The European Court of Justice fined Spain 15 million euros ($18.3 million) on Thursday for failing to transfer EU data protection rules into its own laws.
Spain will also face a daily ongoing penalty of 89,540 euros for each day it fails to do so.
Member states had until May 6, 2018 to transfer into law a 2016 European directive on the protection of web user's personal data in criminal investigations.
But Spain did not and received a warning letter in July 2018 and January 2019.
The European Commission lodged a legal complaint and on Thursday the ECJ ruled that Spain had not fulfilled its obligations.
During the period in question, Spain's governments were struggling to form a parliamentary majority and to pass the necessary legislation.
zap-ahg/dc/jv