[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEv651USmDXY146VKDf0Z-44RdpEywCr4LsjKMpmTdZc":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"b70de639-53c7-4450-b2c9-2c935b8b325c","APDCAT (Catalonia) - PS-0036\u002F2026","apdcat-catalonia-ps-0036-2026-ad7c1f","← Older revision Revision as of 11:45, 4 August 2026 (2 intermediate revisions by the same user not shown) Line 100: Line 100: }} }} The DPA held that a city council violated [[Article 5 GDPR|Articles 5(1)(c)]], [[Article 5 GDPR|5(1)(f)]] and [[Article 31 GDPR|31 GDPR]] by publishing identifiable applicants’ financial and sensitive data and failing to answer two information requests. The DPA held that a city council violated [[Article 5 GDPR|Articles 5(1)(c)]], [[Article 5 GDPR|5(1)(f)]] and [[Article 31 GDPR|31 GDPR]] by publishing financial and sensitive data of applicants for social housing and failing to answer two information requests of the DPA. == English Summary == == English Summary == Line 111: Line 111: In addition to the applicants’ identifying information, the documents disclosed detailed financial data, including the exact annual net income of each household. They also revealed information concerning particularly sensitive personal circumstances, including dependency, gender-based violence and addiction, which had been used to calculate the applicants’ respective scores. No adequate anonymisation or redaction measures had been implemented. In addition to the applicants’ identifying information, the documents disclosed detailed financial data, including the exact annual net income of each household. They also revealed information concerning particularly sensitive personal circumstances, including dependency, gender-based violence and addiction, which had been used to calculate the applicants’ respective scores. No adequate anonymisation or redaction measures had been implemented. In July 2025, the DPA requested that the controller provide specific information concerning certain aspects of the processing. The controller’s failure to respond or cooperate hindered the DPA’s ability to exercise its investigative powers. In July and November 2025, the DPA requested that the controller provide specific information concerning certain aspects of the processing. The controller’s failure to respond or cooperate hindered the DPA’s ability to exercise its investigative powers. === Holding === === Holding === The DPA held that the controller violated [[Article 5 GDPR|Article 5(1)(c) GDPR]] by publishing personal data that were not necessary for the purpose pursued. The DPA held that the controller violated [[Article 5 GDPR|Article 5(1)(c) GDPR]] by publishing personal data that were not necessary for the purpose pursued.","The Catalan Data Protection Authority (APDCAT) fined the Madremanya City Council for violating GDPR. The council published sensitive financial and personal data of social housing applicants without adequate redaction and failed to respond to two information requests from the DPA. This non-cooperation hindered the DPA's investigative powers.","Catalonia DPA fines city council for publishing sensitive applicant data and non-cooperation.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=APDCAT_(Catalonia)_-_PS-0036\u002F2026&diff=52599&oldid=52589","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fb\u002Fbe\u002FApdcat-logo.png","2026-08-04T11:45:23+00:00","2026-08-04T12:00:11.628671+00:00",7,[17,20],{"name":18,"type":19},"APDCAT","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,33,38,40],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":23,"icon":25,"name":26,"slug":27},{"category":41},{"id":42,"icon":25,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":66},"catalan-council-fined-for-publishing-unredacted-personal-data-and-ignoring-dpa-requests","Catalan Council Fined for Publishing Unredacted Personal Data and Ignoring DPA Requests","The Madremanya City Council exposed sensitive financial and personal data of social housing applicants by publishing documents without adequate redaction, a fundamental failure in data handling procedures. Compounding the breach, the council failed to respond to two formal information requests from the APDCAT, actively obstructing the regulatory investigation. This case illustrates that GDPR violations are not limited to technical breaches — procedural failures and non-cooperation with supervisory authorities carry their own significant penalties. Public sector bodies often underestimate their data protection obligations, particularly around document publication and regulatory engagement. The dual failure here — improper disclosure and non-cooperation — demonstrates how gaps in both technical controls and organisational accountability can escalate regulatory consequences.",[55,56,57,58,59,60,61,62,63,64,65],"GDPR Article 5(1)(f) – Integrity and confidentiality","GDPR Article 25 – Data protection by design and by default","GDPR Article 30 – Records of processing activities","GDPR Article 58 – Powers of the supervisory authority","GDPR Article 83 – General conditions for imposing administrative fines","NIST SP 800-53 PL-4 (Rules of Behavior)","NIST SP 800-53 AT-2 (Security Awareness Training)","NIST SP 800-53 AC-3 (Access Enforcement)","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ITIL Service Management – Compliance and Risk Management",{}]