[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzExpNKFOIhIWc-uJoe2mwTZwCf_nhtce93uFr8RCEDA":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"1239c523-8c4d-4d2c-8d66-8c9beb78d345","AEPD (Spain) - ps-00256-2025","aepd-spain-ps-00256-2025-cb1772","← Older revision Revision as of 10:01, 3 September 2026 Line 24: Line 24: |Type=Complaint |Type=Complaint |Outcome=Upheld |Outcome=Upheld |Date_Started= |Date_Started=27.06.2024 |Date_Decided= |Date_Decided= |Date_Published=01.09.2026 |Date_Published=01.09.2026 Line 104: Line 104: The DPA initiated sanctioning proceedings against the controller for a potential infringement of [[Article 6 GDPR|Article 6(1) GDPR]]. The DPA initiated sanctioning proceedings against the controller for a potential infringement of [[Article 6 GDPR|Article 6(1) GDPR]]. === Holding === === Holding === The DPA held that the controller violated [[Article 6 GDPR|Article 6(1) GDPR]] by disclosing the cadastral certificate containing the data subject’s personal data to a third party without a valid legal basis. The DPA held that the controller violated [[Article 6 GDPR|Article 6(1) GDPR]] by disclosing the cadastral certificate containing the data subject’s personal data to a third party without a valid legal basis.","Spain's AEPD has fined a notary €2,000 for violating GDPR by disclosing protected cadastral data, including a data subject's name and address, to a client without a valid legal basis. The data subject filed a complaint after receiving a letter from a third party, accompanied by a cadastral certificate obtained by the notary for a client interested in a property transaction.","Spain's AEPD fines a notary €2,000 for GDPR violation.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-00256-2025&diff=52903&oldid=52902","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-09-03T10:01:37+00:00","2026-09-03T12:00:25.917657+00:00",7,[17],{"name":18,"type":19},"cadastral certificate","product","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":22,"name":23,"slug":24},null,"Privacy Fines","privacy-fines",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":62},"spanish-notary-fined-for-sharing-cadastral-data-without-legal-basis","Spanish Notary Fined for Sharing Cadastral Data Without Legal Basis","A Spanish notary disclosed a data subject's personal cadastral data — including name and address — to a third-party client without establishing a valid legal basis under GDPR, resulting in a €2,000 fine from Spain's AEPD. The core failure was treating access to professional data tools as implicit authorisation to share that data with clients, conflating technical ability with legal permission. This case highlights that professionals handling personal data on behalf of clients must independently verify lawful grounds for each disclosure. Even seemingly routine property transaction activities can constitute serious GDPR violations when proper data-sharing controls are absent.",[53,54,55,56,57,58,59,60,61],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 6 – Lawfulness of processing","GDPR Article 13\u002F14 – Information obligations to data subjects","GDPR Article 58 – Supervisory authority corrective powers","NIST Privacy Framework PR.PO-P1 – Policies and procedures for data processing","NIST SP 800-53 AC-3 – Access Enforcement","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27001 A.18.1.4 – Privacy and protection of personally identifiable information",{}]