[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGcI1AS4pvuNcFgNe9J695gwXZ_hZpXND6m138mtLH0g":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":77},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"d055dd97-6c7c-4f62-847e-7fe020d8da21","AEPD (Spain) - ps-0035-2025","aepd-spain-ps-0035-2025-4a8483","← Older revision Revision as of 10:08, 3 September 2026 Line 91: Line 91: On 4 October 2023, the controller sent an email to several addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone numbers, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues. On 4 October 2023, the controller sent an email to several addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone numbers, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues. On 6 October 2023, the controller sent another email to the workplace stating that it would cease further communications. On 6 October 2023, the controller sent another email to the workplace stating that it would cease further communications. The data subject lodged a complaint with the DPA. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller. The data subject lodged a complaint with the AEPD. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller. === Holding === === Holding === The DPA held that the controller infringed [[Article 5 GDPR|Article 5(1)(f) GDPR]]. The DPA held that the controller infringed [[Article 5 GDPR|Article 5(1)(f) GDPR]].","Spain's AEPD has fined a landlord €160 for violating GDPR Article 5(1)(f). The landlord sent an email to the tenant's workplace, disclosing personal data including identification number, position, phone numbers, email, and details of an alleged debt. This information was accessed by the tenant's colleagues, constituting an unlawful disclosure.","Spain's AEPD fines landlord €160 for GDPR violation involving tenant data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-0035-2025&diff=52905&oldid=52904","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-09-03T10:08:28+00:00","2026-09-03T12:00:25.917657+00:00",7,[17],{"name":18,"type":19},"AEPD","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":22,"name":23,"slug":24},null,"Privacy Fines","privacy-fines",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":46,"vendors":76},[47],{"slug":48,"name":49,"problem":50,"products":51},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",[],{"slug":78,"title":79,"body":80,"framework_refs":81,"framework_notes":90},"landlord-fined-for-sharing-tenants-personal-data-with-employer-via-email","Landlord Fined for Sharing Tenant's Personal Data with Employer via Email","A Spanish landlord violated GDPR Article 5(1)(f) by sending an email containing a tenant's personal data — including identification number, contact details, and alleged debt information — directly to the tenant's workplace, where colleagues were able to access it. The root cause is a failure to apply basic data minimisation and purpose-limitation principles, combined with a lack of awareness about lawful communication channels. This constitutes an unlawful disclosure of personal data to unauthorised third parties, even if the intent was to recover a debt. The case demonstrates that individuals, not just organisations, are bound by GDPR obligations and can face enforcement action for mishandling personal data.",[82,83,84,85,86,87,88,89],"GDPR Article 5(1)(f) – Integrity and confidentiality","GDPR Article 5(1)(b) – Purpose limitation","GDPR Article 5(1)(c) – Data minimisation","GDPR Article 6 – Lawfulness of processing","GDPR Article 33 – Notification of a personal data breach to the supervisory authority","NIST SP 800-122 – Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)","CIS Control 3 – Data Protection","ISO\u002FIEC 29101 – Privacy Architecture Framework",{}]