[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpbNRGonBRFVb62QBKmMWBzN_5e_kY8xeztZVGNil80k":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"4b02760d-7618-46b2-a149-b27f8c723c0c","AEPD (Spain) - ps-0035-2025","aepd-spain-ps-0035-2025-8bb6e9","← Older revision Revision as of 12:39, 8 September 2026 Line 89: Line 89: On 1 October 2023, the controller sent an email stating that, unless the data subject vacated the property and returned the keys, it would provide the data subject’s workplace with a report concerning the data subject’s alleged fraudulent and criminal conduct. On 1 October 2023, the controller sent an email stating that, unless the data subject vacated the property and returned the keys, it would provide the data subject’s workplace with a report concerning the data subject’s alleged fraudulent and criminal conduct. On 4 October 2023, the controller sent an email to several email addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone numbers, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues. On 4 October 2023, the controller sent an email to several email addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone number, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues. The controller then followed-up, on 6 October 2023, with another email stating that it would cease further communications. The controller then followed-up, on 6 October 2023, with another email both the company and the data subject stating that it would cease further communications. The data subject lodged a complaint with the DPA. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller. The data subject lodged a complaint with the DPA. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal to the DPA. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller. === Holding === === Holding === The DPA held that the controller infringed [[Article 5 GDPR|Article 5(1)(f) GDPR]]. The DPA held that the controller infringed [[Article 5 GDPR|Article 5(1)(f) GDPR]].","Spain's data protection authority (AEPD) has fined a landlord €160 for violating GDPR Article 5(1)(f). The landlord disclosed a tenant's personal data, including identification details and alleged debts, to the tenant's workplace via email. This action was taken after the tenant failed to vacate a property and return keys following a dispute.","Spain's AEPD fines landlord €160 for disclosing tenant's debt to workplace.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-0035-2025&diff=52953&oldid=52945","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-09-08T12:39:21+00:00","2026-09-08T14:00:23.156315+00:00",7,[17],{"name":18,"type":19},"AEPD","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":61},"landlord-fined-for-sharing-tenants-personal-data-with-employer","Landlord Fined for Sharing Tenant's Personal Data with Employer","A Spanish landlord violated GDPR Article 5(1)(f) by disclosing a tenant's personal identification details and alleged debt information to the tenant's workplace via email — a channel entirely unrelated to the legitimate purpose of resolving a rental dispute. This constitutes an unlawful disclosure of personal data to an unauthorised third party, breaching the principle of integrity and confidentiality. The action demonstrates a fundamental misunderstanding of what constitutes lawful data processing and the boundaries individuals must respect when handling others' personal information. Even in civil disputes, personal data cannot be weaponised or shared beyond the parties directly involved without a valid legal basis. This case underscores that GDPR obligations apply to individuals and private landlords, not just organisations.",[53,54,55,56,57,58,59,60],"GDPR Article 5(1)(f) — Integrity and Confidentiality","GDPR Article 5(1)(b) — Purpose Limitation","GDPR Article 5(1)(c) — Data Minimisation","GDPR Article 6 — Lawfulness of Processing","NIST SP 800-122 — Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)","CIS Control 3 — Data Protection","NIST Privacy Framework PR.DP-P4 — Data Processing Policies","ISO\u002FIEC 27001:2022 Annex A 5.34 — Privacy and Protection of PII",{}]