[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbosrBZELOm8r0MjPfZuzIAhjrCAD4GQxIrWIwX04QhU":3},{"article":4,"iocs":52},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":30,"category":31,"article_tags":35},"b2419587-f1c0-4c1c-8aa0-68cc27a36cee","AEPD (Spain) - PS-00506-2026","aepd-spain-ps-00506-2026-a4b749","Created page with \"{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color= |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS-00506-2026 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00506-2025.pdf |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint...\" New page {{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color= |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS-00506-2026 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00506-2025.pdf |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint |Outcome=Upheld |Date_Started=05.11.2025 |Date_Decided= |Date_Published=25.08.2026 |Year=2026 |Fine= |Currency= |GDPR_Article_1=Article 5(1)(f) GDPR |GDPR_Article_Link_1=Article 5 GDPR#1f |GDPR_Article_2= |GDPR_Article_Link_2= |GDPR_Article_3= |GDPR_Article_Link_3= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1=Ajuntament de Canals |Party_Link_1=https:\u002F\u002Fcanals.es\u002F |Party_Name_2= |Party_Link_2= |Party_Name_3= |Party_Link_3= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status=Unknown |Appeal_To_Link= |Initial_Contributor=bms | }} The DPA held that a municipality violated [[Article 5 GDPR|Article 5(1)(f) GDPR]] after examination papers containing personal data were disposed of without being destroyed and subsequently accessed by third parties. == English Summary == === Facts === The DPA became aware that examination papers from an employment-training programme managed by Canals City Council, the controller, had been found next to waste containers in a public area. The documents concerned three participants and contained their names, surnames, national identification numbers and exam results. The papers had not been destroyed before disposal and were accessible to passers-by. Photographs of some of the documents were also published on social media. The controller explained that the documents had been set aside for shredding but were mistakenly placed in the general waste. It acknowledged the incident and subsequently revised its document-disposal procedure. === Holding === The DPA found that the controller had violated [[Article 5 GDPR|Article 5(1)(f) GDPR]]. The DPA considered that the controller had failed to ensure an appropriate level of confidentiality when disposing of documents containing personal data. Although an internal procedure required the documents to be shredded before being discarded, this procedure was not followed. As a result, the examination papers remained readable and could be accessed by unauthorised third parties. Their subsequent publication on social media further demonstrated that the confidentiality of the data had been compromised. Therefore, the DPA concluded that the controller had not adequately protected the personal data against unauthorised access or disclosure, in breach of the integrity and confidentiality principle under [[Article 5 GDPR|Article 5(1)(f) GDPR]]. Since the controller was a local public authority, the special regime under Article 77 LOPDGDD applied. Accordingly, the DPA formally declared the infringement but did not impose an administrative fine. It also refrained from ordering additional corrective measures, as the controller had already revised its document-disposal procedures following the incident. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. Case No.: EXP202408290 DECISION ON DISCIPLINARY PROCEEDINGS Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following: BACKGROUND FIRST: The Spanish Data Protection Agency has become aware of certain facts that could constitute a possible violation attributable to THE CITY COUNCIL OF CANALS, with Tax ID No. P4608300B, hereinafter referred to as the CITY COUNCIL. The facts brought to the attention of this authority were as follows: It is alleged that, on May 1, 2024, documentation containing personal data was found abandoned in a next to some trash bins located on Camí Les Moles Street in the town of Canals, Valencia. This documentation contains personal data and originated from training courses offered by the Canals City Council, subsidized by the Valencian Employment Service. The documents belong to individuals participating in an employment workshop organized by the Valencian Employment and Training Service (LABORA) and administered by the Canals City Council Canals and l’Alcudia (Valencia). Attached are images of the abandoned documents, a copy of an exam found at that location, and a message posted on social media by a User of that platform regarding the abandoned documents. Initially, the following documentation is available: - Photographs showing several pages of exams on the ground. - Photographs of exams belonging to three people, showing their first names, last names, ID numbers, and scores, scattered on the ground. - A photograph of two trash containers, with printed sheets of paper and trash bags scattered on the ground around them. - A photograph of a social media post, (…) … In it, A.A.A. writes on May 5, “I am writing to the Canals City Council. Yesterday, on Labor Day, while walking near Curtitex, I saw exam papers scattered among the grass. When I reached the area near the trash containers, there were torn trash bags, boxes, and sacks—everything was outside the containers and covered in job application forms with names, ID numbers, and exam scores dated (…)—all from students from the vocational school. But around 6 p.m., I returned, and some were still there. How can they throw away exams with names and ID numbers? That’s not allowed. Where is data protection? What kind of people does the city council hire who don’t know there are special containers and that the waste must be shredded? The responsible person should go and see the mess that’s there” (attached: C\u002F Jorge Juan 6 www.aepd.es 28001 - Madrid sedeaepd.gob.es 2\u002F10 photographs of the documents found on the ground and around the container). SECOND: As a result of the known facts, on June 6, 2024, the Director of the Spanish Data Protection Agency urged the Subdirectorate General for Data Inspection (SGID) to initiate the preliminary investigative proceedings referred to in Article 67 of Organic Law 3\u002F2018, of December 5, on data protection and the Guarantee of Digital Rights (hereinafter “LOPDGDD”). THIRD: The Subdirectorate General for Data Inspection proceeded to conduct preliminary investigative proceedings to clarify the facts in question, pursuant to the functions assigned to supervisory authorities under Article 57.1 and the powers granted under Article 58.1 of Regulation (EU) 2016\u002F679 (GDPR), and in accordance with the provisions of Title VIII of the LOPDGDD. On October 14, 2024, a request for information was sent to LABORA VALENCIAN EMPLOYMENT AND TRAINING SERVICE (LABORA), requesting information on the actions taken to comply with the requirements set forth in data protection regulations. On November 4, 2024, LABORA submitted a written response to the aforementioned request, in which it stated, in summary, that: LABORA approved the call for applications for the Joint Employment-Training Program “Employment Workshops” in accordance with Order 6\u002F2020, dated December 7, of the Regional Ministry of Sustainable Economy, Productive Sectors, Commerce, and Labor, which approves the program’s regulatory framework. (DOGV No. 9,511, dated January 13, 2023), for the implementation of these projects. The Canals City Council applied for grants from the “Talleres de Empleo” mixed employment-training program. As a result, the Director General of Employment and Training decided to grant the Canals City Council a subsidy for the implementation of the project titled “T.E. EL TORREO IX.” LABORA states that it is the CITY COUNCIL, as the local entity, that develops and manages the project and is responsible for the documentation and data referred to in your letter; therefore, we are forwarding this letter with the purpose of allowing the City Council to appropriately address the issues raised. On November 7, 2024, the CITY COUNCIL submitted a letter in which it states: - That on (…), at the El Torreo IX Employment Workshop, in the specialty of auxiliary activities for forest conservation and improvement—comprising 10 student workers—a mock exam was conducted to reinforce the dynamics (…), in in preparation for the final exam. - That, once the tests were completed, the documents were left in the classroom on a side table to be shredded, using the paper shredder, since there is only one for the entire center and shredding is not done immediately. C\u002F Jorge Juan 6 www.aepd.es 28001 - Madrid sedeaepd.gob.es 3\u002F10 - That due to a “possible” mix-up, the exam papers ended up in the wastebasket and ultimately in the trash bin. - That the protocol normally followed is: o Shred the paper. o Dispose of it in the wastebasket. o The wastebasket is collected by the cleaning services, which, with the bags sealed, dispose of them in the dumpster. - That on May 1, a holiday, it was reported that outside the dumpster in front of the center, the undestroyed exam papers were found in open trash bags, facts that were shared on social media and reported to City Hall. - That, upon learning of the facts, the school administration investigated how it was possible for the aforementioned exam papers to appear undestroyed, outside the garbage bags and outside the dumpster. It was confirmed that there were no undestroyed documents in the dumpster; the City Council was informed, and the protocol for erasure of waste generated in classrooms was reviewed to prevent this from happening again, as nothing like this had ever occurred before. - That the cause could have been an error or confusion when disposing of the documents that were in the area designated for document destruction. - That this incident affected three students, and the data involved includes their full names and ID numbers. Finally, it is noted that the City Council lacks a risk analysis. FOURTH: On November 5, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate disciplinary proceedings against the respondent, pursuant to the provisions of Articles 63 and 64 of Law 39\u002F2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter “LPACAP”), for the alleged violation of Article 5.1.f) of the GDPR, as defined in Article 83.5.a) of the GDPR. FIFTH: Once the aforementioned decision to initiate proceedings was served in accordance with the rules established in Law 39\u002F2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), the respondent filed, dated November 13, 2025, a document it referred to as “statements of defense,” but in which which (i) it acknowledged the facts, (ii) it acknowledged its liability for negligence, without any intent having existed, and (iii) it outlined the various measures taken to prevent a situation such as the one that gave rise to the present disciplinary proceeding from occurring again, and its commitment to adopt new measures in compliance with the principle of accountability. With regard to the submitted brief, it is clarified to the CITY COUNCIL that, as already stated in the decision to initiate proceedings, pursuant to Article 77 of the LOPDGDD in in conjunction with Article 83.7 of the GDPR, in the present case it is appropriate to issue a declaration of the violation rather than impose an administrative fine; for this purpose, the criteria for determining the severity of such fines set forth in Article 83.2 of the GDPR; furthermore, the imposition of corrective measures is not warranted, insofar as these have already been adopted by the CITY COUNCIL. Article 64.2.f) of the LPACAP—a provision of which the respondent was informed in the decision to initiate proceedings—establishes that if no action is taken C\u002F Jorge Juan 6 www.aepd.es 28001 - Madrid sedeaepd.gob.es 4\u002F10 statements within the prescribed time limit regarding the content of the decision to initiate proceedings, when such decision contains a specific finding regarding the alleged liability, it may be considered a proposed resolution. In the present case, the decision to initiate disciplinary proceedings set forth the facts constituting the allegation, the GDPR violation attributed to the respondent, and the penalty that could be imposed. Therefore, taking into account that the respondent has not submitted any arguments regarding the content of the notice of initiation and in accordance with the provisions of the aforementioned provision, the aforementioned notice of initiation is considered, in this case, a proposed resolution. In light of all the proceedings, the Spanish Data Protection Agency considers the following facts to be established in this proceeding: ESTABLISHED FACTS FIRST: The Canals City Council launched the “EL TORREO IX,” for which it received a grant under the Joint Employment-Training Program “Employment Workshops” pursuant to Order 6\u002F2020, dated December 7, issued by the Regional Ministry of Sustainable Economy, Productive Sectors, Commerce, and Labor, approving the program’s regulatory provisions (DOGV No. 9,511, dated January 13, 2023). SECOND: On (…), in the specialty of auxiliary activities in the conservation and improvement of forests within the aforementioned workshop, a mock exam was conducted to reinforce the dynamics (…) in preparation for the final exam. These tests were conducted at the municipal facilities located at Camí de Les Moles, 10, in Canals. THIRD: On May 1, 2024, the exams taken by the three students were found abandoned on the public street next to the trash containers located in the vicinity of the center. FOURTH: The exams had not been destroyed beforehand and left exposed the students’ personal data (first name, last name, ID number, and score) which was viewed by at least two passersby, in addition to photographs being posted on social media. FIFTH: The City Council has acknowledged the facts and its responsibility in its correspondence with this Agency on November 7, 2024, and November 13, 2025, and states that it has taken measures to strengthen the protocol for the erasure of documents. LEGAL GROUNDS I Jurisdiction In accordance with the powers granted by Article 58(2) of Regulation (EU) 2016\u002F679 C\u002F Jorge Juan 6 www.aepd.es 28001 - Madrid sedeaepd.gob.es 5\u002F10 (General Data Protection Regulation, hereinafter GDPR) grants to each supervisory authority, and as established in Articles 47, 48.1, 64.2, and 68.1 of Organic Law 3\u002F2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to resolve this proceeding. Likewise, Article 63.2 of the LOPDGDD provides that: “Proceedings handled by the Spanish Data Protection Agency shall be governed by the provisions Regulation (EU) 2016\u002F679, this Organic Law, the regulatory provisions issued in implementation thereof, and, to the extent they do not conflict therewith, on a subsidiary basis, by the general rules governing administrative proceedings.” II Preliminary Issues Article 4(1) of the GDPR defines “personal data” as: “any information relating to an identified or identifiable natural person (‘the data subject’); an identifiable natural person shall be any person whose identity can be determined, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.” Article 4(2) of the GDPR defines “processing” as: “any operation or set of operations performed on personal data or sets of personal data, whether whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.” Article 4(7) of the GDPR defines the “controller” or “data controller” as: “the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing; if Union law Union or of the Member States determines the purposes and means of the processing, the controller or the specific criteria for its designation may be established by Union or Member State law.” In turn, Article 4(8) of the GDPR defines the “processor” as the natural or legal person, public authority, agency, or other body that engages in personal data processing on behalf of the controller. In the present case, in accordance with the provisions of Articles 4(1) and 4(2) of the GDPR, the processing of personal data has taken place, since, among other processing activities, the collection and storage of personal data of : first and last names and national ID numbers of individuals participating in the employment workshops for the implementation of the project titled “T.E. EL TORREO IX,” at the municipal facilities located at Camí de Les Moles, 10, Canals. C\u002F Jorge Juan 6 www.aepd.es 28001 - Madrid sedeaepd.gob.es 6\u002F10 THE CITY COUNCIL carries out this activity in its capacity as the controller, since it determines the purposes and means of processing, pursuant to Article 4.7 of the GDPR. III Breach of obligation. Integrity and confidentiality Article 5.1(f) of the GDPR states: “1. Personal data shall be: (…) (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, through the implementation of appropriate technical or organizational measures (“integrity and confidentiality”).” The principle of confidentiality set forth in Article 5.1(f) of the GDPR requires controllers to ensure that personal data is processed in a manner that guarantees the confidentiality of personal data, preventing unauthorized access, misuse, or disclosure to unauthorized third parties. This requires the implementation of appropriate technical and organizational measures of all kinds to protect the data against potential data breaches, whether external or internal. These measures must be adequate to prevent the materialization of risks to the rights and freedoms of natural persons that may arise from the processing, and they must be reviewed and updated periodically to ensure their effectiveness. The purpose of the principle of integrity and confidentiality is to prevent leaks of personal data without the data subjects' consent. In the present case, it has been established as a matter of fact that the CITY COUNCIL has violated Article 5.1.f) of the GDPR by failing to comply with the necessary technical and organizational measures necessary to prevent unauthorized access by third parties to the personal data of students in the “T.E. EL TORREO IX” employment workshop who had taken an exam on (…). The exams were found scattered on the ground near the trash containers located in an area close to the center, leaving the students’ personal data in plain sight of any passerby. As a result, at least two unauthorized third parties gained access to the exams, which contained the students’ first names, last names, and national ID numbers, and which were taken on (…) at the municipal premises of the employment workshop. Furthermore, photographs of the students were posted on social media. The CITY COUNCIL, in its letter dated November 7, 2024, and in its letter dated November 13, 2025, acknowledges that it did not act in accordance with the established protocol, which consists of “1. Shredding the paper; 2. Disposing of it in the wastebasket; and 3. Collection of the wastebasket by cleaning services, which dispose of it in the dumpster in sealed bags,” and that “due to a ‘possible’ mix-up, the evidence ended up in the wastebasket and ultimately in the recycling bin.” C\u002F Jorge Juan 6 www.aepd.es 28001 - Madrid sedeaepd.gob.es 7\u002F10 Three individuals were affected by the personal data breach, as acknowledged by the CITY COUNCIL in its letter dated November 7, 2024: “This incident has affected 3 students, and the data consists of their full names and ID numbers,” and in its statement of defense dated November 13, 2025. Therefore, in accordance with the established facts currently available in this disciplinary proceeding, it is considered that the known facts constitute a violation attributable to the CITY COUNCIL for violation of Article 5.1.f) of the GDPR, as transcribed above. V Classification of the violation of Article 5.1.f) of the GDPR and assessment for purposes of the statute of limitations Article 83.5 of the GDPR classifies a violation of the following article, which shall be punishable, in accordance with paragraph 2, by administrative fines of up to 20,000,000 EUR or, in the case of an enterprise, an amount equivalent to up to 4% of the total annual global turnover of the preceding financial year, whichever is higher: “a) the basic principles governing processing, including the conditions for consent pursuant to Articles 5, 6, 7, and 9;” For its part, article 71 of the LOPDGDD, “Violations,” states that: “Acts and conduct referred to in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016\u002F679, as well as those that are contrary to this organic law, constitute violations.” For the sole purpose of the statute of limitations, article 72.1 of the LOPDGDD provides as follows: “Pursuant to Recital 83(5) of Regulation (EU) 2016\u002F679, infractions that constitute a substantial breach of the articles mentioned therein and, in particular, the following: a) The processing of personal data in violation of the principles and safeguards established in Article 5 of Regulation (EU) 2016\u002F679.” VI Statement of Violation Article 83, “General conditions for the imposition of administrative fines,” of the GDPR, in paragraph 7, provides: “Without prejudice to the corrective powers of supervisory authorities under Article 58(2), each Member State may lay down rules on whether C\u002F Jorge Juan 6 www.aepd.es 28001 - Madrid sedeaepd.gob.es 8\u002F10 may, and to what extent, administrative fines be imposed on public authorities and bodies established in that Member State.” Article 77, “Regime Applicable to Certain Categories of Controllers or Processors,” of the LOPDGDD provides as follows: “1. The regime established in this article shall apply to processing operations for which the following are controllers or processors: a) Constitutional bodies or bodies of constitutional significance, and institutions of the autonomous communities analogous to them. b) Judicial bodies. c) The General State Administration, the administrations of the autonomous communities, and the entities that make up the local administration. d) Public bodies and entities governed by public law that are linked to or dependent on public administrations. e) Independent administrative authorities. f) The Bank of Spain. g) Public-law corporations when the purposes of the processing are related to the exercise of public-law powers. h) Public-sector foundations. i) Public universities. j) Consortia. k) Parliamentary groups in the Spanish Parliament (Cortes Generales) and the autonomous regional legislative assemblies, as well as political groups within local governments. 2. If the data controllers or processors listed in paragraph 1 commit any of the violations referred to in Articles 72 through 74 of this Organic Law, the competent Data Protection Authority shall issue a decision declaring the violation and establishing, where appropriate, the measures to be taken to cease the conduct or correct the effects of the violation that has been committed, with the exception of that provided for in Article 58.2.i of Regulation (EU) 2016\u002F679 of the European Parliament and of the Council, dated April 27, 2016. The decision shall be notified to the controller or processor, to the body to which it reports hierarchically, if applicable, and to the affected individuals who have the status of data subjects, if applicable. C\u002F Jorge Juan 6 www.aepd.es 28001 - Madrid sedeaepd.gob.es 9\u002F10 3. Without prejudice to the provisions of the preceding paragraph, the Data Protection Authority shall also propose the initiation of disciplinary proceedings when there is sufficient evidence to do so. In this case, the procedure and sanctions to be applied shall be those established in the applicable legislation on disciplinary or sanctioning proceedings. Likewise, when violations are attributable to authorities and executives, and it is established that technical reports or recommendations regarding data processing were not duly heeded, the decision imposing the sanction shall include a reprimand specifying the title of the responsible official, and publication shall be ordered in the corresponding Official State Gazette or regional gazette. 4. Decisions that are issued in relation to the measures and actions referred to in the preceding paragraphs. 5. The actions taken and the decisions issued pursuant to this article shall be communicated to the Ombudsman or, where applicable, to the analogous institutions of the autonomous communities. 6. When the competent authority is the Spanish Data Protection Authority, it shall publish on its website, with due distinction, the decisions pertaining to the entities referred to in paragraph 1 of this article, expressly indicating the identity of the controller or processor that committed the violation. When jurisdiction lies with an autonomous community Data Protection Authority, the publication of these decisions shall be governed by the provisions of its specific regulations.” This provision establishes that proceedings arising from violations of personal data protection laws committed by the categories of controllers or processors listed in paragraph 1 shall be resolved, in all cases, by a finding of violation. Consequently, since the controller is considered a local entity and, therefore, falls under Article 77.1 of the LOPDGDD, the penalty decision must declare a violation of Article 5.1(f) of the GDPR. Therefore, in accordance with applicable law and after assessing the criteria for for determining the severity of sanctions—the existence of which has been established—the Presidency of the Spanish Data Protection Agency RESOLVES: FIRST: TO DECLARE that the CANALS CITY COUNCIL, with Tax ID P4608300B, has violated the provisions of Article 5.1(f) of the GDPR, a violation defined in Article 83.5 of the GDPR. C\u002F Jorge Juan 6 www.aepd.es 28001 - Madrid sedeaepd.gob.es 10\u002F10 SECOND: TO NOTIFY the CANALS CITY COUNCIL, with Tax ID No. P4608300B, THIRD: TO COMMUNICATE this decision to the Ombudsman, in accordance with the provisions of Article 77.5 of the LOPDGDD. In accordance with the provisions of Article 50 of the LOPDGDD, this Decision shall be made public once it has been notified to the data subjects. Against this resolution, which concludes the administrative proceedings pursuant to Article 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, the data subjects may, at their discretion, file an appeal for reconsideration with the Presidency of the Spanish Data Protection Agency within one month from the day following notification of this resolution, or directly file a contentious-administrative appeal before the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29\u002F1998, of July 13, regulating the Contentious-Administrative Jurisdiction, within two months from the day following notification of this decision, as provided for in Article 46.1 of the aforementioned Law. Finally, it is noted that, in accordance with the provisions of Article 90.3(a) of the LPACAP, a final administrative decision may be provisionally suspended if the data subject expresses their intention to file a contentious-administrative appeal. If this is the case, the data subject must formally notify the Spanish Data Protection Agency of this fact by submitting a written notice addressed to the Agency through the Agency’s Electronic Registry [https:\u002F\u002Fsedeaepd.gob.es\u002Fsede-electronica- web\u002F], or through any of the other registries provided for in Art. 16.4 of the aforementioned Law 39\u002F2015, of October 1. The data subject must also submit to the Agency the documentation proving that the contentious-administrative appeal has been effectively filed. If the Agency is not notified of the filing of the contentious-administrative appeal within two months from the day following the notification of this decision, it will consider the precautionary suspension to have ended. 938-100325 Lorenzo Cotino Hueso President of the Spanish Data Protection Agency C\u002F Jorge Juan 6 www.aepd.es 28001 - Madrid sedeaepd.gob.es","Spain's Data Protection Agency (AEPD) ruled that the Canals City Council violated GDPR Article 5(1)(f) by failing to properly destroy exam papers containing personal data. The documents, which included names, national identification numbers, and exam results of three participants, were found discarded next to waste containers and were subsequently accessed by third parties, with some even published on social media. While the council acknowledged the error and revised its procedures, the AEPD formally declared the infringement but did not impose a fine due to the entity being a local public authority and having already taken corrective measures.","Spain's AEPD found a municipality violated GDPR by improperly disposing of exam papers.","Help AEPD (Spain) - PS-00506-2026: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 14:39, 26 August 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators282 edits Tag: Decisions [1.0] (No difference) Latest revision as of 14:39, 26 August 2026 AEPD - PS-00506-2026 Authority: AEPD (Spain) Jurisdiction: Spain Relevant Law: Article 5(1)(f) GDPR Type: Complaint Outcome: Upheld Started: 05.11.2025 Decided: Published: 25.08.2026 Fine: n\u002Fa Parties: Ajuntament de Canals National Case Number\u002FName: PS-00506-2026 European Case Law Identifier: n\u002Fa Appeal: Unknown Original Language(s): Spanish Original Source: AEPD (in ES) Initial Contributor: bms The DPA held that a municipality violated Article 5(1)(f) GDPR after examination papers containing personal data were disposed of without being destroyed and subsequently accessed by third parties. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The DPA became aware that examination papers from an employment-training programme managed by Canals City Council, the controller, had been found next to waste containers in a public area. The documents concerned three participants and contained their names, surnames, national identification numbers and exam results. The papers had not been destroyed before disposal and were accessible to passers-by. Photographs of some of the documents were also published on social media. The controller explained that the documents had been set aside for shredding but were mistakenly placed in the general waste. It acknowledged the incident and subsequently revised its document-disposal procedure. Holding The DPA found that the controller had violated Article 5(1)(f) GDPR. The DPA considered that the controller had failed to ensure an appropriate level of confidentiality when disposing of documents containing personal data. Although an internal procedure required the documents to be shredded before being discarded, this procedure was not followed. As a result, the examination papers remained readable and could be accessed by unauthorised third parties. Their subsequent publication on social media further demonstrated that the confidentiality of the data had been compromised. Therefore, the DPA concluded that the controller had not adequately protected the personal data against unauthorised access or disclosure, in breach of the integrity and confidentiality principle under Article 5(1)(f) GDPR. Since the controller was a local public authority, the special regime under Article 77 LOPDGDD applied. Accordingly, the DPA formally declared the infringement but did not impose an administrative fine. It also refrained from ordering additional corrective measures, as the controller had already revised its document-disposal procedures following the incident. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. Case No.: EXP202408290 DECISION ON DISCIPLINARY PROCEEDINGS Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following: BACKGROUND FIRST: The Spanish Data Protection Agency has become aware of certain facts that could constitute a possible violation attributable to THE CITY COUNCIL OF CANALS, with Tax ID No. P4608300B, hereinafter referred to as the CITY COUNCIL. The facts brought to the attention of this authority were as follows: It is alleged that, on May 1, 2024, documentation containing personal data was found abandoned in a next to some trash bins located on Camí Les Moles Street in the town of Canals, Valencia. This documentation contains personal data and originated from training courses offered by the Canals City Council, subsidized by the Valencian Employment Service. The documents belong to individuals participating in an employment workshop organized by the Valencian Employment and Training Service (LABORA) and administered by the Canals City Council Canals and l’Alcudia (Valencia). Attached are images of the abandoned documents, a copy of an exam found at that location, and a message posted on social media by a User of that platform regarding the abandoned documents. Initially, the following documentation is available: - Photographs showing several pages of exams on the ground. - Photographs of exams belonging to three people, showing their first names, last names, ID numbers, and scores, scattered on the ground. - A photograph of two trash containers, with printed sheets of paper and trash bags scattered on the ground around them. - A photograph of a social media post, (…) … In it, A.A.A. writes on May 5, “I am writing to the Canals City Council. Yesterday, on Labor Day, while walking near Curtitex, I saw exam papers scattered among the grass. When I reached the area near the trash containers, there were torn trash bags, boxes, and sacks—everything was outside the containers and covered in job application forms with names, ID numbers, and exam scores dated (…)—all from students from the vocational school. But around 6 p.m., I returned, and some were still there. How can they throw away exams with names and ID numbers? That’s not allowed. Where is data protection? What kind of people does the city council hire who don’t know there are special containers and that the waste must be shredded? The responsible person should go and see the mess that’s there” (attached: C\u002F Jorge Juan 6 www.aepd.es 28001 - Madrid sedeaepd.gob.es 2\u002F10 photographs of the documents found on the ground and around the container). SECOND: As a result of the known facts, on June 6, 2024, the Director of the Spanish Data Protection Agency urged the Subdirectorate General for Data Inspection (SGID) to initiate the preliminary investigative proceedings referred to in Article 67 of Organic Law 3\u002F2018, of December 5, on data protection and the Guarantee of Digital Rights (hereinafter “LOPDGDD”). THIRD: The Subdirectorate General for Data Inspection proceeded to conduct preliminary investigative proceedings to clarify the facts in question, pursuant to the functions assigned to supervisory authorities under Article 57.1 and the powers granted under Article 58.1 of Regulation (EU) 2016\u002F679 (GDPR), and in accordance with the provisions of Title VIII of the LOPDGDD. On October 14, 2024, a request for information was sent to LABORA VALENCIAN EMPLOYMENT AND TRAINING SERVICE (LABORA), requesting information on the actions taken to comply with the requirements set forth in data protection regulations. On November 4, 2024, LABORA submitted a written response to the aforementioned request, in which it stated, in summary, that: LABORA approved the call for applications for the Joint Employment-Training Program “Employment Workshops” in accordance with Order 6\u002F2020, dated December 7, of the Regional Ministry of Sustainable Economy, Productive Sectors, Commerce, and Labor, which approves the program’s regulatory framework. (DOGV No. 9,511, dated January 13, 2023), for the implementation of these projects. The Canals City Council applied for grants from the “Talleres de Empleo” mixed employment-training program. As a result, the Director General of Employment and Training decided to grant the Canals City Council a subsidy for the implementation of the project titled “T.E. EL TORREO IX.” LABORA states that it is the CITY COUNCIL, as the local entity, that develops and manages the project and is responsible for the documentation and data referred to in your letter; therefore, we are forwarding this letter with the purpose of allowing the City Council to appropriately address the issues raised. On November 7, 2024, the CITY COUNCIL submitted a letter in which it states: - That on (…)","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00506-2026&diff=52811&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-08-26T14:39:26+00:00","2026-08-26T16:00:35.177045+00:00",7,[18,21,24,26,28],{"name":19,"type":20},"GDPR","product",{"name":22,"type":23},"AEPD","vendor",{"name":25,"type":20},"LOPDGDD",{"name":27,"type":20},"LPACAP",{"name":29,"type":23},"Ajuntament de Canals","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":30,"icon":32,"name":33,"slug":34},null,"Policy","policy",[36,40,45,50],{"category":37},{"id":38,"icon":32,"name":19,"slug":39},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":41},{"id":42,"icon":32,"name":43,"slug":44},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":46},{"id":47,"icon":32,"name":48,"slug":49},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":51},{"id":30,"icon":32,"name":33,"slug":34},[]]