[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-PoniIipiHaPsuieXUL5C7YL2qxBoIMh_iHXhj8qNLM":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"131d0120-024b-4c24-9203-51143adee88b","AEPD (Spain) - ps-00287-2025","aepd-spain-ps-00287-2025-4ac220","Created page with \"{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color= |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=ps-00287-2025 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00287-2025.pdf |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint...\" Show changes","Spain's data protection authority (AEPD) ruled that the Dirección General de Tráfico (DGT) violated GDPR Article 5(1)(c) by collecting and transmitting unnecessary personal data, including IP addresses and device information, via its mobile app. Although the DGT implemented changes, the AEPD found the infringement had already occurred, but no fine was imposed as the controller is a public authority.","Spain's AEPD finds DGT's mobile app collected unnecessary personal data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-00287-2025&diff=53278&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-10-01T15:31:33+00:00","2026-10-01T16:00:18.697676+00:00",7,[17,20,23],{"name":18,"type":19},"AEPD","vendor",{"name":21,"type":22},"mobile app","product",{"name":24,"type":19},"DGT","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,24],{"controls":51,"vendors":133},[52,81,107],{"slug":53,"name":54,"problem":55,"products":56},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"slug":82,"name":83,"problem":84,"products":85},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[86,93,101],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":88,"url":91,"description":92},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":102,"product_name":103,"url":105,"description":106},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"slug":108,"name":109,"problem":110,"products":111},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[112,120,125],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":121,"product_name":122,"url":123,"description":124},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":148},"spains-dgt-fined-for-collecting-excessive-personal-data-via-mobile-app","Spain's DGT Fined for Collecting Excessive Personal Data via Mobile App","The Dirección General de Tráfico violated GDPR's data minimisation principle (Article 5(1)(c)) by collecting and transmitting unnecessary personal data — including IP addresses and device identifiers — through its official mobile application. The root cause was a failure to design the app with privacy by design and by default principles, meaning data collection was not scoped to what was strictly necessary for the app's purpose. This matters because public sector organisations handle data for large populations and hold a heightened responsibility to model compliant data practices. Even though no fine was imposed due to the controller's public authority status, the reputational and corrective burden demonstrates that technical implementation decisions carry direct regulatory consequences.",[139,140,141,142,143,144,145,146,147],"GDPR Article 5(1)(c) — Data Minimisation","GDPR Article 25 — Data Protection by Design and by Default","GDPR Article 35 — Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.DS-P1 — Data minimisation practices","NIST SP 800-53 RA-3 — Risk Assessment","NIST SP 800-53 SI-12 — Information Management and Retention","CIS Control 3 — Data Protection (Subcontrol 3.1: Establish and Maintain a Data Management Process)","ISO\u002FIEC 29101 — Privacy Architecture Framework","ITIL Service Design — Privacy and data handling requirements in service design",{"NIST SP 800-53 RA-3 — Risk Assessment":149,"GDPR Article 5(1)(c) — Data Minimisation":150,"ISO\u002FIEC 29101 — Privacy Architecture Framework":151,"GDPR Article 25 — Data Protection by Design and by Default":152,"GDPR Article 35 — Data Protection Impact Assessment (DPIA)":153,"NIST SP 800-53 SI-12 — Information Management and Retention":154,"NIST Privacy Framework PR.DS-P1 — Data minimisation practices":155,"ITIL Service Design — Privacy and data handling requirements in service design":156,"CIS Control 3 — Data Protection (Subcontrol 3.1: Establish and Maintain a Data Management Process)":157},"Risk assessment helps identify privacy risks in app design.","Data minimisation would have stopped the DGT app collecting unnecessary IP addresses and device identifiers.","Privacy architecture guidance supports designing apps with minimal data collection.","Privacy by design would have built the app to collect only necessary data.","A DPIA would have identified excessive data collection before launch.","Information management limits retention and use of collected data.","Calls for collecting only data needed for the app's purpose.","Building privacy requirements into service design would have flagged unnecessary data collection.","A data management process defines what data the app should collect and why."]