AEPD (Spain) - PS/00028/2022: Difference between revisions

Revision as of 15:10, 27 February 2023

AEPD - PS-00028-2022

Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(f) GDPR Article 32 GDPR Article 33 GDPR 72, 73, 77 Spanish Data Protection Act
Type:	Complaint
Outcome:	Upheld
Started:	31.03.2021
Decided:
Published:	03.02.2023
Fine:	n/a
Parties:	Getafe City Council
National Case Number/Name:	PS-00028-2022
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Mapez

The Spanish DPA imposed a warning to a local administration for violating Articles 5(1)(f), 32 and 33 GDPR by making available online during several months the personal data of data subjects without their consent.

English Summary

Facts

On 31 March 2021, the City Council of Getafe (controller) accidentally published an Excel sheet on its website. This Excel sheet contained personal data of vehicle owners who had requested an address change. The Excel sheet included several categories of data, such as name, surname, tax identification number, ID number and vehicle registration number. The Excel sheet had thirty-six entries, but the vast majority of the data subjects that were mentioned were included several times in the list.

On 31 March 2021, the data subject informed both the controller and the Spanish DPA of this breach. After this, the controller unlinked the Excel sheet from its website, so that it would not be available when navigating the controller website. There was therefore no way to reach the Excel sheet any longer, navigating the controller's website. However, the Excel sheet itself was not deleted from the internet and stayed online as an "orphan document" until 24 January 2022. This meant that the Excel sheet could still be accessed, when typing the exact URL in the browser. People who were aware of the exact URL, could therefore still access the Excel sheet.

Despite the fact that the Excel sheet stayed online for several months after the initial complaint of the applicant, the controller stated that it was unlikely that any data had been retrieved by unauthorised third parties, because the Excel sheet could only be accessed through the exact URL and not through any linking on the controller's website. Also, the controller had not identified any serious harm as a result of this data breach.

Holding

First, the DPA found a violation of Article 5(1)(f) GDPR, since the publication of the Excel sheet online enabled unauthorised access to the personal data of the data subjects, in violation of the principle of confidentiality.

Second, the DPA found a violation of Article 32 GDPR, because the controller failed to properly remove the Excel sheet from its website and did not involve its own IT services in the process. Furthermore, the DPA found that the controller had failed to make an appropriate assessment of the risks as a result of the breach. The controller should have considered potential further risks.

Third, the DPA found a violation of Article 33 GDPR, because the controller failed to assess the level of severity of the data breach. In this case, the DPA found that such a confidentiality breach as in the present case would have justified a notification to the DPA, which the controller did not undertake.

On the basis of Articles 72 and 73 of the Spanish Data Protection Act - LOPDGDD, the DPA classified the infringement of Articles 32 and 33 GDPR as "serious" offences, whilst the violation of Article 5(1)(f) was considered a "very serious" offence. The DPA issued a warning pursuant to Article 77 LOPDGDD.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

https://www.aepd.es/es/documento/ps-00028-2022.pdf

@@ Line 72: / Line 72: @@
 === Facts ===
-On 31 March 2021, the City Council of Getafe (the controller) published by mistake on its website an excel sheet containing the personal data of the vehicle owners that had requested a change of address in the previous week (the data subjects). The excel sheet included the name, surname, address, date of birth, tax identification number, ID number, vehicle registration number, and date of registration of vehicle of the data subjects. The excel sheet had thirty-six entries, but the vast majority of the data subjects that were mentioned were included several times in the list.
+On 31 March 2021, the City Council of Getafe (controller) accidentally published an Excel sheet on its website. This Excel sheet contained personal data of vehicle owners who had requested an address change. The Excel sheet included several categories of data, such as name, surname, tax identification number, ID number and vehicle registration number. The Excel sheet had thirty-six entries, but the vast majority of the data subjects that were mentioned were included several times in the list.
-On 31 March 2021, A.A.A. (the applicant), notified the breach to controller and the AEPD. The controller unlinked the excel sheet from the website, so that it would not be available when using the navigation route on the portal. However, the excel sheet itself was not deleted from the internet and stayed online as an "orphan document" until 24 January 2022, which could be retrieved when typing the exact URL in the browser.
+On 31 March 2021, the data subject informed both the controller and the Spanish DPA of this breach. After this, the controller unlinked the Excel sheet from its website, so that it would not be available when navigating the controller website. There was therefore no way to reach the Excel sheet any longer, navigating the controller's website. However, the Excel sheet itself was not deleted from the internet and stayed online as an "orphan document" until 24 January 2022. This meant that the Excel sheet could still be accessed, when typing the exact URL in the browser. People who were aware of the exact URL, could therefore still access the Excel sheet.
-During the procedure, the controller submitted that it had originally intended to publish a call for the plenary session of the City Council, and instead published the excel sheet by mistake. Despite the fact that the excel sheet stayed online during several months after the initial complaint of the applicant, the controller submitted that it was unlikely that the data had been retrieved, as the excel sheet could only be accessed through the exact URL and not through a link on the website. According to the controller, no serious harm had been identified following the data breach.
+Despite the fact that the Excel sheet stayed online for several months after the initial complaint of the applicant, the controller stated that it was unlikely that any data had been retrieved by unauthorised third parties, because the Excel sheet could only be accessed through the exact URL and not through any linking on the controller's website. Also, the controller had not identified any serious harm as a result of this data breach.
 === Holding ===
-The AEPD qualified the upload of the excel file as a confidentiality breach and identified three subsequent infringing conducts: infringement of Article 5(1)(f) and Article 32 for not handling the data with the appropriate level of security, and of Article 33 for not notifying the data breach to the AEPD.
+First, the DPA found a violation of [[Article 5 GDPR|Article 5(1)(f) GDPR]], since the publication of the Excel sheet online enabled unauthorised access to the personal data of the data subjects, in violation of the principle of confidentiality.
-With regards to Article 5(1)(f), the AEPD found that the publication of the excel sheet online enabled unauthorised access to the personal data of the data subjects, in violation of the principle of confidentiality.
+Second, the DPA found a violation of Article 32 GDPR, because the controller failed to properly remove the Excel sheet from its website and did not involve its own IT services in the process. Furthermore, the DPA found that the controller had failed to make an appropriate assessment of the risks as a result of the breach. The controller should have considered potential further risks.
-With regards to Article 32, the AEPD found that the controller failed to properly take out the excel sheet and did not involve the IT services in the process. Furthermore, the AEPD found that the controller had failed to make an appropriate assessment of the risks generated by the initial breach of confidentiality, and should have considered potential further risks to prevent its persistence. The AEPD noted that although the controller was aware of the persistence of the data breach, all the details of the infringement were probably not known.
+Third, the DPA found a violation of Article 33 GDPR, because the controller failed to assess the level of severity of the data breach. In this case, the DPA found that such a confidentiality breach as in the present case would have justified a notification to the DPA, which the controller did not undertake.
-With regards to Article 33, the AEPD found that the controller had failed to assess the level of severity of the data breach and the risks to the rights and freedoms of the data subjects. In the case at hand, the AEPD found that such confidentiality breach would have justified a notification to the AEPD, which the controller did not undertake.
+On the basis of Articles 72 and 73 of the Spanish Data Protection Act - LOPDGDD, the DPA classified the infringement of Articles 32 and 33 GDPR as "serious" offences,  whilst the violation of Article 5(1)(f) was considered a "very serious" offence. The DPA issued a warning pursuant to Article 77 LOPDGDD.
-On the basis of Articles 72 and 73 of the Ley Orgánica 3/2018 de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (Spanish Data Protection Act - LOPDGDD), the AEPD classified the infringement of Article 32 and 33 as "serious" offences whilst the breach of Article 5(1)(f) was considered a "very serious" offence. The AEPD issued a warning decision to the controller in accordance with the special regime of administrative fines applicable to local administrations (Article 77 LOPDGDD).
 == Comment ==