APDCAT (Catalonia) - PS-0127/2025

APDCAT - PS-0127/2025
Authority:	APDCAT (Catalonia)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 5(1)(f) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	07.06.2025
Decided:	20.04.2026
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	PS-0127/2025
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Catalan, Valencian
Original Source:	APDCAT (in CA)
Initial Contributor:	bms

The DPA found that a Catalan city council had infringed the principle of data minimisation by including unnecessary and excessive personal data in a mayoral decree initiating disciplinary proceedings against a local police officer.

English Summary

Facts

A Catalan city council (the controller) included, in a mayoral decree initiating disciplinary proceedings against an employee, a local police officer (the data subject), information concerning the activation of a workplace harassment protocol involving that person. The decree reproduced verbatim extracts from a report prepared by the head of the local police, referring to isolated incidents that occurred at a later date and had no connection with the initiation of the disciplinary proceedings.

However, the purpose of the decree was to initiate disciplinary proceedings for matters unrelated to the facts that had led to the activation of the harassment protocol.

According to the operative part of the decree, it was served on the data subject and on the officials appointed as investigating officer and secretary. Nevertheless, the controller itself acknowledged that up to five additional individuals, all of whom were council employees, had access to the decree. These individuals were therefore able to access the data subject’s personal data relating to the activation of the harassment protocol.

Holding

The DPA found that the city council, as controller of the personal data included in the mayoral decree, had infringed the principles of data minimisation and integrity and confidentiality under Articles 5(1)(c) and 5(1)(f) GDPR, in conjunction with Article 83(5)(a) GDPR, by including unnecessary and excessive personal data to justify the initiation of disciplinary proceedings and allowing additional council employees to access personal data relating to the activation of the workplace harassment protocol without a legal basis. However, no corrective measures were required, as the infringement concerned an isolated and already completed incident.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Catalan, Valencian original. Please refer to the Catalan, Valencian original for more details.

PAGE: 1 of 8 DATE AND TIME OF COPY GENERATION: 20/04/2026 13:05
This document is an authentic copy of the original electronic document. You can check its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=049b73af-398b-441f-ba17-5724f3949c62 The recipient
of the document must treat the secure verification code (CSV) included in the header of this document with caution, since its communication to third parties would allow them to access the content of the document.
DOCUMENTS
TYPE: Anonymized Resolution
NAME: RESOL_A ca_ps_2025_127
UNIT: APDCAT Inspection and Technical Area
SECURE VERIFICATION CODE: 049b73af-398b-441f-ba17-5724f3949c62
IDENTIFIER: ES_A09018940_2026_0000000000000000000000000134574
STATUS OF PREPARATION: Definitive
ACCESS LEVEL:
REFERENCES
FILES: PS-0127/2025
SIGNATURES
APDCAT Processor: 04/20/2026 1:04 PM“In this resolution, the mentions of the affected entity have been hidden in order to
comply with art. 17.2 of Law 32/2010, given that in the event of revealing the name of the affected entity, the affected individuals could also be identified”.
Identification of the file
Resolution of the sanctioning procedure no. PS-0127/2025 (IP 356/2025 and IP 844/2025),
referring to the City Council of (...).
Background
1. On 07/05/2025, a complaint was received by the Catalan Data Protection Authority against the City Council of (...), due to an alleged breach of the regulations on the protection of personal data. The complainant, who was an employee of the City Council, stated that, in the agreement to initiate disciplinary proceedings against her, the entire report issued by the head of the local police had been included. This report referred to another case, relating to the activation of the protocol for situations of workplace harassment, which was unrelated to the facts that are the subject of this disciplinary case. In this sense, it considers that the duty of confidentiality and the right to data protection have been breached in the activation of the “protocol for the prevention, detection, action and resolution of situations of sexual harassment, on grounds of sex, sexual orientation, gender identity, gender expression, psychological work and other discrimination in the work environment of the City Council of (...)” (hereinafter, the protocol), with respect to its person. The complainant provided various documentation regarding the reported facts, including:
− Copy of the Mayor's decree dated 13/11/2024 (exp. no. 2341/2024/eRH), issued
by the Councilor for Finance, Talent and People Management and Organization, by which
it was agreed to initiate disciplinary proceedings against him. In the list of facts
of this decree, a report issued on 13/10/2024
by the head of the local police, regarding an incident that occurred on 24/09/2024, is transcribed verbatim. The final part of the report states the following text:
“Other information.- That I consider it relevant to provide other information, in the same sense, regarding the way of commanding the sergeant with TIP (…), due to incidents that occurred on May 27, 2023, between the corporal with TIP (…) and the sergeant with TIP (…), the former requested the activation of the protocol for situations of workplace harassment and an information file was opened to clarify the facts. The conclusions of the disciplinary file, number 2250/2023/eRH, were classified as a minor offense, of one day of suspension without work and pay, for the sergeant with TIP (…), which was prescribed […].
PAGE: 2 of 8 DATE AND TIME OF COPY GENERATION: 04/20/2026 13:05
This document is an authentic copy of the original electronic document. You can check its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=049b73af-398b-441f-ba17-5724f3949c62 The recipient
of the document must treat the secure verification code (CSV) included in the header of this document with caution, since its communication to third parties would allow them to access the content of the document.
DOCUMENTS
TYPE: Anonymized resolution
NAME: RESOL_A ca_ps_2025_127
UNIT: APDCAT Inspection and Technical Area
SECURE VERIFICATION CODE: 049b73af-398b-441f-ba17-5724f3949c62
IDENTIFIER: ES_A09018940_2026_0000000000000000000000000134574
STATUS OF PREPARATION: Definitive
LEVEL OF ACCESS:
REFERENCES
FILES: PS-0127/2025
SIGNATURES
APDCAT Processor: 20/04/2026 13:042/8
That, in parallel, the conclusions of the Commission for the activation of the file of the labor harassment protocol, identified with file 2284/2023/eRH concluded, verbatim: “The Commission concludes that there is sufficient evidence of verbal abuse and inappropriate conduct by Mr. (...) for the events of May 27 (event A). That there is no proven evidence of the existence of psychological harassment towards Mr. (…) by Mr. (…), although it has been found that the way of commanding and carrying out the supervision and control by the police sergeant over subordinates, generates discomfort and this discomfort has been present in the organization for a long time, chronicizing the situation and the discomfort in the work environment”
− Copy of the document “protocol for the prevention, detection, action and resolution of situations of sexual harassment, due to sex, sexual orientation, gender identity, gender expression, psychological work and other discriminations in the work environment”, from the City Council of (…).
2. The Authority opened a prior information phase (no. 356/2025), to determine whether the facts were likely to motivate the initiation of a sanctioning procedure, in accordance with the provisions of article 7 of Decree 278/1993, of 9 November, on the sanctioning procedure of application to the areas of competence of the Generalitat, and article 55.2 of Law 39/2015, of October 1, on the common administrative procedure of public administrations (LPAC). In this information phase, on 06/10/2025, the reported entity was required to report on the following points: − Regarding the report of the local police chief dated 13/10/2024, what was the purpose of including the data referring to file number 2284/2023/eRH in relation to the activation of the protocol. Also, which people accessed the report and the functions they exercised within the organization that justified this access. − Regarding the activation of the protocol that gave rise to file number 2284/2023/eRH, which people intervened directly in the different stages of the
procedure and what positions they held within the City Council.
− What would be the legal basis that would legitimize the inclusion in the decree dated 13/11/2024,
initiating disciplinary proceedings with file number 2341/2024/eRH, of the
transcription of the full report of the local police chief dated 13/10/2024, and in particular
the data relating to the activation of the aforementioned protocol. In the event that
this information was considered necessary to motivate the administrative act,
why was this information considered relevant to process or resolve
the disciplinary proceedings.
− Which people had access to the content of decree number 2341/2024/eRH and
what functions they performed within the organization that justified this access.
3. On 17/10/2025, the City Council of (...) responded to the request with a writing in which
it stated the following:
PAGE: 3 of 8 DATE AND TIME OF GENERATION OF THE COPY: 20/04/2026 13:05
This document is an authentic copy of the original electronic document. You can check its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=049b73af-398b-441f-ba17-5724f3949c62 The recipient
of the document must treat the secure verification code (CSV) that appears in the header of this document with caution, since its communication to third parties would allow them to access the content of the document.
DOCUMENTS
TYPE: Anonymized Resolution
NAME: RESOL_A ca_ps_2025_127
UNIT: APDCAT Inspection and Technical Area
SECURE VERIFICATION CODE: 049b73af-398b-441f-ba17-5724f3949c62
IDENTIFIER: ES_A09018940_2026_000000000000000000000000134574
STATUS OF PREPARATION: Definitive
LEVEL OF ACCESS:
REFERENCES
FILES: PS-0127/2025
SIGNATURES
APDCAT Processor: 20/04/2026 13:043/8
− Regarding the report of the local police chief dated 13/10/2024, in which the data referring to file number 2284/2023/eRH were
included in relation to
the activation of the protocol, a report issued by the local police chief inspector is provided. which states:
“That the purpose of including the data of file number 2284/2024/eRH,
in relation to the activation of the Harassment protocol followed against Sergeant (…),
was to, using the conclusions of the Protocol Commission, contextualize
his way of commanding, to record the difficulties that he
himself was having with the rest of the work team and in case it was necessary to take
some precautionary measure to avoid the conflict situation that was occurring.
That personally, as the head of the group, in the exercise of
the functions of Chief Inspector of the local police of (…), I had access to the
conclusions of the Harassment Protocol Commission. For the record, of the local police collective, I was the only person who had access to the information on these conclusions of the Commission, strictly complying with the professional secrecy of the position I hold. That I remain at your disposal for any clarification in this regard.”
− Regarding the activation of the protocol that gave rise to file number 2284/2023/eRH, related to the complainant, it is stated that the people who had access to the file were: the head of the service that executes the administrative processing of the file, the legal advisor who provides assistance and conformity to the files of the Human Resources Service, the deputy secretary of the City Council who signs the decrees, the Human Resources administrative and the mayor.
− On the legal basis that would legitimize the inclusion in the decree dated 13/11/2024
initiating disciplinary proceedings with file number 2341/2024/eRH, of the
transcription of the full report of the local police chief dated 13/10/2024 and in particular of the data relating to the activation of the protocol with file number
2284/2023/eRM related to the complainant, it is stated that the
processing
responds to the legal basis established in article 6.1.e of the RGPD, according to which
data processing is lawful when “it is necessary for the performance of a mission
carried out in the public interest or in the exercise of public powers conferred on the controller”.
According to the entity complained about, the City Council exercises public powers in the investigation of a disciplinary case, so in this context it can process personal data. It adds that the aforementioned legal basis is based on Law 39/2015, of 1 October, on the common administrative procedure of public administrations (LPAC), which establishes the minimum content of administrative acts and the need for motivation, especially in sanctioning or disciplinary procedures. Therefore, the inclusion of the report was necessary to understand the facts or substantiate the initiation, limiting the information to what is strictly relevant to justify the act in accordance with the principle of data minimization of article 5.1.c of the GDPR. − Regarding the people who had access to the decree initiating disciplinary proceedings 2341/2024-eRH, it is stated that they were: the Director of Human Resources and Internal Organization, as head of the Service that carries out the administrative processing of the disciplinary proceedings; the legal technical person who provides the PAGE: 4 of 8 DATE AND TIME OF COPY GENERATION: 04/20/2026 1:05 PM This document is an authentic copy of the original electronic document. You can check its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=049b73af-398b-441f-ba17-5724f3949c62 The recipient of the document should treat the secure verification code (CSV) contained in the header of this document with caution, since its communication to third parties would allow them to access the content of the document.
DOCUMENTS
TYPE: Anonymized Resolution
NAME: RESOL_A ca_ps_2025_127
UNIT: APDCAT Inspection and Technical Area
SECURE VERIFICATION CODE: 049b73af-398b-441f-ba17-5724f3949c62
IDENTIFIER: ES_A09018940_2026_0000000000000000000000000134574
STATUS OF PREPARATION: Definitive
ACCESS LEVEL:
REFERENCES
FILES: PS-0127/2025
SIGNATURES
APDCAT Processor: 20/04/2026 13:044/8
assistance and compliance with the files of the Human Resources Service; the Deputy Secretary of the City Council who signs the decrees; the technical specialist in human resources who processes the file; and the Councillor for Finance, Human Resources and Open Government, who signed the decree by delegated competence
4. On 05/11/2025, this Authority received, by transfer from the AEPD, a complaint against the City Council of (...), presented by the same complainant, on the grounds of an alleged breach of the regulations on the protection of personal data. The Authority opened a preliminary information phase (No. 844/2025), to determine whether the facts were likely to justify the initiation of a disciplinary procedure. Given that the facts reported in the two documents were substantially the same, this Authority decided that the preliminary information phases that were initiated as a result of the two aforementioned complaints would be investigated together.
5. On 02/12/2025, the director of the Catalan Data Protection Authority agreed to initiate disciplinary proceedings against the City Council of (...), for an alleged infringement provided for in article 83.5.a, in relation to article 5.1. f, all of them of Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR). This initiation agreement was notified to the accused entity on 02/12/2025. 6. On 16/12/2025, within the period granted to submit allegations to the agreement to initiate this sanctioning procedure, the City Council of (...) submitted a letter that was evaluated in the proposed resolution with the content contained in the 2nd legal basis.
7. On 09/02/2026, the person instructing this procedure formulated a proposed resolution by which he proposed that the director of the Catalan Data Protection Authority declare that the City Council of (...) had incurred an infringement provided for in article 83.5.a in relation to article 5.1 f; all of them of the GDPR.
This proposed resolution was notified on 10/02/2026 and a period of 10 days was granted to formulate allegations.
8. The deadline has been exceeded by far and no allegations have been presented.
Proven facts
The City Council of (...) included in a mayoral decree, initiating disciplinary proceedings
against the complainant, information relating to the activation of a protocol against workplace harassment referred to this person, transcribing verbatim a report prepared by the head of the local police. Given that the purpose of the decree was to initiate disciplinary proceedings for events that were unrelated to the events that led to the activation of the protocol, information relating to the complainant was revealed without any legal basis to justify it.
According to the operative part of the aforementioned decree, it was notified to the complainant and to the officials called the instructor and secretary. However, according to the City Council itself, up to 5 other people, all employees of the City Council, had access to it. As a result, these people were able to learn personal information about the complainant regarding the activation of the harassment protocol. PAGE: 5 of 8 DATE AND TIME OF COPY GENERATION: 04/20/2026 13:05 This document is an authentic copy of the original electronic document. You can check its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=049b73af-398b-441f-ba17-5724f3949c62 The recipient of the document must treat the secure verification code (CSV) included in the header of this document with caution, since its communication to third parties would allow them to access the content of the document. DOCUMENTS
TYPE: Anonymized Resolution
NAME: RESOL_A ca_ps_2025_127
UNIT: APDCAT Inspection and Technical Area
SECURE VERIFICATION CODE: 049b73af-398b-441f-ba17-5724f3949c62
IDENTIFIER: ES_A09018940_2026_0000000000000000000000000134574
STATUS OF PREPARATION: Definitive
ACCESS LEVEL:
REFERENCES
FILES: PS-0127/2025
SIGNATURES
APDCAT Processor: 20/04/2026 13:045/8
Legal Basis
1. The provisions of the LPAC and Article 15 of Decree
278/1993, as provided for in DT 2a of Law 32/2010, of 1 October, of the Catalan Data Protection Authority. In accordance with Articles 5 and 8 of Law
32/2010, the resolution of the sanctioning procedure corresponds to the director of the Catalan Data Protection Authority.
2. The accused entity has not made allegations in the proposed resolution, but did so in the initiation agreement. In this regard, it is considered appropriate to reiterate the most relevant of the reasoned response of the investigating person to these allegations below.
In relation to the facts that give rise to the complaint, the following
considerations should be made:
• The facts that motivated the activation of the “Protocol for the prevention, detection,
action and resolution of situations of sexual harassment, due to sex,
sexual orientation, gender identity, gender expression, psychological labor
and other discrimination in the field of work”, of the City Council of (...) and that
gave rise to the file with number 2284/2023/eRH in relation to the person
complaining, occurred on 05/23/2023.
• On 11/13/2024 it was agreed to initiate disciplinary proceedings against the person
complaining by means of the mayoral decree with file number
2341/2024/eRH, for specific facts that occurred on 09/24/2024.
• The facts that are the subject of both cases are unrelated and only have some of the people involved in common.
Secondly, it is appropriate to address the allegations that the accused entity has made in the initiation agreement and that consist of a letter that in summary states the following:
That the processing of personal data within the framework of the disciplinary procedure is based on article 6.1.e of the GDPR (exercise of public powers) in accordance with Law
39/2015 on common administrative procedure, and the specific disciplinary regulations applicable to the Local Police Force (Decree 179/2015; Law 16/1991; Internal Regulations).
The entity states, with respect to the nature of the procedure initiated as a result of the activation of the protocol, that it is essential to distinguish between the activation of the protocol and the initiation of a disciplinary procedure, given that both mechanisms have a clearly differentiated nature, purpose and legal effects. The activation of the protocol is framed within a preventive and guaranteeing scope, aimed at assessing the existence of signs of harassment and supporting the parties involved. The internal procedure is carried out in phases and concludes with a binding report issued by the Investigation Commission, which is not punitive in nature, which includes the technical assessment of the facts and, where appropriate, recommendations or preventive measures. That the inclusion of information relating to the activation of the protocol in the opening of disciplinary file number 2341/2024/eRH was limited to what is strictly necessary, in compliance with the principle of minimization (art. 5.1.c GDPR), as this information, PAGE: 6 of 8 DATE AND TIME OF COPY GENERATION: 04/20/2026 13:05 This document is an authentic copy of the original electronic document. You can check its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=049b73af-398b-441f-ba17-5724f3949c62 The recipient of the document must treat the secure verification code (CSV) that appears in the header of this document with caution, since its communication to third parties would allow them to access the content of the document.
DOCUMENTS
TYPE: Anonymized Resolution
NAME: RESOL_A ca_ps_2025_127
UNIT: APDCAT Inspection and Technical Area
SECURE VERIFICATION CODE: 049b73af-398b-441f-ba17-5724f3949c62
IDENTIFIER: ES_A09018940_2026_0000000000000000000000000134574
STATUS OF PREPARATION: Definitive
ACCESS LEVEL:
REFERENCES
FILES: PS-0127/2025
SIGNATURES
APDCAT Processor: 20/04/2026 13:046/8
in the opinion of the police chief, it was essential in order to be able to correctly analyze
the matter.
That the information incorporated into disciplinary file number 2341/2024/eRH originating from file 2284/2023/eRH was part of the rational evidence that is required in order to initiate a disciplinary procedure and that was necessary to justify the start of the investigation and motivate the agreement to open the file. These statements do not serve to undermine the facts charged or to justify the conduct in question. While it is true that administrative acts must be motivated and that a disciplinary file must have all the guarantees provided for, it has not been demonstrated that there was any relationship between the facts that are the subject of the two procedures, beyond the coincidence of the person involved. There are no reasonable indications that the activation of the protocol against workplace harassment had any impact on the investigation of the facts alleged in the agreement to initiate the disciplinary proceedings. What has become clear throughout these proceedings is that the facts allegedly alleged in the agreement to initiate the proceedings were isolated events that occurred subsequently and had no relation to the activation of the protocol for workplace harassment or its resolution. Therefore, stating the information relating to the activation of the protocol in the agreement to initiate the disciplinary proceedings is considered excessive and unnecessary, causing people outside the processing of the aforementioned protocol to have access to personal information about the complainant that was not necessary to justify the initiation of the proceedings. Even the same entity recognizes that the activation of the protocol is independent of a disciplinary proceeding since its nature and purposes are different, but in addition, the facts that are the subject of both proceedings were completely different events that occurred at different times. It has not been argued or justified in what way the knowledge of the activation of the protocol against the complainant could serve to contextualize the facts that are the subject of the disciplinary proceedings, without compromising the impartiality and objectivity of its investigation. As highlighted in the agreement to initiate this disciplinary proceeding, if the intention was to demonstrate a bad work environment, reference could have been made to this situation without detailing whether or not the protocol for workplace harassment had been activated against this person, nor its resolution. For all of the above, these allegations were not accepted. 3. In relation to the facts described in the proven facts section, it is necessary to refer to article 5.1 f of the GDPR, which provides that:
“1. Personal data shall be: (...) f) processed in such a way as to guarantee adequate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by applying appropriate technical or organisational measures (integrity and confidentiality).”
This principle of integrity and confidentiality provided for by the GDPR must be complemented by the duty of confidentiality set out in article 5 of Organic Law 3/2018, of 5
PAGE: 7 of 8 DATE AND TIME OF COPY GENERATION: 04/20/2026 13:05
This document is an authentic copy of the original electronic document. You can check its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=049b73af-398b-441f-ba17-5724f3949c62 The recipient of the document should treat the secure verification code (CSV) contained in the header of this document with caution, since its communication to third parties would allow them to access the content of the document.
DOCUMENTS
TYPE: Anonymized Resolution
NAME: RESOL_A ca_ps_2025_127
UNIT: APDCAT Inspection and Technical Area
SECURE VERIFICATION CODE: 049b73af-398b-441f-ba17-5724f3949c62
IDENTIFIER: ES_A09018940_2026_0000000000000000000000000134574
STATUS OF PREPARATION: Definitive
ACCESS LEVEL:
REFERENCES
FILES: PS-0127/2025
SIGNATURES
APDCAT Processor: 20/04/2026 13:047/8
of December, on the protection of personal data and guarantee of digital rights (LOPDGDD),
which establishes the following:
“Article 5. Duty of confidentiality
1. Data controllers and processors, as well as all persons involved in any phase of data processing, are subject to the duty of confidentiality referred to in Article 5.1.f) of Regulation (EU) 2016/679.
2. The general obligation set out in the previous section is complementary to the professional secrecy obligations in accordance with the applicable regulations.
3. The obligations established in the previous sections remain in force even if the relationship between the data subject and the controller or processor has ended.”
During the processing of this procedure, the fact described in the proven facts section has been proven, which constitutes the infringement provided for in Article 83.5.a of the GDPR, which typifies the violation of “the basic principles for processing”, which include the principle of data minimisation.
The conduct addressed here has been included as a very serious infringement in article 72.1.a of
Organic Law 3/2018, of 5 December, on the protection of personal data and the guarantee of digital rights (LOPDGDD), as follows:
“The processing of personal data that violates the principles and guarantees established in article 5 of Regulation (EU) 2016/679.
4. Article 77.2 of the LOPDGDD provides that, in the case of infringements committed by the controllers or processors listed in article 77.1 of the same law, the competent data protection authority:
“(...) must issue a resolution declaring the infringement and establishing, where appropriate, the measures that should be adopted to cease the conduct or correct the effects of the infringement that has been committed, with the exception of that provided for Article 58.2.i of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. The resolution shall be notified to the controller or processor, to the body to which he or she is hierarchically subordinate, if applicable, and to the affected parties who have the status of interested party, if applicable.” In terms similar to the LOPDGDD, Article 21.2 of Law 32/2010 determines the following: “2. In the case of infringements committed in relation to publicly owned files, the Director of the Catalan Data Protection Authority shall issue a resolution declaring the infringement and establishing the measures to be adopted to correct its effects (...).” In this case, no corrective measures are required since this is a one-time and completed event.
PAGE: 8 of 8 DATE AND TIME OF COPY GENERATION: 04/20/2026 13:05
This document is an authentic copy of the original electronic document. You can check its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=049b73af-398b-441f-ba17-5724f3949c62 The recipient of the document must treat the secure verification code (CSV) included in the header of this document with caution, since its communication to third parties would allow them to access the content of the document.
DOCUMENTS
TYPE: Anonymized Resolution
NAME: RESOL_A ca_ps_2025_127
UNIT: Inspection and Technical Area of l'APDCAT
SECURE VERIFICATION CODE: 049b73af-398b-441f-ba17-5724f3949c62
IDENTIFIER: ES_A09018940_2026_0000000000000000000000000134574
STATUS OF PREPARATION: Definitive
ACCESS LEVEL:
REFERENCES
FILES: PS-0127/2025
SIGNATURES
APDCAT Processor: 20/04/2026 13:048/8
Resolution
For all this, I resolve:
1. To declare that the City Council of (...) has committed an infringement provided for in article 83.5.a in
relation to article 5.1 f, both of the RGPD.
2. It is not necessary to require measures to correct the effects of the infringement, in accordance with what has been set out in the 4th legal basis.
3. Notify this resolution to the City Council of (...).
4. Communicate the resolution to the Catalan Ombudsman, in accordance with the provisions of article
77.5 of the LOPDGDD.
5. Order that this resolution be published on the Authority's electronic headquarters, in accordance with article 17 of Law 32/2010, of October 1.
Against this resolution, which puts an end to the administrative procedure in accordance with articles 26.2 of Law 32/2010 and 14.3 of Decree 48/2003, of February 20, by which the Statute of the Catalan Data Protection Agency is approved, the accused entity may optionally file an appeal for reconsideration with the director of the Authority Catalan Data Protection Authority, within a period of one month from the day following its notification, in accordance with the provisions of Article 123 et seq. of Law 39/2015. A contentious-administrative appeal may also be filed directly with the contentious-administrative courts of Barcelona, within a period of two months from the day following its notification, in accordance with Law 29/1998, of 13 July, regulating contentious-administrative jurisdiction. The director