On the basis of claims originating from the Information Commissioner's Office (ICO) -i.e., the UK's data protection supervisory authority-, the Spanish data protection supervisory authority initiated penalty proceedings.
A citizen of the UK brought a claim before the ICO stating that she had received an unsolicited commercial call from an entity located in Spain that promoted holiday clubs and time-sharing properties. The latter alleged that it had obtained the data from another Spanish company, which denied the allegation before the ICO.
The sanction imposed by the Spanish data protection supervisory authority on the entity making the call to the UK citizen was EUR 60,101.21. This amount was based on the fact that it had not been evidenced that the data subject had consented to the personal data processing. The Spanish data protection supervisory authority has initiated 6 penalty proceedings for similar illegal processings addressed to foreign data subjects.