The DPA held that a municipality violated Article 5(1)(f) GDPR after examination papers containing personal data were disposed of without being destroyed and subsequently accessed by third parties

The DPA held that a municipality violated Article 5(1)(f) GDPR after examination papers containing personal data were disposed of without being destroyed and subsequently accessed by third parties. English Summary. Facts. The DPA became aware that examination papers from an employment-training programme managed by Canals City Council, the controller, had been found next to waste containers in a public area. The documents concerned three participants and contained their names, surnames, national identification numbers and exam results. The papers had not been destroyed before disposal and were accessible to passers-by. Photographs of some of the documents were also published on social media. The controller explained that the documents had been set aside for shredding but were mistakenly placed in the general waste. It acknowledged the incident and subsequently revised its document-disposal procedure. Holding. The DPA found that the controller had violated Article 5(1)(f) GDPR. The DPA c