AEPD (Spain) - ps-0035-2025
Spain's AEPD fines landlord €160 for GDPR violation involving tenant data.
Spain's AEPD has fined a landlord €160 for violating GDPR Article 5(1)(f). The landlord sent an email to the tenant's workplace, disclosing personal data including identification number, position, phone numbers, email, and details of an alleged debt. This information was accessed by the tenant's colleagues, constituting an unlawful disclosure.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Spanish landlord violated GDPR Article 5(1)(f) by sending an email containing a tenant's personal data — including identification number, contact details, and alleged debt information — directly to the tenant's workplace, where colleagues were able to access it. The root cause is a failure to apply basic data minimisation and purpose-limitation principles, combined with a lack of awareness about lawful communication channels. This constitutes an unlawful disclosure of personal data to unauthorised third parties, even if the intent was to recover a debt. The case demonstrates that individuals, not just organisations, are bound by GDPR obligations and can face enforcement action for mishandling personal data.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.