La Liga fined €250,000 for breach of GDPR

The Spanish Data Protection Agency (AEPD) has hit the organisers of Spain’s top football division La Liga with a €250,000 ($280,959) fine for breaching EU data protection law when monitoring online piracy.

Spanish online newspaper eldiario.es reported last year that La Liga had been using its official app to “spy” on bars showing La Liga matches.

According to those reports, if users of the app had given it permission to access their mobile phone’s microphone, La Liga could remotely activate the microphone in order to determine whether a bar was showing a match without a licence.

After an investigation, the AEPD has now decided that this practice breached the EU’s General Data Protection Regulation (GDPR).

The EU adopted GDPR in 2016 and began implementing it in law last May in order to tighten rules on the holding and processing of private data.

In a statement, La Liga hit back at the AEPD’s findings and said it has always complied with its GDPR obligations.

“La Liga disagrees profoundly with this decision, rejects the penalty imposed as unjust, unfounded and disproportionate, and considers that the AEPD has not made the necessary efforts to understand how the technology works,” the statement said.

The league also confirmed that it would appeal against the fine. According to La Liga, the app could not be used to listen to users’ voices or identify participants.

“La Liga would not be acting diligently if it did not use all means at its disposal to fight against piracy,” La Liga said.

The league added: “This is a major undertaking given the scale of the fraud in the market, which is estimated to cost around €400 million a year.”