The AEPD fines B.B.B. for publishing personal data without consent
The Spanish Agency from Data Protection imposed a sanction on B.B.B., linked to APEDANICA, for publishing judicial and administrative documentation on the internet that contained personal and sensitive data of several claimants, without applying measures for anonymisation. The resolution considers the principle of data minimisation to have been violated GDPR.
Online reputation lawyers
Spanish Data Protection Agency
Organ
B.B.B. (APEDANICA)
Counterpart
Data protection
Material
Fine of €10,000 and GDPR infringement
Result
Case summary
B.B.B., under the direction of APEDANICA, published judicial and administrative documentation on its website which included personal and sensitive data of various claimants.
The information presented included full names, DNI/NIF numbers and other data linked to private procedures and situations, without the content having been properly anonymised.
The publication of this documentation resulted in a breach of the personal data protection rights of those affected, who went to the Spanish Data Protection Agency to report the incident.
What were the parties discussing?
The claimants alleged that their personal data had been published openly on the internet without their consent and without sufficient justification for doing so.
Furthermore, they alleged that the information disseminated had not been minimised or anonymised, despite containing data that was particularly sensitive from a privacy perspective.
The main issue was to determine whether the publication of those documents respected the principles of GDPR, particularly data minimisation.
What did Honoralia do?
Honoralia analysed the published documentation, assessed the scope of the personal data exposure, and prepared the appropriate legal strategy for the defence of those affected.
Based on that analysis, the claim was submitted to the Spanish Data Protection Agency, highlighting that the publication contained more data than strictly necessary and that this dissemination infringed the rights of the claimants.
Our work focused on documenting the breach, establishing that personal data had been improperly disclosed, and providing a legal basis for the breach of data protection regulations.
What was the AEPD’s decision?
The Spanish Data Protection Agency initiated disciplinary proceedings and concluded that there had been a breach of the Article 5.1(c) of the GDPR, relating to the principle of data minimisation.
As a consequence, he imposed on B.B.B. a an administrative fine of 10,000 euros, on the grounds that the publication of that documentation did not comply with the legal requirements regarding the protection of personal data.
The ruling makes it clear that it is not sufficient to invoke a journalistic or documentary context if the information disclosed goes beyond what is necessary and infringes on the privacy of third parties.
The processing of personal data must always comply with the principles of GDPR, especially with data minimisation.
Why is this case significant?
This case reinforces the view that data protection must also be respected when judicial or administrative documents are published on the internet.
Resolution demonstrates that the dissemination of personal information is not automatically protected by virtue of being part of a file or an administrative proceeding if measures are not taken. anonymisation.
Furthermore, it serves as a warning to associations, platforms and individuals who publish documentation with third-party data without properly assessing the impact on their privacy.
Honoralia's work
Honoralia’s legal team took charge of the strategic management of the case from the perspective of data protection and the online reputation.
Our work involved analysing the published content, identifying the infringement, drafting the complaint and defending the rights of the individuals concerned before the Spanish Data Protection Agency.
We take action to prevent the unauthorised disclosure of personal information and to ensure an effective response to unlawful data processing.
Case file
Customer
Individuals (various claimants)
Area
Data protection
Service
Complaint and claim to the AEPD
Organisation
Spanish Data Protection Agency
Applicable legislation
GDPR * Art. 5.1.c) Data minimisation principle
Impact
Data protection and correction of an unlawful publication
Case process
1
Detection of the publication
The existence of documentation published online containing personal and sensitive data of those affected has been identified.
2
Legal analysis
Honoralia reviews the content and verifies that the information published has not been anonymised and breaches the principles of the GDPR.
3
Claim preparation
Evidence is gathered, the unauthorised disclosure of data is documented, and legal action is prepared.
4
Procedure before the AEPD
The Agency is investigating the facts and initiating the relevant disciplinary proceedings.
5
Decision and penalty
The AEPD concludes that there is a breach of the data minimisation principle and imposes a fine of €10,000.
Legal and practical impact
Strengthens data protection
It confirms that personal data may not be disclosed publicly without a legitimate basis and without complying with the limits of the GDPR.
Sanction non-compliance
The AEPD takes action against conduct that violates regulations and imposes sanctions when there is undue exposure of data.
Protects privacy
Prevent personal and sensitive information from being accessible on the internet without adequate control or justification.
Defend the rights of those affected
Remember that individuals can make claims when their data is processed unlawfully and obtain an effective response.
We protect your privacy and your online reputation
If your personal data has been published on the internet without your consent or in violation of data protection regulations, Honoralia can help you claim and defend your rights.