AEPD (Spain) - PS-00506-2026

Summary

Spain's Data Protection Agency (AEPD) ruled that the Canals City Council violated GDPR Article 5(1)(f) by failing to properly destroy exam papers containing personal data. The documents, which included names, national identification numbers, and exam results of three participants, were found discarded next to waste containers and were subsequently accessed by third parties, with some even published on social media. While the council acknowledged the error and revised its procedures, the AEPD formally declared the infringement but did not impose a fine due to the entity being a local public authority and having already taken corrective measures.

Full text

Help AEPD (Spain) - PS-00506-2026: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 14:39, 26 August 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators282 edits Tag: Decisions [1.0] (No difference) Latest revision as of 14:39, 26 August 2026 AEPD - PS-00506-2026 Authority: AEPD (Spain) Jurisdiction: Spain Relevant Law: Article 5(1)(f) GDPR Type: Complaint Outcome: Upheld Started: 05.11.2025 Decided: Published: 25.08.2026 Fine: n/a Parties: Ajuntament de Canals National Case Number/Name: PS-00506-2026 European Case Law Identifier: n/a Appeal: Unknown Original Language(s): Spanish Original Source: AEPD (in ES) Initial Contributor: bms The DPA held that a municipality violated Article 5(1)(f) GDPR after examination papers containing personal data were disposed of without being destroyed and subsequently accessed by third parties. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The DPA became aware that examination papers from an employment-training programme managed by Canals City Council, the controller, had been found next to waste containers in a public area. The documents concerned three participants and contained their names, surnames, national identification numbers and exam results. The papers had not been destroyed before disposal and were accessible to passers-by. Photographs of some of the documents were also published on social media. The controller explained that the documents had been set aside for shredding but were mistakenly placed in the general waste. It acknowledged the incident and subsequently revised its document-disposal procedure. Holding The DPA found that the controller had violated Article 5(1)(f) GDPR. The DPA considered that the controller had failed to ensure an appropriate level of confidentiality when disposing of documents containing personal data. Although an internal procedure required the documents to be shredded before being discarded, this procedure was not followed. As a result, the examination papers remained readable and could be accessed by unauthorised third parties. Their subsequent publication on social media further demonstrated that the confidentiality of the data had been compromised. Therefore, the DPA concluded that the controller had not adequately protected the personal data against unauthorised access or disclosure, in breach of the integrity and confidentiality principle under Article 5(1)(f) GDPR. Since the controller was a local public authority, the special regime under Article 77 LOPDGDD applied. Accordingly, the DPA formally declared the infringement but did not impose an administrative fine. It also refrained from ordering additional corrective measures, as the controller had already revised its document-disposal procedures following the incident. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. Case No.: EXP202408290 DECISION ON DISCIPLINARY PROCEEDINGS Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following: BACKGROUND FIRST: The Spanish Data Protection Agency has become aware of certain facts that could constitute a possible violation attributable to THE CITY COUNCIL OF CANALS, with Tax ID No. P4608300B, hereinafter referred to as the CITY COUNCIL. The facts brought to the attention of this authority were as follows: It is alleged that, on May 1, 2024, documentation containing personal data was found abandoned in a next to some trash bins located on Camí Les Moles Street in the town of Canals, Valencia. This documentation contains personal data and originated from training courses offered by the Canals City Council, subsidized by the Valencian Employment Service. The documents belong to individuals participating in an employment workshop organized by the Valencian Employment and Training Service (LABORA) and administered by the Canals City Council Canals and l’Alcudia (Valencia). Attached are images of the abandoned documents, a copy of an exam found at that location, and a message posted on social media by a User of that platform regarding the abandoned documents. Initially, the following documentation is available: - Photographs showing several pages of exams on the ground. - Photographs of exams belonging to three people, showing their first names, last names, ID numbers, and scores, scattered on the ground. - A photograph of two trash containers, with printed sheets of paper and trash bags scattered on the ground around them. - A photograph of a social media post, (…) … In it, A.A.A. writes on May 5, “I am writing to the Canals City Council. Yesterday, on Labor Day, while walking near Curtitex, I saw exam papers scattered among the grass. When I reached the area near the trash containers, there were torn trash bags, boxes, and sacks—everything was outside the containers and covered in job application forms with names, ID numbers, and exam scores dated (…)—all from students from the vocational school. But around 6 p.m., I returned, and some were still there. How can they throw away exams with names and ID numbers? That’s not allowed. Where is data protection? What kind of people does the city council hire who don’t know there are special containers and that the waste must be shredded? The responsible person should go and see the mess that’s there” (attached: C/ Jorge Juan 6 www.aepd.es 28001 - Madrid sedeaepd.gob.es 2/10 photographs of the documents found on the ground and around the container). SECOND: As a result of the known facts, on June 6, 2024, the Director of the Spanish Data Protection Agency urged the Subdirectorate General for Data Inspection (SGID) to initiate the preliminary investigative proceedings referred to in Article 67 of Organic Law 3/2018, of December 5, on data protection and the Guarantee of Digital Rights (hereinafter “LOPDGDD”). THIRD: The Subdirectorate General for Data Inspection proceeded to conduct preliminary investigative proceedings to clarify the facts in question, pursuant to the functions assigned to supervisory authorities under Article 57.1 and the powers granted under Article 58.1 of Regulation (EU) 2016/679 (GDPR), and in accordance with the provisions of Title VIII of the LOPDGDD. On October 14, 2024, a request for information was sent to LABORA VALENCIAN EMPLOYMENT AND TRAINING SERVICE (LABORA), requesting information on the actions taken to comply with the requirements set forth in data protection regulations. On November 4, 2024, LABORA submitted a written response to the aforementioned request, in which it stated, in summary, that: LABORA approved the call for applications for the Joint Employment-Training Program “Employment Workshops” in accordance with Order 6/2020, dated December 7, of the Regional Ministry of Sustainable Economy, Productive Sectors, Commerce, and Labor, which approves the program’s regulatory framework. (DOGV No. 9,511, dated January 13, 2023), for the implementation of these projects. The Canals City Council applied for grants from the “Talleres de Empleo” mixed employment-training program. As a result, the Director General of Employment and Training decided to grant the Canals City Council a subsidy for the implementation of the project titled “T.E. EL TORREO IX.” LABORA states that it is the CITY COUNCIL, as the local entity, that develops and manages the project and is responsible for the documentation and data referred to in your letter; therefore, we are forwarding this letter with the purpose of allowing the City Council to appropriately address the issues raised. On November 7, 2024, the CITY COUNCIL submitted a letter in which it states: - That on (…)

Entities