Spanish Notary Fined for Sharing Cadastral Data Without Legal Basis

Written by AI from the linked story. Not reviewed by an editor. How this works

A Spanish notary disclosed a data subject's personal cadastral data — including name and address — to a third-party client without establishing a valid legal basis under GDPR, resulting in a €2,000 fine from Spain's AEPD. The core failure was treating access to professional data tools as implicit authorisation to share that data with clients, conflating technical ability with legal permission. This case highlights that professionals handling personal data on behalf of clients must independently verify lawful grounds for each disclosure. Even seemingly routine property transaction activities can constitute serious GDPR violations when proper data-sharing controls are absent.

Tactical Insight

Immediate actions

Establish and document a lawful basis assessment process before any personal data is disclosed to clients or third parties.
Train all staff and licensed professionals on the distinction between accessing data internally and lawfully sharing it externally.

Policy & Governance improvements

Implement a formal Data Protection Policy that explicitly governs when cadastral or third-party personal data may be shared, and with whom.
Appoint or designate a Data Protection Officer (or advisor) responsible for reviewing data-sharing requests in professional practice settings.
Create a data disclosure register to log every instance of personal data shared with external parties, including the legal basis cited.

Detection & Accountability measures

Conduct periodic internal audits of data-sharing practices to identify disclosures lacking documented legal bases.
Establish a clear complaints-handling procedure so that data subject concerns are escalated and remediated before regulatory intervention.