[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAhaVIfoFZwDvv8zHRReDwy0AbH7SrUY22ez-lREEhSg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"d1cd8384-d554-486d-acce-3ea42a4efd40","notary-fined-for-unlawful-disclosure-of-personal-data-without-legal-basis","b5b0882e-bd6b-45b5-9059-37a115e7f34d","Notary Fined for Unlawful Disclosure of Personal Data Without Legal Basis","A Spanish notary disclosed a cadastral certificate containing personal data to a third-party client without a valid legal basis under GDPR Article 6(1), despite the client's stated intention being a property negotiation. While notaries may access certain data in the course of their official duties, that access right does not automatically authorize sharing complete personal records with private parties for purposes outside their official competences. This case highlights a critical distinction between lawful access to data and lawful disclosure of that data — they require separate and independent legal justifications. The violation matters because even well-intentioned data sharing, such as facilitating a legitimate property transaction, can constitute a serious breach if the proper legal basis is not established before disclosure.","**Immediate actions:**\n- Establish and enforce a written data-sharing policy that requires staff to verify a documented legal basis before disclosing any personal data to third parties.\n- Conduct an urgent review of all current data-disclosure practices to identify any instances where personal records are shared without an explicit legal basis.\n\n**Process & Governance improvements:**\n- Implement a formal data-request approval workflow that requires sign-off confirming lawful basis (e.g., consent, legal obligation, legitimate interest) before any personal data leaves the organization.\n- Maintain a data-sharing register documenting who received personal data, under what legal basis, and for what stated purpose.\n- Clearly define and communicate the boundaries of role-based data access versus data disclosure rights for all staff handling personal records.\n\n**Training & Awareness measures:**\n- Deliver mandatory GDPR training to all staff that explicitly distinguishes between the right to *access* personal data and the right to *disclose* it to third parties.\n- Run periodic scenario-based refresher exercises covering common high-risk situations, such as client requests for documents containing third-party personal information.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 6(1) — Lawfulness of processing","GDPR Article 5(1)(b) — Purpose limitation principle","GDPR Article 5(1)(f) — Integrity and confidentiality principle","NIST SP 800-53 AC-3 — Access Enforcement","NIST SP 800-53 AC-22 — Publicly Accessible Content","NIST SP 800-53 PM-25 — Minimization of Personally Identifiable Information","CIS Control 3 — Data Protection (Safeguard 3.1: Establish and Maintain a Data Management Process)","CIS Control 4 — Secure Configuration of Enterprise Assets and Software","ISO\u002FIEC 29101 — Privacy Architecture Framework","ITIL Service Design — Information Security Management (data classification and handling)",{},"published","2026-09-08T10:20:42.238812+00:00","2026-09-08T10:20:42.155+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-00256-2025&diff=52943&oldid=52903","aepd-spain-ps-00256-2025-a3e601","AEPD (Spain) - ps-00256-2025",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]