APDCAT (Catalonia) - PS-01092025
APDCAT fines public sector group €5,250 for unlawful audio recording disclosure.
The Catalan Data Protection Authority (APDCAT) has fined a public-sector organization €5,250 for unlawfully disclosing an employee's audio recording of a conversation to four additional recipients. The disclosure violated Article 5(1)(a) of GDPR, as the recording was personal data and its sharing was not legally justified, despite the controller's arguments about labor relations and security functions of the recipients.
AI summary of the linked source. Not reviewed by an editor. How this works
Run APDCAT?
Get an email when a new story names APDCAT, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Catalan public-sector organization was fined €5,250 after sharing an employee's audio recording with four unauthorized recipients without a lawful basis, violating GDPR Article 5(1)(a)'s principle of lawfulness, fairness, and transparency. The core failure was treating personal data as an internal administrative tool rather than recognizing its protected status under data protection law. This case highlights that even within organizations, sharing personal data — including recordings — requires a clearly defined and documented legal justification. The fact that recipients held security or labor relations roles was insufficient to legitimize the disclosure, underscoring that job function alone does not create a lawful basis. Organizations must embed data minimization and purpose limitation principles into everyday workflows, not just formal IT systems.