[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f940mG9OoSaSnOfv8nbo1ufCUE0u07TzZ1IuWC191v-I":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":47,"controls":48},"c8b43b62-7aca-4f8e-a700-078cbe7a8d18","landlord-fined-for-sharing-tenants-personal-data-with-employer-via-email","d055dd97-6c7c-4f62-847e-7fe020d8da21","Landlord Fined for Sharing Tenant's Personal Data with Employer via Email","A Spanish landlord violated GDPR Article 5(1)(f) by sending an email containing a tenant's personal data — including identification number, contact details, and alleged debt information — directly to the tenant's workplace, where colleagues were able to access it. The root cause is a failure to apply basic data minimisation and purpose-limitation principles, combined with a lack of awareness about lawful communication channels. This constitutes an unlawful disclosure of personal data to unauthorised third parties, even if the intent was to recover a debt. The case demonstrates that individuals, not just organisations, are bound by GDPR obligations and can face enforcement action for mishandling personal data.","**Immediate actions:**\n- Never share a data subject's personal information with third parties (such as employers) without a clear legal basis or explicit consent.\n- Limit debt-related communications strictly to the individual concerned, using direct and private contact channels only.\n\n**Long-term improvements:**\n- Establish a clear personal data handling policy for any context involving individual data processing, including landlord-tenant relationships.\n- Train individuals who handle personal data — even in non-corporate settings — on GDPR principles such as data minimisation, purpose limitation, and confidentiality.\n- Consult legal counsel or a data protection advisor before disclosing personal data in dispute or debt-recovery situations.\n\n**Detection & response measures:**\n- Implement a process to assess whether a planned communication constitutes a data disclosure before sending sensitive information.\n- If a disclosure has already occurred, notify the affected individual promptly and assess whether a supervisory authority report is required under GDPR Article 33.",[12,13,14,15,16,17,18,19],"GDPR Article 5(1)(f) – Integrity and confidentiality","GDPR Article 5(1)(b) – Purpose limitation","GDPR Article 5(1)(c) – Data minimisation","GDPR Article 6 – Lawfulness of processing","GDPR Article 33 – Notification of a personal data breach to the supervisory authority","NIST SP 800-122 – Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)","CIS Control 3 – Data Protection","ISO\u002FIEC 29101 – Privacy Architecture Framework",{},"published","2026-09-03T12:22:14.417831+00:00","2026-09-03T12:22:14.123+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-0035-2025&diff=52905&oldid=52904","aepd-spain-ps-0035-2025-4a8483","AEPD (Spain) - ps-0035-2025",[29,35,41],{"id":30,"name":31,"slug":32,"description":33,"color":34},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[49],{"slug":50,"name":51,"problem":52},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]