[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXmFJAnUVyM8lueL0b8dGXgllum0yCV8JOatUFXfH4Cc":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":80},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"95c6231e-53b8-4e01-9b50-a95482eb150d","APDCAT (Catalonia) - PS-0036\u002F2026","apdcat-catalonia-ps-0036-2026-7916fb","Fixed language tag ← Older revision Revision as of 06:41, 23 September 2026 Line 13: Line 13: |Original_Source_Name_1=APDCAT |Original_Source_Name_1=APDCAT |Original_Source_Link_1=https:\u002F\u002Fseu.apdcat.cat\u002Fca\u002FdocumentPublic\u002Fdownload\u002F8342 |Original_Source_Link_1=https:\u002F\u002Fseu.apdcat.cat\u002Fca\u002FdocumentPublic\u002Fdownload\u002F8342 |Original_Source_Language_1=Catalan; Valencian |Original_Source_Language_1=Catalan |Original_Source_Language__Code_1=CA |Original_Source_Language__Code_1=CA","The Catalan Data Protection Authority (APDCAT) has ruled against the Ajuntament de Madremanya for violating GDPR. The city council published personal data of social housing applicants, including financial and sensitive information, without adequate redaction. Furthermore, the council failed to respond to the DPA's requests for information, hindering the investigation.","Catalonia's DPA fines Ajuntament de Madremanya for GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=APDCAT_(Catalonia)_-_PS-0036\u002F2026&diff=53162&oldid=52599","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fb\u002Fbe\u002FApdcat-logo.png","2026-09-23T06:41:52+00:00","2026-09-23T08:00:09.411889+00:00",7,[17,20],{"name":18,"type":19},"APDCAT","vendor",{"name":21,"type":22},"Ajuntament de Madremanya","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":79},[50],{"slug":51,"name":52,"problem":53,"products":54},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",[],{"slug":81,"title":82,"body":83,"framework_refs":84,"framework_notes":96},"catalan-council-fined-for-publishing-unredacted-social-housing-applicants-personal-data","Catalan Council Fined for Publishing Unredacted Social Housing Applicants' Personal Data","The Ajuntament de Madremanya violated GDPR by publicly disclosing sensitive personal and financial data of social housing applicants without proper redaction, exposing vulnerable individuals to significant privacy risks. The failure to apply basic anonymisation or redaction procedures before publication reflects a fundamental gap in data handling awareness and internal controls. Compounding the violation, the council's non-cooperation with the APDCAT investigation obstructed regulatory oversight and likely worsened the authority's assessment. This case highlights that even small public bodies process sensitive special-category data and must embed GDPR-compliant practices into routine administrative workflows. Ignoring data protection obligations — and then failing to engage with regulators — significantly escalates legal and reputational consequences.",[85,86,87,88,89,90,91,92,93,94,95],"GDPR Article 5(1)(f) — Integrity and confidentiality principle","GDPR Article 9 — Processing of special categories of personal data","GDPR Article 25 — Data protection by design and by default","GDPR Article 31 — Cooperation with the supervisory authority","GDPR Article 83 — General conditions for imposing administrative fines","NIST SP 800-53 AC-3 — Access Enforcement","NIST SP 800-53 PL-8 — Security and Privacy Architectures","NIST SP 800-53 AT-2 — Literacy Training and Awareness","CIS Control 3 — Data Protection","CIS Control 14 — Security Awareness and Skills Training","ITIL Service Transition — Information Security Management",{}]