AEPD (Spain) - ps-0035-2025
Spain's AEPD fines landlord €160 for disclosing tenant's debt to workplace.
Spain's data protection authority (AEPD) has fined a landlord €160 for violating GDPR Article 5(1)(f). The landlord disclosed a tenant's personal data, including identification details and alleged debts, to the tenant's workplace via email. This action was taken after the tenant failed to vacate a property and return keys following a dispute.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Spanish landlord violated GDPR Article 5(1)(f) by disclosing a tenant's personal identification details and alleged debt information to the tenant's workplace via email — a channel entirely unrelated to the legitimate purpose of resolving a rental dispute. This constitutes an unlawful disclosure of personal data to an unauthorised third party, breaching the principle of integrity and confidentiality. The action demonstrates a fundamental misunderstanding of what constitutes lawful data processing and the boundaries individuals must respect when handling others' personal information. Even in civil disputes, personal data cannot be weaponised or shared beyond the parties directly involved without a valid legal basis. This case underscores that GDPR obligations apply to individuals and private landlords, not just organisations.