[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2yORHl4CBg-ha7KJ9kkxOAzNMyelpdjqXcJJFAYG2jw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":47,"controls":48},"8771e5df-919f-4035-a991-c74e23d6d6a1","landlord-fined-for-sharing-tenants-personal-data-with-employer","4b02760d-7618-46b2-a149-b27f8c723c0c","Landlord Fined for Sharing Tenant's Personal Data with Employer","A Spanish landlord violated GDPR Article 5(1)(f) by disclosing a tenant's personal identification details and alleged debt information to the tenant's workplace via email — a channel entirely unrelated to the legitimate purpose of resolving a rental dispute. This constitutes an unlawful disclosure of personal data to an unauthorised third party, breaching the principle of integrity and confidentiality. The action demonstrates a fundamental misunderstanding of what constitutes lawful data processing and the boundaries individuals must respect when handling others' personal information. Even in civil disputes, personal data cannot be weaponised or shared beyond the parties directly involved without a valid legal basis. This case underscores that GDPR obligations apply to individuals and private landlords, not just organisations.","**Immediate actions:**\n- Never share a third party's personal data (identification, financial details, debts) with unrelated parties such as employers without a clear legal basis.\n- Consult a legal professional before communicating personal data about another individual during a civil or contractual dispute.\n\n**Policy & awareness improvements:**\n- Landlords and property managers should receive basic GDPR training covering lawful bases for processing and restrictions on disclosing tenant data.\n- Establish clear internal guidelines specifying which parties may receive tenant information and under what circumstances (e.g., courts, debt collection agencies with proper mandate).\n- Document all communications involving personal data to demonstrate accountability and compliance if challenged.\n\n**Long-term compliance measures:**\n- Register with the relevant national data protection authority if processing personal data as part of a rental business activity.\n- Implement a minimal data-sharing principle: only share the minimum necessary data with only those parties who have a legitimate, lawful need.\n- Periodically review data handling practices against GDPR requirements, particularly Articles 5, 6, and 9, to ensure ongoing compliance.",[12,13,14,15,16,17,18,19],"GDPR Article 5(1)(f) — Integrity and Confidentiality","GDPR Article 5(1)(b) — Purpose Limitation","GDPR Article 5(1)(c) — Data Minimisation","GDPR Article 6 — Lawfulness of Processing","NIST SP 800-122 — Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)","CIS Control 3 — Data Protection","NIST Privacy Framework PR.DP-P4 — Data Processing Policies","ISO\u002FIEC 27001:2022 Annex A 5.34 — Privacy and Protection of PII",{},"published","2026-09-08T14:22:06.737512+00:00","2026-09-08T14:22:06.583+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-0035-2025&diff=52953&oldid=52945","aepd-spain-ps-0035-2025-8bb6e9","AEPD (Spain) - ps-0035-2025",[29,35,41],{"id":30,"name":31,"slug":32,"description":33,"color":34},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]