Landlord Fined for Sharing Tenant's Personal Data with Employer
Written by AI from the linked story. Not reviewed by an editor. How this works
A Spanish landlord violated GDPR Article 5(1)(f) by disclosing a tenant's personal identification details and alleged debt information to the tenant's workplace via email — a channel entirely unrelated to the legitimate purpose of resolving a rental dispute. This constitutes an unlawful disclosure of personal data to an unauthorised third party, breaching the principle of integrity and confidentiality. The action demonstrates a fundamental misunderstanding of what constitutes lawful data processing and the boundaries individuals must respect when handling others' personal information. Even in civil disputes, personal data cannot be weaponised or shared beyond the parties directly involved without a valid legal basis. This case underscores that GDPR obligations apply to individuals and private landlords, not just organisations.
Tactical Insight
Immediate actions
- Never share a third party's personal data (identification, financial details, debts) with unrelated parties such as employers without a clear legal basis.
- Consult a legal professional before communicating personal data about another individual during a civil or contractual dispute.
Policy & awareness improvements
- Landlords and property managers should receive basic GDPR training covering lawful bases for processing and restrictions on disclosing tenant data.
- Establish clear internal guidelines specifying which parties may receive tenant information and under what circumstances (e.g., courts, debt collection agencies with proper mandate).
- Document all communications involving personal data to demonstrate accountability and compliance if challenged.
Long-term compliance measures
- Register with the relevant national data protection authority if processing personal data as part of a rental business activity.
- Implement a minimal data-sharing principle: only share the minimum necessary data with only those parties who have a legitimate, lawful need.
- Periodically review data handling practices against GDPR requirements, particularly Articles 5, 6, and 9, to ensure ongoing compliance.