{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/enforcement/enforcement%3Aes%3Aaepd%3Aps-00164-2025","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/enforcement/enforcement%3Aes%3Aaepd%3Aps-00164-2025)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-11-02","fingerprint":"ewai:shared:f4b8fe","proof":"sha256:5f603bafce456297d1ff43e7e9ecdbca1309f4028a1e9bd12dabd1a7fa760c51","jurisdiction":"shared","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","schema_version":1,"id":"enforcement:es:aepd:ps-00164-2025","country":"es","authority":"aepd","case_ref":"PS-00164-2025","decision_type":"sanction","topic":"privacy","impact":"low","impact_basis":"decision_type:sanction","classification_rules":"v1","decided":"2026-08-22","entity":"YOTI LTD","act":"regulation-2016-679-eu","articles":["art-5","art-7","art-9"],"amount":"not_in_register","currency":"not_in_register","summary":"PS-00164-2025: RESUELVE: PRIMERO: IMPONER a YOTI LTD, con NIF 08998951: C/ Jorge Juan, 6 28001 – Madrid www.aepd.es sedeaepd.gob.es 64/65 - Por la infracción del artículo 9 del RGPD: 500.000 euros. Por la infracción del artículo 7 del RGPD: 200.000 euros. Por la infracción del artículo 5.1 e) del RG …","source_url":"https://www.aepd.es/documento/ps-00164-2025.pdf","read_at":"2026-10-10T10:55:13.431783+00:00","sha256":"1e0f6570a07f4ff6ef2b30bafdd4babffd83a1a4a25f63468997cd4dc4cd5bde","url":"https://legal.exploreworldai.com/api/public/v1/enforcement/enforcement%3Aes%3Aaepd%3Aps-00164-2025","source":"NovaCopilot","risk_objects":"https://legal.exploreworldai.com/api/public/v1/risk-objects?topic=privacy&country=es","chain":{"rules":"v1","source":"NovaCopilot","status":"linked","decision_id":"enforcement:es:aepd:ps-00164-2025","breached_articles":[5,7,9],"obligations":[{"obligation_id":"obligation:eu:gdpr-art-5-controller","article":"5","role":"controller","duty":"Process personal data in line with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and be able to demonstrate compliance (accountability).","sha256":"fac4bba489cc1f5c6b4653fb29928a5274bb19273e0d21fe18fd12be13fe8f60","url":"https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu%3Agdpr-art-5-controller"},{"obligation_id":"obligation:eu:gdpr-art-7-controller","article":"7","role":"controller","duty":"Be able to demonstrate consent where processing is based on consent, present consent requests clearly distinguishable from other matters, and make withdrawal as easy as giving consent.","sha256":"c2a224d1eeb7b2c71ede1c8d4d91af62a64b4750cb7d32edf39198215a7247cc","url":"https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu%3Agdpr-art-7-controller"},{"obligation_id":"obligation:eu:gdpr-art-9-controller","article":"9","role":"controller","duty":"Do not process special categories of personal data unless an exception in Article 9(2) applies.","sha256":"10db04e22ee39c12aad3cfe51f923c8d94a42795689790f8eb93ed57e5daa176","url":"https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu%3Agdpr-art-9-controller"}],"unlinked_articles":[],"sanctions":[{"sanction_id":"sanction:eu:gdpr-art-83-5","article":"83(5)","max_amount":"EUR 20 000 000","max_turnover_pct":4,"sha256":"f0b01e602fcb61aa65f52bb1beeb2f29ae0e2f70162dc508d3906fc9973ee2f0"}],"fine":{"amount_eur":"not_in_register","fixed_cap_eur":20000000,"share_of_fixed_cap":"not_in_register","turnover_cap":"requires_entity_turnover"},"chain_hash":"f1a305762a8b0ef12d8a7c20b4cf83a4514daacd78bb646135731d654a3359de","chain_formula":"chain_n = SHA-256(chain_{n-1}|n|kind|id|sha256), genesis 64x0, order decision, obligations, sanctions"},"hash":"sha256:5f603bafce456297d1ff43e7e9ecdbca1309f4028a1e9bd12dabd1a7fa760c51","version":"legal-2026-11-02","expires":"2026-11-02T12:00:00.000Z","dependency":{"index_version":"legal-2026-11-02+legal-2026-11-02+2026-11-02T08:29:46","content_hash":"sha256:5f603bafce456297d1ff43e7e9ecdbca1309f4028a1e9bd12dabd1a7fa760c51","revalidate_after":"2026-11-02T10:10:15.777Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/enforcement/enforcement%3Aes%3Aaepd%3Aps-00164-2025","disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/enforcement/enforcement%3Aes%3Aaepd%3Aps-00164-2025","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"freshness":{"freshness_class":"live","as_of":"2026-11-02T09:10:16.083Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/enforcement/enforcement%3Aes%3Aaepd%3Aps-00164-2025","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1450}}