me for a series of documents, among which I was particularly surprised by a detailed account of her academic history. Upon further inquiry, I learned that the Federation requests this information for the purpose of preventing young players from being bought in one way or another by major clubs. (…) By requesting information in this manner, the Federation is going far beyond its authority. First, the information requested must be related to the purpose of the request. The purpose of the request is, 28001 – Madrid 6 sedeaepd.gob.es 2\u002F44 first and foremost, to allow my daughter to participate in the soccer competition, and her academic record and grades are irrelevant in this regard. Furthermore, the club has informed me that this information is requested only for players who are not Spanish nationals (…) Furthermore, this practice violates the principle of equal treatment between residents who are nationals of a country and other EU citizens, as established in applicable European legislation, as well as the right to the free movement of persons within the EU. - Reply email sent from the address estatutojugador@rfef.es to ***EMAIL.1 with copies to secretaria@rfef.es, estatutojugador@rfef.es, ***EMAIL.2, and ***EMAIL.3, dated September 26, 2023, at 3:59 p.m. with the following content: (…) Please find attached the Regulations on the Status and Transfer of Players so that you may review Article 19. We are also attaching the FIFA Minor Player Guide, which specifies the documents that clubs must provide depending on the exception invoked (Art 19 of the RETJ), in this case, “5 Years of Uninterrupted Residence.” It is important to note that any minor player whose nationality or country of birth is other than Spain requires authorization from FIFA. Based on the foregoing, in accordance with Article 14 of the FIFA Statutes (see attachment), it is our duty to require the documentation specified in the guidelines; otherwise, FIFA could sanction the club and the RFEF. - New email from ***EMAIL.1 to secretaria@rfef.es, dated October 19, 2023, at 8:06 a.m., in which the complainant requests (…) a response to this email (for this purpose, he forwarded the email dated Sep","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00339\u002F2024&diff=53280&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-10-02T07:43:17+00:00","2026-10-02T08:00:23.421893+00:00",7,[18,21,24,26],{"name":19,"type":20},"AEPD","vendor",{"name":22,"type":23},"GDPR","product",{"name":25,"type":20},"FIFA",{"name":27,"type":23},"RFEF","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":28,"icon":30,"name":31,"slug":32},null,"Policy","policy",[34,38,43,45],{"category":35},{"id":36,"icon":30,"name":22,"slug":37},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":39},{"id":40,"icon":30,"name":41,"slug":42},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":44},{"id":28,"icon":30,"name":31,"slug":32},{"category":46},{"id":47,"icon":30,"name":48,"slug":49},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]