APDCAT (Catalonia) - PS-0036/2026
Catalonia's DPA fines Ajuntament de Madremanya for GDPR violations.
The Catalan Data Protection Authority (APDCAT) has ruled against the Ajuntament de Madremanya for violating GDPR. The city council published personal data of social housing applicants, including financial and sensitive information, without adequate redaction. Furthermore, the council failed to respond to the DPA's requests for information, hindering the investigation.
AI summary of the linked source. Not reviewed by an editor. How this works
Run APDCAT?
Get an email when a new story names APDCAT, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Ajuntament de Madremanya violated GDPR by publicly disclosing sensitive personal and financial data of social housing applicants without proper redaction, exposing vulnerable individuals to significant privacy risks. The failure to apply basic anonymisation or redaction procedures before publication reflects a fundamental gap in data handling awareness and internal controls. Compounding the violation, the council's non-cooperation with the APDCAT investigation obstructed regulatory oversight and likely worsened the authority's assessment. This case highlights that even small public bodies process sensitive special-category data and must embed GDPR-compliant practices into routine administrative workflows. Ignoring data protection obligations — and then failing to engage with regulators — significantly escalates legal and reputational consequences.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.