AEPD (Spain) - PS-00506-2026
Spain's AEPD found a municipality violated GDPR by improperly disposing of exam papers.
Spain's Data Protection Agency (AEPD) ruled that the Canals City Council violated GDPR Article 5(1)(f) by failing to properly destroy exam papers containing personal data. The documents, which included names, national identification numbers, and exam results of three participants, were found discarded next to waste containers and were subsequently accessed by third parties, with some even published on social media. While the council acknowledged the error and revised its procedures, the AEPD formally declared the infringement but did not impose a fine due to the entity being a local public authority and having already taken corrective measures.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Canals City Council failed to implement adequate physical data destruction procedures for exam papers containing sensitive personal data, including national identification numbers and exam results. These documents were discarded next to waste containers rather than being securely destroyed, allowing third parties to access and even publish the information on social media. This incident highlights that data protection obligations extend fully to physical documents, not just digital records. The breach violated GDPR Article 5(1)(f), which mandates appropriate security to prevent unauthorised access, demonstrating that even small public bodies must enforce strict end-of-life data handling policies.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.