[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f86BqTWTlnTmGMZ14ILS6f8Sb61Xio20r4DLhL-RNvNs":3},{"article":4,"iocs":44},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":26},"270415de-9b03-4eb4-8dbb-db5a360b8537","AEPD (Spain) - ps-0035-2025","aepd-spain-ps-0035-2025-26b1a9","Created page with \"{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color= |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=ps-0035-2025 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00035-2025.pdf |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint |...\" Show changes","Spain's data protection authority (AEPD) has fined a landlord €160 for violating GDPR by disclosing a tenant's personal data, including alleged debts and identification details, to the tenant's workplace. The landlord had threatened to send this information if the tenant did not vacate the apartment and return the keys. The AEPD found this disclosure breached the principle of integrity and confidentiality under Article 5(1)(f) GDPR.","Spain's AEPD fines landlord €160 for disclosing tenant's personal data to workplace.","Help AEPD (Spain) - ps-0035-2025: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 10:07, 3 September 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators294 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 10:07, 3 September 2026 AEPD - ps-0035-2025 Authority: AEPD (Spain) Jurisdiction: Spain Relevant Law: Article 5(1)(f) GDPR Type: Complaint Outcome: Upheld Started: 24.05.2026 Decided: Published: 28.09.2026 Fine: 160.0 EUR Parties: n\u002Fa National Case Number\u002FName: ps-0035-2025 European Case Law Identifier: n\u002Fa Appeal: Unknown Original Language(s): Spanish Original Source: AEPD (in ES) Initial Contributor: bms The DPA held that a landlord violated Article 5(1)(f) GDPR by disclosing a tenant’s personal data and alleged debts to the tenant’s workplace. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The controller owned an apartment rented by the data subject, who had lived in the property since late 2021. Following a dispute concerning the tenancy and an alleged outstanding debt, the controller contacted the data subject about vacating the property. On 1 October 2023, the controller sent an email stating that, unless the data subject vacated the property and returned the keys, it would provide the data subject’s workplace with a report concerning the data subject’s alleged fraudulent and criminal conduct. On 4 October 2023, the controller sent an email to several addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone numbers, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues. On 6 October 2023, the controller sent another email to the workplace stating that it would cease further communications. The data subject lodged a complaint with the AEPD. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller. Holding The DPA held that the controller infringed Article 5(1)(f) GDPR. The DPA considered that the information disclosed by the controller constituted personal data and that its communication to the data subject’s workplace amounted to processing under the GDPR. The controller determined the purposes and means of that processing and therefore acted as the controller. The DPA found that the controller disclosed the data subject’s personal data to unauthorised third parties. In particular, information relating to the data subject’s identity, contact details, employment and alleged debts was communicated to colleagues at the data subject’s workplace. Such disclosure breached the principle of integrity and confidentiality under Article 5(1)(f) GDPR. Taking into account the circumstances of the case, including the consequences for the data subject and the controller’s subsequent commitment to cease such communications, the DPA imposed a €200 administrative fine. Before the final decision was issued, the controller voluntarily paid the proposed fine and benefited from the 20% reduction available under Spanish Administrative Law (39\u002F2015). The amount payable was therefore reduced to €160. The DPA nevertheless formally declared the infringement and confirmed the €200 sanction before terminating the proceedings following the voluntary payment. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. Case No.: EXP202403237 DECISION TO TERMINATE THE PROCEEDINGS DUE TO VOLUNTARY PAYMENT Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On November 23, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate disciplinary proceedings against A.A.A. (hereinafter, A.A.A.). Following notification of the decision to initiate proceedings, on April 30, 2026, the proposed resolution set forth below was issued: \u003C\u003C Case No.: EXP202403237 PROPOSED RESOLUTION IN DISCIPLINARY PROCEEDINGS Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following: BACKGROUND FIRST: On May 24, 2024, a complaint was filed with the Spanish Data Protection Agency regarding a possible violation attributable to A.A.A., with Tax ID No. ***NIF.1 (hereinafter, A.A.A. or the respondent). The facts brought to the attention of this authority are as follows: The complainant states that they rented a residence owned by the respondent and that, following disagreements, they chose to terminate the lease agreement. The respondent is making a complaint and is demanding payment of a debt related to the rent and states that it has disclosed information regarding this alleged delinquency to third parties, having contacted the complainant via a third party’s WhatsApp account to demand payment of the amount allegedly owed and receiving threats that the situation would be disclosed in the claimant’s workplace. Thus, on October 4, 2023, the defendant sent an email addressed to ***POSITION.1, given that the plaintiff is (…), explaining the situation C\u002F Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 2\u002F13 of alleged delinquency and accusing them of criminal conduct, which was brought to their attention by the institutional relations department at their workplace. He notes that, subsequently, on October 6, 2023, the respondent sent another email to his workplace, retracting its statements regarding the complainant’s alleged criminal conduct. Attached to his complaint are: - A copy of the WhatsApp message received, which states, among other things, the following: “(…). (…) (…)”. - Copies of the emails: a. Email dated October 1, 2023, at 3:52 a.m. “ (…) (…). (…)”. b. Email dated October 4, 2023, at 2:26 a.m. “(…) (…) (…), (…) (…) (…) (…), (…). (…). (…). (…): - (…). - (…). - (…). - (…). (…). C\u002F Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 3\u002F13 (…)”. c. Email dated October 6, 2023 “(…) (…): (…)”. SECOND: Pursuant to Article 65.4 of Organic Law 3\u002F2018, of December 5, on data protection and the Guarantee of Digital Rights (hereinafter hereinafter LOPDGDD), said complaint was forwarded to A.A.A. so that it could analyze it and inform this Agency, within one month, of the actions taken to comply with the requirements set forth in the data protection regulations. The forwarding of the complaint, which was carried out in accordance with the rules established in Law 39\u002F2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), was not acknowledged by the data controller. The first attempt to deliver the complaint was made on March 1, 2024, resulting in “returned to sender due to missing address” on April 24, 2024, as certified by the notice of non-delivery included in the case file. The second attempt was made on April 26, 2024, resulting in “Returned to Origin due to Incorrect Address on May 7, 2024,” according to the certification of failure to deliver included in the file. THIRD: On May 10, 2024, in accordance with Article 65 of the LOPDGDD, the complaint was dismissed. FOURTH: On May 24, 2024, the claimant filed an appeal for reconsideration against the refusal to accept the complaint for processing, on the grounds that it seriously violated their fundamental rights. FIFTH: On September 10, 2024, a notice was sent to A.A.A., granting him a hearing regarding the appeal for reconsideration. The first attempt to deliver the noti","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-0035-2025&diff=52904&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-09-03T10:07:36+00:00","2026-09-03T12:00:25.917657+00:00",7,[18],{"name":19,"type":20},"AEPD","vendor","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":21,"icon":23,"name":24,"slug":25},null,"GDPR","gdpr",[27,29,34,39],{"category":28},{"id":21,"icon":23,"name":24,"slug":25},{"category":30},{"id":31,"icon":23,"name":32,"slug":33},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":35},{"id":36,"icon":23,"name":37,"slug":38},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":40},{"id":41,"icon":23,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]