Landlord Fined for Sharing Tenant's Personal Data with Employer via Email
Written by AI from the linked story. Not reviewed by an editor. How this works
A Spanish landlord violated GDPR Article 5(1)(f) by sending an email containing a tenant's personal data — including identification number, contact details, and alleged debt information — directly to the tenant's workplace, where colleagues were able to access it. The root cause is a failure to apply basic data minimisation and purpose-limitation principles, combined with a lack of awareness about lawful communication channels. This constitutes an unlawful disclosure of personal data to unauthorised third parties, even if the intent was to recover a debt. The case demonstrates that individuals, not just organisations, are bound by GDPR obligations and can face enforcement action for mishandling personal data.
Tactical Insight
Immediate actions
- Never share a data subject's personal information with third parties (such as employers) without a clear legal basis or explicit consent.
- Limit debt-related communications strictly to the individual concerned, using direct and private contact channels only.
Long-term improvements
- Establish a clear personal data handling policy for any context involving individual data processing, including landlord-tenant relationships.
- Train individuals who handle personal data — even in non-corporate settings — on GDPR principles such as data minimisation, purpose limitation, and confidentiality.
- Consult legal counsel or a data protection advisor before disclosing personal data in dispute or debt-recovery situations.
Detection & response measures
- Implement a process to assess whether a planned communication constitutes a data disclosure before sending sensitive information.
- If a disclosure has already occurred, notify the affected individual promptly and assess whether a supervisory authority report is required under GDPR Article 33.