[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fC4PTR5kAMBzCZDbNkcSyNItPVkkfjgN-0b3-r4AiLyc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"2a8a183b-c337-45a9-8678-167199792960","catalan-council-fined-for-publishing-unredacted-personal-data-and-ignoring-dpa-requests","b70de639-53c7-4450-b2c9-2c935b8b325c","Catalan Council Fined for Publishing Unredacted Personal Data and Ignoring DPA Requests","The Madremanya City Council exposed sensitive financial and personal data of social housing applicants by publishing documents without adequate redaction, a fundamental failure in data handling procedures. Compounding the breach, the council failed to respond to two formal information requests from the APDCAT, actively obstructing the regulatory investigation. This case illustrates that GDPR violations are not limited to technical breaches — procedural failures and non-cooperation with supervisory authorities carry their own significant penalties. Public sector bodies often underestimate their data protection obligations, particularly around document publication and regulatory engagement. The dual failure here — improper disclosure and non-cooperation — demonstrates how gaps in both technical controls and organisational accountability can escalate regulatory consequences.","**Immediate actions:**\n- Establish a mandatory redaction review process for all documents containing personal data before any public publication.\n- Designate a responsible Data Protection Officer (DPO) point of contact to ensure timely responses to regulatory authority inquiries.\n- Audit all recently published documents to identify and remove any inadequately redacted personal or financial data.\n\n**Long-term improvements:**\n- Implement a formal Data Protection Impact Assessment (DPIA) procedure for any activity involving publication of documents containing personal data.\n- Create and maintain a documented records of processing activities (RoPA) register aligned with GDPR Article 30 requirements.\n- Develop staff training programmes focused on data minimisation, redaction techniques, and GDPR obligations specific to public sector entities.\n\n**Governance & compliance measures:**\n- Establish a clear internal escalation and response protocol for handling supervisory authority requests within legally required timeframes.\n- Schedule periodic compliance audits to verify that data publication workflows incorporate appropriate privacy controls.\n- Appoint or formally empower a DPO with sufficient authority and resources to enforce data protection policies across all departments.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 5(1)(f) – Integrity and confidentiality","GDPR Article 25 – Data protection by design and by default","GDPR Article 30 – Records of processing activities","GDPR Article 58 – Powers of the supervisory authority","GDPR Article 83 – General conditions for imposing administrative fines","NIST SP 800-53 PL-4 (Rules of Behavior)","NIST SP 800-53 AT-2 (Security Awareness Training)","NIST SP 800-53 AC-3 (Access Enforcement)","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ITIL Service Management – Compliance and Risk Management",{},"published","2026-08-04T12:20:51.981841+00:00","2026-08-04T12:20:51.858+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=APDCAT_(Catalonia)_-_PS-0036\u002F2026&diff=52599&oldid=52589","apdcat-catalonia-ps-0036-2026-ad7c1f","APDCAT (Catalonia) - PS-0036\u002F2026",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":45,"name":46,"slug":47,"description":48,"color":49},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]