[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXmFJAnUVyM8lueL0b8dGXgllum0yCV8JOatUFXfH4Cc":3},{"article":4,"iocs":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":24,"category":25,"article_tags":29},"95c6231e-53b8-4e01-9b50-a95482eb150d","APDCAT (Catalonia) - PS-0036\u002F2026","apdcat-catalonia-ps-0036-2026-7916fb","Fixed language tag ← Older revision Revision as of 06:41, 23 September 2026 Line 13: Line 13: |Original_Source_Name_1=APDCAT |Original_Source_Name_1=APDCAT |Original_Source_Link_1=https:\u002F\u002Fseu.apdcat.cat\u002Fca\u002FdocumentPublic\u002Fdownload\u002F8342 |Original_Source_Link_1=https:\u002F\u002Fseu.apdcat.cat\u002Fca\u002FdocumentPublic\u002Fdownload\u002F8342 |Original_Source_Language_1=Catalan; Valencian |Original_Source_Language_1=Catalan |Original_Source_Language__Code_1=CA |Original_Source_Language__Code_1=CA","The Catalan Data Protection Authority (APDCAT) has ruled against the Ajuntament de Madremanya for violating GDPR. The city council published personal data of social housing applicants, including financial and sensitive information, without adequate redaction. Furthermore, the council failed to respond to the DPA's requests for information, hindering the investigation.","Catalonia's DPA fines Ajuntament de Madremanya for GDPR violations.","Help APDCAT (Catalonia) - PS-0036\u002F2026: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 11:45, 4 August 2026 view sourceFm (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators120 editsTag: Visual edit← Older edit Latest revision as of 06:41, 23 September 2026 view source Sfl (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators589 editsm Tag: Visual edit Line 13: Line 13: |Original_Source_Name_1=APDCAT|Original_Source_Name_1=APDCAT |Original_Source_Link_1=https:\u002F\u002Fseu.apdcat.cat\u002Fca\u002FdocumentPublic\u002Fdownload\u002F8342|Original_Source_Link_1=https:\u002F\u002Fseu.apdcat.cat\u002Fca\u002FdocumentPublic\u002Fdownload\u002F8342 |Original_Source_Language_1=Catalan; Valencian|Original_Source_Language_1=Catalan |Original_Source_Language__Code_1=CA|Original_Source_Language__Code_1=CA Latest revision as of 06:41, 23 September 2026 APDCAT - PS-0036\u002F2026 Authority: APDCAT (Catalonia) Jurisdiction: Spain Relevant Law: Article 5(1)(c) GDPR Article 5(1)(f) GDPR Article 31 GDPR Article 5 LOPDGDDArticle 77 LOPDGDD Type: Complaint Outcome: Upheld Started: 28.04.2026 Decided: 17.07.2026 Published: Fine: n\u002Fa Parties: Ajuntament de Madremanya National Case Number\u002FName: PS-0036\u002F2026 European Case Law Identifier: n\u002Fa Appeal: Unknown Original Language(s): Catalan Original Source: APDCAT (in CA) Initial Contributor: bms The DPA held that a city council violated Articles 5(1)(c), 5(1)(f) and 31 GDPR by publishing financial and sensitive data of applicants for social housing and failing to answer two information requests of the DPA. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts On 8 May 2025, Madremanya City Council, acting as controller, published on its notice board two administrative acts concerning a tender procedure for the award of a social housing lease. The documents expressly disclosed the identities of the applicants. On 9 May 2025, the controller replaced the original documents with revised versions in which the applicants’ names and surnames were partially redacted, leaving only their initials visible. However, the redaction was performed manually and did not effectively conceal the information, as it remained possible to infer the length of the names and surnames and to identify some of their letters. In addition to the applicants’ identifying information, the documents disclosed detailed financial data, including the exact annual net income of each household. They also revealed information concerning particularly sensitive personal circumstances, including dependency, gender-based violence and addiction, which had been used to calculate the applicants’ respective scores. No adequate anonymisation or redaction measures had been implemented. In July and November 2025, the DPA requested that the controller provide specific information concerning certain aspects of the processing. The controller’s failure to respond or cooperate hindered the DPA’s ability to exercise its investigative powers. Holding The DPA held that the controller violated Article 5(1)(c) GDPR by publishing personal data that were not necessary for the purpose pursued. The DPA acknowledged that publishing information about the procedure could serve the objective of administrative transparency. However, transparency did not justify disclosing identifying data together with detailed financial information and sensitive personal or family circumstances. The controller had to limit the processing to data that were necessary and proportionate to that objective and consider less intrusive alternatives. The DPA found that the controller’s subsequent redaction did not amount to effective anonymisation. Although most of the characters had been concealed, the applicants could still potentially be reidentified from their initials, the length of their names and surnames and other contextual information. This risk was particularly significant because the municipality had only 277 inhabitants. The controller should therefore have applied complete anonymisation or a pseudonymisation method preventing direct or indirect identification. The DPA also held that the controller violated Article 5(1)(f) GDPR and the duty of confidentiality under Article 5 LOPDGDD. The published documents disclosed the applicants’ exact household income, household composition and scores linked to circumstances such as dependency, addiction, gender-based violence, single-parent status and age. Although this information was relevant to assessing the applications, it was unnecessary to make it publicly accessible in a form linked to identifiable individuals. The DPA considered that the violations of the data-minimisation and confidentiality principles constituted a medial concurrence of infringements. The failure to anonymise the applicants’ identities was the necessary means through which their sensitive personal and family circumstances were disclosed. Nevertheless, the DPA formally declared separate violations of Articles 5(1)(c) and 5(1)(f) GDPR. Additionally, the DPA held that the controller violated Article 31 GDPR by failing to respond to two information requests. This failure breached the controller’s duty to cooperate with the supervisory authority and obstructed the exercise of the DPA’s investigative powers. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Catalan; Valencian original. Please refer to the Catalan; Valencian original for more details. Case Identification Resolution of sanctioning proceeding no. PS-0036\u002F2026, concerning the Town Hall of Madremanya. Background 1. On May 8, 2025, a complaint was filed with the Catalan Data Protection Authority against the Madremanya City Council, alleging a potential violation of personal data protection regulations. The complainant stated that, on May 8, 2025, the Madremanya Town Hall published on its electronic notice board two minutes related to the tendering procedure for a social housing lease contract, identified by file number (...). According to the complainant, these minutes contained personal data of the applicants, both identifying and financial (first and last names and net annual income), as well as particularly sensitive information regarding situations of dependency and gender-based violence, without any anonymization or pseudonymization measures having been adopted. The complainant provided a copy of the two acts. 2. On May 13, 2025, the Authority received a new submission from the complainant in which they expanded on the facts reported. Thus, it was reported that the City Council had unredacted the two minutes and on May 9, 2025, had replaced them with the same document, leaving only the applicants' first and last names visible, but manually censoring the content. Likewise, the scoring tables for remuneration, or for situations of dependency or gender-based violence, remained visible. 3. The Authority opened a preliminary information phase (No. IP-0360\u002F2025) to determine whether the facts could warrant the initiation of an enforcement proceeding, in accordance with Article 7 of Decree 278\u002F1993, of November 9, on the sanctioning procedure applicable to the areas of competence of the Generalitat, and Article 55.2 of Law 39\u002F2015, of October 1, on the common administrative procedure of public administrations (LPAC). In this information phase, on July 9, 2025, the entity under investigation was required to provide information on the legal basis that authorized the publication of the record with non-anonymized data and to indicate the period of time during which the document was accessible. 4. On November 6, 2025, the Town Hall of Madremanya was again required to respond due to the entity's lack of response to the previous request, with the","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=APDCAT_(Catalonia)_-_PS-0036\u002F2026&diff=53162&oldid=52599","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fb\u002Fbe\u002FApdcat-logo.png","2026-09-23T06:41:52+00:00","2026-09-23T08:00:09.411889+00:00",7,[18,21],{"name":19,"type":20},"APDCAT","vendor",{"name":22,"type":23},"Ajuntament de Madremanya","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":24,"icon":26,"name":27,"slug":28},null,"Policy","policy",[30,35,40,42],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":41},{"id":24,"icon":26,"name":27,"slug":28},{"category":43},{"id":44,"icon":26,"name":45,"slug":46},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]