[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0nZb2jXUzZGwysSHfrh8nls741xUswHmEBFlyx2nf0s":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":49},"aa2a6906-070d-4fce-a3e9-ad5587447a76","spanish-notary-fined-for-sharing-cadastral-data-without-legal-basis","1239c523-8c4d-4d2c-8d66-8c9beb78d345","Spanish Notary Fined for Sharing Cadastral Data Without Legal Basis","A Spanish notary disclosed a data subject's personal cadastral data — including name and address — to a third-party client without establishing a valid legal basis under GDPR, resulting in a €2,000 fine from Spain's AEPD. The core failure was treating access to professional data tools as implicit authorisation to share that data with clients, conflating technical ability with legal permission. This case highlights that professionals handling personal data on behalf of clients must independently verify lawful grounds for each disclosure. Even seemingly routine property transaction activities can constitute serious GDPR violations when proper data-sharing controls are absent.","**Immediate actions:**\n- Establish and document a lawful basis assessment process before any personal data is disclosed to clients or third parties.\n- Train all staff and licensed professionals on the distinction between accessing data internally and lawfully sharing it externally.\n\n**Policy & Governance improvements:**\n- Implement a formal Data Protection Policy that explicitly governs when cadastral or third-party personal data may be shared, and with whom.\n- Appoint or designate a Data Protection Officer (or advisor) responsible for reviewing data-sharing requests in professional practice settings.\n- Create a data disclosure register to log every instance of personal data shared with external parties, including the legal basis cited.\n\n**Detection & Accountability measures:**\n- Conduct periodic internal audits of data-sharing practices to identify disclosures lacking documented legal bases.\n- Establish a clear complaints-handling procedure so that data subject concerns are escalated and remediated before regulatory intervention.",[12,13,14,15,16,17,18,19,20],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 6 – Lawfulness of processing","GDPR Article 13\u002F14 – Information obligations to data subjects","GDPR Article 58 – Supervisory authority corrective powers","NIST Privacy Framework PR.PO-P1 – Policies and procedures for data processing","NIST SP 800-53 AC-3 – Access Enforcement","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27001 A.18.1.4 – Privacy and protection of personally identifiable information",{},"published","2026-09-03T12:22:44.970495+00:00","2026-09-03T12:22:43.68+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-00256-2025&diff=52903&oldid=52902","aepd-spain-ps-00256-2025-cb1772","AEPD (Spain) - ps-00256-2025",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":43,"name":44,"slug":45,"description":46,"color":47},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]