Catalan Council Fined for Publishing Unredacted Social Housing Applicants' Personal Data
The Ajuntament de Madremanya violated GDPR by publicly disclosing sensitive personal and financial data of social housing applicants without proper redaction, exposing vulnerable individuals to significant privacy risks. The failure to apply basic anonymisation or redaction procedures before publication reflects a fundamental gap in data handling awareness and internal controls. Compounding the violation, the council's non-cooperation with the APDCAT investigation obstructed regulatory oversight and likely worsened the authority's assessment. This case highlights that even small public bodies process sensitive special-category data and must embed GDPR-compliant practices into routine administrative workflows. Ignoring data protection obligations — and then failing to engage with regulators — significantly escalates legal and reputational consequences.
Tactical Insight
Immediate actions
- Establish and enforce a mandatory redaction and review process for any documents containing personal data before public publication.
- Appoint or confirm a designated Data Protection Officer (DPO) responsible for reviewing data disclosures and ensuring GDPR compliance.
Long-term improvements
- Implement a Data Protection Impact Assessment (DPIA) process for all activities involving sensitive or special-category personal data.
- Develop and regularly update a data classification policy so staff can identify which data requires redaction, anonymisation, or restricted access.
- Create formal procedures for responding to regulatory authority requests within legally mandated timeframes.
Training & awareness measures
- Deliver mandatory GDPR and data handling training to all staff involved in document preparation and public communications.
- Conduct periodic audits of publicly accessible documents to detect and remediate any inadvertent personal data disclosures.