APDCAT (Catalonia) - PS-0036/2026
Catalonia DPA fines city council for publishing sensitive applicant data and non-cooperation.
The Catalan Data Protection Authority (APDCAT) fined the Madremanya City Council for violating GDPR. The council published sensitive financial and personal data of social housing applicants without adequate redaction and failed to respond to two information requests from the DPA. This non-cooperation hindered the DPA's investigative powers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run APDCAT?
Get an email when a new story names APDCAT, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Madremanya City Council exposed sensitive financial and personal data of social housing applicants by publishing documents without adequate redaction, a fundamental failure in data handling procedures. Compounding the breach, the council failed to respond to two formal information requests from the APDCAT, actively obstructing the regulatory investigation. This case illustrates that GDPR violations are not limited to technical breaches — procedural failures and non-cooperation with supervisory authorities carry their own significant penalties. Public sector bodies often underestimate their data protection obligations, particularly around document publication and regulatory engagement. The dual failure here — improper disclosure and non-cooperation — demonstrates how gaps in both technical controls and organisational accountability can escalate regulatory consequences.