[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fy80-Ks1clvCTOR012QPt-jDTx7HL_ywvdfVHvoOwDcU":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"b5b0882e-bd6b-45b5-9059-37a115e7f34d","AEPD (Spain) - ps-00256-2025","aepd-spain-ps-00256-2025-a3e601","← Older revision Revision as of 09:46, 8 September 2026 Line 97: Line 97: === Facts === === Facts === A data subject filed a complaint with the DPA after receiving a letter from a third party concerning a plot of land. The third party asked the data subject to acknowledge that she was not the owner of the property so that the cadastral records could be amended. The letter was accompanied by a cadastral certificate containing the data subject’s name, surname and home address. The third party had also previously visited the data subject at that address. After receiving an in-person visit at her address, a data subject received a letter from a third party concerning a plot of land. The third party asked the data subject to acknowledge that she was not the owner of the property so that the cadastral records could be amended. The letter was accompanied by a cadastral certificate containing the data subject’s name, surname and home address. An investigation established that a notary, the controller, had obtained the cadastral certificate at the request of a client. The client had indicated that her son intended to enter into negotiations with the person registered as the owner of the property to purchase or rent it. The controller subsequently provided the certificate to the client. The data subject filed a complaint with the DPA which investigated the case. The investigation established that a notary, the controller, had obtained the cadastral certificate at the request of a client. The client had indicated that her son intended to enter into negotiations with the person registered as the owner of the property to purchase or rent it. The controller subsequently provided the certificate to the client. The certificate included the data subject’s name, surname and address. Ultimately, no transaction was ultimately formalized before the controller. The controller argued that access to the cadastral information had taken place in the context of preparatory steps for a potential property transaction and relied on the powers granted to notaries under Spanish cadastral legislation. No transaction was ultimately formalised before the controller. The controller argued that access to the cadastral information had taken place in the context of preparatory steps for a potential property transaction and relied on the powers granted to notaries under Spanish cadastral legislation. The DPA initiated sanctioning proceedings against the controller for a potential infringement of [[Article 6 GDPR|Article 6(1) GDPR]]. The DPA initiated sanctioning proceedings against the controller for a potential infringement of [[Article 6 GDPR|Article 6(1) GDPR]]. Line 107: Line 107: The DPA held that the controller violated [[Article 6 GDPR|Article 6(1) GDPR]] by disclosing the cadastral certificate containing the data subject’s personal data to a third party without a valid legal basis. The DPA held that the controller violated [[Article 6 GDPR|Article 6(1) GDPR]] by disclosing the cadastral certificate containing the data subject’s personal data to a third party without a valid legal basis. The DPA noted that the data contained in the certificate, including the data subject’s name, surname and address, constituted protected cadastral data under Spanish law. Although the applicable cadastral legislation allows notaries to access protected cadastral information in certain circumstances, the DPA distinguished between the controller’s access to the information and its subsequent disclosure to the client. The DPA distinguished between (i) the controller’s access to the certificate and (ii) its subsequent disclosure to the client. In particular, the DPA considered that the rules allowing a notary to access protected cadastral data did not provide a legal basis for handing the complete certificate to the client. The certificate itself stated that the information could only be used for the exercise of the requesting party’s competences. The client subsequently used the information to visit the data subject’s home and send her a letter concerning the property. Regarding (i) the access to the certificate, the DPA noted that the applicable cadastral legislation indeed allows notaries to access protected cadastral information in certain circumstances. However, such authorization does not extend to (ii) the disclosure of the information. That finding was supported by the certificate itself which stated that the information could only be used for the exercise of the requesting party’s competences. On the contrary, in this case, the information was later on used to visit the data subject’s home and send her a letter concerning the property. Consequently, the DPA found that the disclosure constituted a separate processing operation for which none of the legal bases under [[Article 6 GDPR|Article 6(1) GDPR]] had been established. Consequently, the DPA found that the disclosure constituted a separate processing operation for which none of the legal bases under [[Article 6 GDPR|Article 6(1) GDPR]] had been established.","The Spanish Data Protection Agency (AEPD) has initiated sanctioning proceedings against a notary for violating Article 6(1) of the GDPR. The notary disclosed a cadastral certificate containing a data subject's personal information to a client without a valid legal basis, despite the client's stated intention to negotiate a property transaction. The AEPD found that while notaries may access such data under specific circumstances, this authorization does not extend to disclosing the complete certificate to third parties for purposes beyond the notary's official competences.","Spanish DPA fines notary for unlawful disclosure of cadastral data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-00256-2025&diff=52943&oldid=52903","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-09-08T09:46:23+00:00","2026-09-08T10:00:13.925103+00:00",7,[17],{"name":18,"type":19},"AEPD","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":63},"notary-fined-for-unlawful-disclosure-of-personal-data-without-legal-basis","Notary Fined for Unlawful Disclosure of Personal Data Without Legal Basis","A Spanish notary disclosed a cadastral certificate containing personal data to a third-party client without a valid legal basis under GDPR Article 6(1), despite the client's stated intention being a property negotiation. While notaries may access certain data in the course of their official duties, that access right does not automatically authorize sharing complete personal records with private parties for purposes outside their official competences. This case highlights a critical distinction between lawful access to data and lawful disclosure of that data — they require separate and independent legal justifications. The violation matters because even well-intentioned data sharing, such as facilitating a legitimate property transaction, can constitute a serious breach if the proper legal basis is not established before disclosure.",[53,54,55,56,57,58,59,60,61,62],"GDPR Article 6(1) — Lawfulness of processing","GDPR Article 5(1)(b) — Purpose limitation principle","GDPR Article 5(1)(f) — Integrity and confidentiality principle","NIST SP 800-53 AC-3 — Access Enforcement","NIST SP 800-53 AC-22 — Publicly Accessible Content","NIST SP 800-53 PM-25 — Minimization of Personally Identifiable Information","CIS Control 3 — Data Protection (Safeguard 3.1: Establish and Maintain a Data Management Process)","CIS Control 4 — Secure Configuration of Enterprise Assets and Software","ISO\u002FIEC 29101 — Privacy Architecture Framework","ITIL Service Design — Information Security Management (data classification and handling)",{}]