AEPD (Spain) - ps-0035-2025

Summary

Spain's data protection authority (AEPD) has fined a landlord €160 for violating GDPR Article 5(1)(f). The landlord disclosed a tenant's personal data, including identification details and alleged debts, to the tenant's workplace via email. This action was taken after the tenant failed to vacate a property and return keys following a dispute.

Full text

Help AEPD (Spain) - ps-0035-2025: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editNewer edit →VisualWikitext Revision as of 09:59, 8 September 2026 view sourceLs (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators396 editsmTag: Visual edit← Older edit Revision as of 12:39, 8 September 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators303 editsTag: Visual editNewer edit → Line 89: Line 89: On 1 October 2023, the controller sent an email stating that, unless the data subject vacated the property and returned the keys, it would provide the data subject’s workplace with a report concerning the data subject’s alleged fraudulent and criminal conduct.On 1 October 2023, the controller sent an email stating that, unless the data subject vacated the property and returned the keys, it would provide the data subject’s workplace with a report concerning the data subject’s alleged fraudulent and criminal conduct. On 4 October 2023, the controller sent an email to several email addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone numbers, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues. On 4 October 2023, the controller sent an email to several email addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone number, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues. The controller then followed-up, on 6 October 2023, with another email stating that it would cease further communications. The controller then followed-up, on 6 October 2023, with another email both the company and the data subject stating that it would cease further communications. The data subject lodged a complaint with the DPA. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller.The data subject lodged a complaint with the DPA. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal to the DPA. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller. === Holding ====== Holding === The DPA held that the controller infringed [[Article 5 GDPR|Article 5(1)(f) GDPR]].The DPA held that the controller infringed [[Article 5 GDPR|Article 5(1)(f) GDPR]]. Revision as of 12:39, 8 September 2026 AEPD - ps-0035-2025 Authority: AEPD (Spain) Jurisdiction: Spain Relevant Law: Article 5(1)(f) GDPR Type: Complaint Outcome: Upheld Started: 24.05.2026 Decided: Published: 28.09.2026 Fine: 160.0 EUR Parties: n/a National Case Number/Name: ps-0035-2025 European Case Law Identifier: n/a Appeal: Unknown Original Language(s): Spanish Original Source: AEPD (in ES) Initial Contributor: bms The DPA held that a landlord violated Article 5(1)(f) GDPR by disclosing a tenant’s personal data and alleged debts to the tenant’s workplace. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The controller owned an apartment rented by the data subject, who had lived in the property since late 2021. Following a dispute concerning the tenancy and an alleged outstanding debt, the controller asked the data subject to leave the property. On 1 October 2023, the controller sent an email stating that, unless the data subject vacated the property and returned the keys, it would provide the data subject’s workplace with a report concerning the data subject’s alleged fraudulent and criminal conduct. On 4 October 2023, the controller sent an email to several email addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone number, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues. The controller then followed-up, on 6 October 2023, with another email both the company and the data subject stating that it would cease further communications. The data subject lodged a complaint with the DPA. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal to the DPA. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller. Holding The DPA held that the controller infringed Article 5(1)(f) GDPR. The DPA considered that (i) the landlord determined the purposes and means of that processing and therefore acted as the controller; (ii) the information disclosed by the controller constituted personal data; (iii) its communication to the data subject’s workplace qualified as processing under the GDPR; and (iv) that colleagues qualified as unauthorised third parties. The DPA then found that the disclosure to the data subject's colleagues of information relating to the data subject’s identity, contact details, employment and alleged debts breached the principle of integrity and confidentiality under Article 5(1)(f) GDPR. (comment LS: This could also, edited a bit, be the short summary) Taking into account the circumstances of the case, including the consequences for the data subject and the controller’s subsequent commitment to cease such communications, the DPA imposed a €200 administrative fine. Before the final decision was issued, the controller voluntarily paid the proposed fine and benefited from the 20% reduction available under Spanish Administrative Law (39/2015). The amount payable was therefore reduced to €160. The DPA nevertheless formally declared the infringement and confirmed the €200 sanction before terminating the proceedings following the voluntary payment. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. Case No.: EXP202403237 DECISION TO TERMINATE THE PROCEEDINGS DUE TO VOLUNTARY PAYMENT Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On November 23, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate disciplinary proceedings against A.A.A. (hereinafter, A.A.A.). Following notification of the decision to initiate proceedings, on April 30, 2026, the proposed resolution set forth below was issued: << Case No.: EXP202403237 PROPOSED RESOLUTION IN DISCIPLINARY PROCEEDINGS Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following: BACKGROUND FIRST: On May 24, 2024, a complaint was filed with the Spanish Data Protection Agency regarding a possible violation attributable to A.A.A., with Tax ID No. ***NIF.1 (hereinafter, A.A.A. or the respondent). The facts brought to the attention of this authority are as follows: The complainant states that they rented a residence owned by the respondent and that, following disagreements, they chose to terminate the lease agreement. The respondent is making a complaint and is demanding payment of a debt related to the rent and states that it has disclosed information regarding this alleged delinquency to third parties, having contacted the complainant via a third party’s WhatsApp account to demand payment of the amount allegedly owed and receiving t

Entities