AEPD (Spain) - ps-0035-2025

Summary

Spain's AEPD has fined a landlord €160 for violating GDPR Article 5(1)(f). The landlord sent an email to the tenant's workplace, disclosing personal data including identification number, position, phone numbers, email, and details of an alleged debt. This information was accessed by the tenant's colleagues, constituting an unlawful disclosure.

Full text

Help AEPD (Spain) - ps-0035-2025: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 10:07, 3 September 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators294 edits Tag: Decisions [1.0] Latest revision as of 10:08, 3 September 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators294 editsTag: Visual edit Line 91: Line 91: On 4 October 2023, the controller sent an email to several addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone numbers, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues.On 4 October 2023, the controller sent an email to several addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone numbers, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues. On 6 October 2023, the controller sent another email to the workplace stating that it would cease further communications.On 6 October 2023, the controller sent another email to the workplace stating that it would cease further communications. The data subject lodged a complaint with the DPA. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller. The data subject lodged a complaint with the AEPD. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller. === Holding ====== Holding === The DPA held that the controller infringed [[Article 5 GDPR|Article 5(1)(f) GDPR]].The DPA held that the controller infringed [[Article 5 GDPR|Article 5(1)(f) GDPR]]. Latest revision as of 10:08, 3 September 2026 AEPD - ps-0035-2025 Authority: AEPD (Spain) Jurisdiction: Spain Relevant Law: Article 5(1)(f) GDPR Type: Complaint Outcome: Upheld Started: 24.05.2026 Decided: Published: 28.09.2026 Fine: 160.0 EUR Parties: n/a National Case Number/Name: ps-0035-2025 European Case Law Identifier: n/a Appeal: Unknown Original Language(s): Spanish Original Source: AEPD (in ES) Initial Contributor: bms The DPA held that a landlord violated Article 5(1)(f) GDPR by disclosing a tenant’s personal data and alleged debts to the tenant’s workplace. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The controller owned an apartment rented by the data subject, who had lived in the property since late 2021. Following a dispute concerning the tenancy and an alleged outstanding debt, the controller contacted the data subject about vacating the property. On 1 October 2023, the controller sent an email stating that, unless the data subject vacated the property and returned the keys, it would provide the data subject’s workplace with a report concerning the data subject’s alleged fraudulent and criminal conduct. On 4 October 2023, the controller sent an email to several addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone numbers, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues. On 6 October 2023, the controller sent another email to the workplace stating that it would cease further communications. The data subject lodged a complaint with the DPA. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller. Holding The DPA held that the controller infringed Article 5(1)(f) GDPR. The DPA considered that the information disclosed by the controller constituted personal data and that its communication to the data subject’s workplace amounted to processing under the GDPR. The controller determined the purposes and means of that processing and therefore acted as the controller. The DPA found that the controller disclosed the data subject’s personal data to unauthorised third parties. In particular, information relating to the data subject’s identity, contact details, employment and alleged debts was communicated to colleagues at the data subject’s workplace. Such disclosure breached the principle of integrity and confidentiality under Article 5(1)(f) GDPR. Taking into account the circumstances of the case, including the consequences for the data subject and the controller’s subsequent commitment to cease such communications, the DPA imposed a €200 administrative fine. Before the final decision was issued, the controller voluntarily paid the proposed fine and benefited from the 20% reduction available under Spanish Administrative Law (39/2015). The amount payable was therefore reduced to €160. The DPA nevertheless formally declared the infringement and confirmed the €200 sanction before terminating the proceedings following the voluntary payment. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. Case No.: EXP202403237 DECISION TO TERMINATE THE PROCEEDINGS DUE TO VOLUNTARY PAYMENT Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On November 23, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate disciplinary proceedings against A.A.A. (hereinafter, A.A.A.). Following notification of the decision to initiate proceedings, on April 30, 2026, the proposed resolution set forth below was issued: << Case No.: EXP202403237 PROPOSED RESOLUTION IN DISCIPLINARY PROCEEDINGS Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following: BACKGROUND FIRST: On May 24, 2024, a complaint was filed with the Spanish Data Protection Agency regarding a possible violation attributable to A.A.A., with Tax ID No. ***NIF.1 (hereinafter, A.A.A. or the respondent). The facts brought to the attention of this authority are as follows: The complainant states that they rented a residence owned by the respondent and that, following disagreements, they chose to terminate the lease agreement. The respondent is making a complaint and is demanding payment of a debt related to the rent and states that it has disclosed information regarding this alleged delinquency to third parties, having contacted the complainant via a third party’s WhatsApp account to demand payment of the amount allegedly owed and receiving threats that the situation would be disclosed in the claimant’s workplace. Thus, on October 4, 2023, the defendant sent an email addressed to ***POSITION.1, given that the plaintiff is (…), explaining the situation C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 2/13 of alleged delinquency and accusing them of criminal conduct, which was brought to their attention by the institutional relations department at their workplace. He notes that, subsequently, on October 6, 2023, the respondent sent another email to his workplace, retracting its statements regarding the complainant’s alleged criminal conduct. Attached to his complaint are: - A copy of the

Entities