AEPD (Spain) - ps-00256-2025
Spanish DPA fines notary for unlawful disclosure of cadastral data.
The Spanish Data Protection Agency (AEPD) has initiated sanctioning proceedings against a notary for violating Article 6(1) of the GDPR. The notary disclosed a cadastral certificate containing a data subject's personal information to a client without a valid legal basis, despite the client's stated intention to negotiate a property transaction. The AEPD found that while notaries may access such data under specific circumstances, this authorization does not extend to disclosing the complete certificate to third parties for purposes beyond the notary's official competences.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Spanish notary disclosed a cadastral certificate containing personal data to a third-party client without a valid legal basis under GDPR Article 6(1), despite the client's stated intention being a property negotiation. While notaries may access certain data in the course of their official duties, that access right does not automatically authorize sharing complete personal records with private parties for purposes outside their official competences. This case highlights a critical distinction between lawful access to data and lawful disclosure of that data — they require separate and independent legal justifications. The violation matters because even well-intentioned data sharing, such as facilitating a legitimate property transaction, can constitute a serious breach if the proper legal basis is not established before disclosure.