{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/enforcement/enforcement%3Aes%3Aaepd%3Aps-00188-2025","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/enforcement/enforcement%3Aes%3Aaepd%3Aps-00188-2025)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-25","fingerprint":"ewai:shared:55e7a1","proof":"sha256:63d9a1f536b92785d1eca83357403cc4d61a324682a08ed7295b26600e883654","jurisdiction":"shared","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","schema_version":1,"id":"enforcement:es:aepd:ps-00188-2025","country":"es","authority":"aepd","case_ref":"PS-00188-2025","decision_type":"sanction","topic":"privacy","impact":"low","impact_basis":"decision_type:sanction","classification_rules":"v1","decided":"2026-02-07","entity":"not_in_register","act":"regulation-2016-679-eu","articles":["art-25","art-30","art-35"],"amount":"not_in_register","currency":"not_in_register","summary":"PS-00188-2025: RESUELVE: PRIMERO: DECLARAR que la GERENCIA REGIONAL DE SALUD DE CASTILLA Y LEÓN, con NIF Q4700608E, ha infringido lo dispuesto en los artículos 25, 30 y 35 del RGPD, infracciones tipificadas en el artículo 83.4.a) del RGPD SEGUNDO:","source_url":"https://www.aepd.es/documento/ps-00188-2025.pdf","read_at":"2026-10-10T10:55:18.505219+00:00","sha256":"ff456f417a58eb953f1de8bf8c7d0f4bb1d4df2a45208b848da7f55a07f1ae41","url":"https://legal.exploreworldai.com/api/public/v1/enforcement/enforcement%3Aes%3Aaepd%3Aps-00188-2025","source":"NovaCopilot","risk_objects":"https://legal.exploreworldai.com/api/public/v1/risk-objects?topic=privacy&country=es","chain":{"rules":"v1","source":"NovaCopilot","status":"linked","decision_id":"enforcement:es:aepd:ps-00188-2025","breached_articles":[25,30,35],"obligations":[{"obligation_id":"obligation:eu:gdpr-art-25-controller","article":"25","role":"controller","duty":"Apply data protection by design and by default.","sha256":"02861b9b67c914fd1c7ffe029d53774e8ed387c6ee3898f8ba574c8771f4b6f3","url":"https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu%3Agdpr-art-25-controller"},{"obligation_id":"obligation:eu:gdpr-art-30-controller","article":"30","role":"controller","duty":"Keep records of processing activities.","sha256":"cf28938e0d3202383d4643d9eb0e16a76f341981304034fdc2338ad762a8ca6b","url":"https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu%3Agdpr-art-30-controller"},{"obligation_id":"obligation:eu:gdpr-art-35-controller","article":"35","role":"controller","duty":"Carry out a data protection impact assessment for high-risk processing.","sha256":"369d40ec296e481259b284116b57747f9ee6507cc74e6dc169f46cc90532028a","url":"https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu%3Agdpr-art-35-controller"},{"obligation_id":"obligation:eu:gdpr-art-30-processor","article":"30","role":"processor","duty":"Maintain a written record of all categories of processing activities carried out on behalf of each controller.","sha256":"8eec6315cac3e7b0b7076baeca996c533cc05e227d0def3c5cb291612734ae26","url":"https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu%3Agdpr-art-30-processor"}],"unlinked_articles":[],"sanctions":[{"sanction_id":"sanction:eu:gdpr-art-83-4","article":"83(4)","max_amount":"EUR 10 000 000","max_turnover_pct":2,"sha256":"02ac09ae66b44afcfc74bc418e4d1bdfaa9565aa4c55640e517c0d8dcb3864a4"}],"fine":{"amount_eur":"not_in_register","fixed_cap_eur":10000000,"share_of_fixed_cap":"not_in_register","turnover_cap":"requires_entity_turnover"},"chain_hash":"96eac8418a1abb662f1dd6d0aaf656458f9a8b6b47992105eddf23b6e5685a7a","chain_formula":"chain_n = SHA-256(chain_{n-1}|n|kind|id|sha256), genesis 64x0, order decision, obligations, sanctions"},"hash":"sha256:63d9a1f536b92785d1eca83357403cc4d61a324682a08ed7295b26600e883654","version":"legal-2026-10-25","expires":"2026-10-26T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-25+legal-2026-10-25+2026-10-25T12:13:04","content_hash":"sha256:63d9a1f536b92785d1eca83357403cc4d61a324682a08ed7295b26600e883654","revalidate_after":"2026-10-25T13:31:38.662Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/enforcement/enforcement%3Aes%3Aaepd%3Aps-00188-2025","disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/enforcement/enforcement%3Aes%3Aaepd%3Aps-00188-2025","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"}}