Misuse of freelance workers’ data in Spain

In Spain, the data of millions of freelance workers is shared unlawfully by the registrar of freelance workers and the tax authorities with other public authorities, who then repurpose the data. Freelancers have noticed that this data has become accessible through search engines and private companies are selling individual profiles for up to EUR 40. The freelancers themselves are not informed if or how their data is transferred and used.

Xnet completed research in 2021 on the ways in which Spanish data protection legislation fails to properly respect European data protection standards on this issue. They confirmed their hypothesis that the data of millions of freelance workers is being shared illegally and mapped out a litigation strategy. They also made the finding that “blue collar” freelance workers (drivers, delivery people, etc) suffer from violations more often than “white collar” freelance workers (consultants, etc.).

In December 2022, Xnet filed a complaint to the Spanish Data Protection Agency (the AEPD), who in April 2023 launched an investigation.

On 20 May 2025, the AEPD issued a statement confirming that they agreed with Xnet’s complaint. The AEPD’s decision ordered the Spanish Chamber of Commerce to delete the data of freelancer workers and forbids them from selling the data to private consulting firms without their consent. They also issued fines amounting to EUR 500,000.


In its decision, the AEPD references Xnet’s report, “La venta de los datos de las personas en régimen de autónomos” and the evidence they presented as the basis of the investigation they carried out.