AEPD (Spain) - PS/00034/2020

From GDPRhub
Revision as of 17:23, 21 September 2020 by Francesc Julve (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS/00...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
AEPD - PS/00034/2020
LogoES.jpg
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 5(1)(f) GDPR
9 (h) Ley 49/1960, de Propiedad Horizontal
Type: Investigation
Outcome: Violation Found
Started:
Decided: 31.08.2020
Published: 31.08.2020
Fine: 10000 EUR
Parties: n/a
National Case Number/Name: PS/00034/2020
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Spanish
Original Source: AEPD (in ES)
Initial Contributor: Francesc Julve Falcó

The Spanish DPA fined a neighborhood community EUR 10.000 for infringing Article 5(1)(f) of the GDPR.

English Summary

Facts

The complainant had contracted a debt with the community of neighbours. The administrator, believing himself to be covered by the Horizontal Property Law Article 9 (h)* published his name, address, and amount owed on the community's notice board.

The administrator of the community said that the former administrator displayed the person's debt on the notice board because the applicant refused to take receipt of a notification where it said that they were going to register her owe in a public register.


Dispute

Is the public displaying of a document containing personal data on the notice board of the neighbour’s community a violation of Article 5 (1) (f) GDPR?

Holding

The Spanish DPA held that the public sharing on the notice board located in the neighbour’s community hall is an infringement of Article 5 (1) (f) GDPR, which addresses the principles of integrity and confidentiality of personal data, as well as proactive responsibility of the data controller to demonstrate his compliance.

The fact that it was a non-intentional negligent action, that basic personal identifiers were affected and the continued nature of the infringement were considered aggravating factors, determining the amount of the fine in EUR 10000.


Comment

The complainant was a victim of gender-based violence recognized by a court ruling and therefore requested that her data be processed more carefully.

Article 9 Horizontal Property Law: "If a summons or notification to the owner cannot be made in the place foreseen in the previous paragraph, it will be understood that it has been made by placing the corresponding communication on the community notice board, or in a visible place of general use enabled for this purpose, with express diligence of the date and reasons for which this form of notification is made, signed by the person who exercises the functions of community secretary, with the approval of the president. The notification carried out in this way will produce full legal effects within three calendar days."

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.