[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvq3UNMGJhIWeWutp4fZsLTF_ro7MzM3oK_nobATDXaw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":47,"controls":48},"bb34b0fd-1f9e-4235-8bbd-1c85bd797415","spanish-council-fined-for-improper-disposal-of-exam-documents-containing-personal-data","b2419587-f1c0-4c1c-8aa0-68cc27a36cee","Spanish Council Fined for Improper Disposal of Exam Documents Containing Personal Data","The Canals City Council failed to implement adequate physical data destruction procedures for exam papers containing sensitive personal data, including national identification numbers and exam results. These documents were discarded next to waste containers rather than being securely destroyed, allowing third parties to access and even publish the information on social media. This incident highlights that data protection obligations extend fully to physical documents, not just digital records. The breach violated GDPR Article 5(1)(f), which mandates appropriate security to prevent unauthorised access, demonstrating that even small public bodies must enforce strict end-of-life data handling policies.","**Immediate actions:**\n- Establish a mandatory secure document destruction policy requiring all documents containing personal data to be shredded or incinerated before disposal.\n- Audit all existing physical document handling workflows to identify and remediate gaps in destruction procedures.\n\n**Long-term improvements:**\n- Implement a formal Records Retention and Disposal Schedule that defines retention periods and approved destruction methods for every document category holding personal data.\n- Procure certified on-site or third-party document destruction services and maintain certificates of destruction for audit purposes.\n- Introduce role-specific training on physical data handling obligations under GDPR for all staff who process personal data in paper form.\n\n**Detection & oversight measures:**\n- Conduct periodic spot-checks and internal audits of document disposal areas to verify compliance with destruction procedures.\n- Designate a Data Protection Officer (or equivalent) responsibility to oversee physical data disposal compliance and report incidents promptly.",[12,13,14,15,16,17,18,19],"GDPR Article 5(1)(f) – Integrity and Confidentiality","GDPR Article 24 – Responsibility of the Controller","GDPR Article 32 – Security of Processing","NIST SP 800-88 Rev. 1 – Guidelines for Media Sanitisation","CIS Control 3.7 – Securely Dispose of Data","ISO\u002FIEC 27001:2022 – Annex A 7.10 (Storage Media) & A 8.10 (Information Deletion)","ITIL Service Design – Information Security Management (Physical Asset Disposal)","LOPDGDD (Spain) – Ley Orgánica 3\u002F2018, complementing GDPR obligations for public authorities",{},"published","2026-08-26T16:21:40.159439+00:00","2026-08-26T16:21:39.887+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00506-2026&diff=52811&oldid=0","aepd-spain-ps-00506-2026-a4b749","AEPD (Spain) - PS-00506-2026",[29,35,41],{"id":30,"name":31,"slug":32,"description":33,"color":34},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[49],{"slug":50,"name":51,"problem":52},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]