AEPD (Spain) - ps-00287-2025
Spain's AEPD finds DGT's mobile app collected unnecessary personal data.
Spain's data protection authority (AEPD) ruled that the Dirección General de Tráfico (DGT) violated GDPR Article 5(1)(c) by collecting and transmitting unnecessary personal data, including IP addresses and device information, via its mobile app. Although the DGT implemented changes, the AEPD found the infringement had already occurred, but no fine was imposed as the controller is a public authority.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Dirección General de Tráfico violated GDPR's data minimisation principle (Article 5(1)(c)) by collecting and transmitting unnecessary personal data — including IP addresses and device identifiers — through its official mobile application. The root cause was a failure to design the app with privacy by design and by default principles, meaning data collection was not scoped to what was strictly necessary for the app's purpose. This matters because public sector organisations handle data for large populations and hold a heightened responsibility to model compliant data practices. Even though no fine was imposed due to the controller's public authority status, the reputational and corrective burden demonstrates that technical implementation decisions carry direct regulatory consequences.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- SaaS security posture management (SSPM)
Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.