The controller owned an apartment rented by the data subject, who had lived in the property since late 2021
Following a dispute concerning the tenancy and an alleged outstanding debt, the controller asked the data subject to leave the property.
Status Not cited by any decision here yet
Holding
The DPA held that the controller infringed Article 5(1)(f) GDPR. The DPA considered that (i) the landlord determined the purposes and means of that processing and therefore acted as the controller; (ii) the information disclosed by the controller constituted personal data; (iii) its communication to the data subject’s workplace qualified as processing under the GDPR; and (iv) that colleagues qualified as unauthorised third parties. The DPA then found that the disclosure to the data subject's colleagues of information relating to the data subject’s identity, contact details, employment and alleged debts breached the principles of integrity and confidentiality under Article 5(1)(f) GDPR. Taking into account the circumstances of the case, including the consequences for the data subject and the controller’s subsequent commitment to cease such communications, the DPA imposed a €200 administrative fine. Before the final decision was issued, the controller voluntarily paid the proposed fine and benefited from the 20% reduction available under Spanish Administrative Law (39/2015). The amount payable was therefore reduced to €160. The DPA nevertheless formally declared the infringement and confirmed the €200 sanction before terminating the proceedings following the voluntary payment.
From GDPRhub’s case note — a summary of the decision, not its own words. Read it in the text ↓
On 1 October 2023, the controller sent an email stating that, unless the data subject vacated the property and returned the keys, it would provide the data subject’s workplace with a report concerning the data subject’s alleged fraudulent and criminal conduct. On 4 October 2023, the controller sent an email to several email addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone number, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues. The controller then followed-up, on 6 October 2023, with another email both the company and the data subject stating that it would cease further communications. The data subject lodged a complaint with the DPA. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal to the DPA. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller.
Full text 3 findings
Machine translation of the decision, via GDPRhub — not the official text. Read the original
Case No.: EXP202403237 DECISION TO TERMINATE THE PROCEEDINGS DUE TO VOLUNTARY PAYMENT Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On November 23, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate disciplinary proceedings against A.A.A. (hereinafter, A.A.A.). Following notification of the decision to initiate proceedings, on April 30, 2026, the proposed resolution set forth below was issued: > SECOND: On May 19, 2026, A.A.A. paid the penalty in the amount of 160.00 euros, taking advantage of the reduction provided for in the proposed resolution transcribed above. LEGAL GROUNDS I Jurisdiction In accordance with the powers granted to each supervisory authority under Article 58(2) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) grants to each supervisory authority, and in accordance with Articles 47, 48.1, 64.2, and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency has jurisdiction to resolve this proceeding. Likewise, Article 63.2 of the LOPDGDD provides that: “Proceedings handled by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, this Organic Law, the adopted to implement it, and, to the extent they do not contradict them, on a subsidiary basis, by the general rules on administrative proceedings.” II Conclusion of the proceeding C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 11/13 Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter “LPACAP”), under the heading “Termination of Disciplinary Proceedings,” provides as follows: “1. Once a disciplinary proceeding has been initiated, if the offender acknowledges liability, the proceeding may be resolved by imposing the appropriate penalty.
When the penalty is solely of a pecuniary nature, or when it is appropriate to impose a pecuniary penalty and another of a non-pecuniary nature but the inappropriateness of the latter has been demonstrated, voluntary payment by the alleged offender, at any time prior to the final decision, shall result in the termination of the proceedings, except with respect to the restoration of the altered situation or the determination of compensation for damages caused by the commission of the violation.
In both cases, when the penalty is solely financial in nature, the body competent to resolve the proceeding shall apply reductions of at least 20% of the amount of the proposed penalty, which may be cumulative. The aforementioned reductions must be specified in the notice of initiation of the proceedings, and their effectiveness shall be conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty. The reduction percentage provided for in this section may be increased by regulation.” III Voluntary Payment In accordance with the provisions of the aforementioned Article 85 of the LPACAP, the notified proposed resolution allowed you to make a voluntary payment of the proposed penalty, which would result in a 20% reduction of its amount. With the application of this reduction, the penalty would be set at 160.00 euros, and its payment would result in the termination of the proceedings, without prejudice to the imposition of the corresponding measures. Following the aforementioned proposed resolution, and before a decision was issued by this authority, A.A.A., on May 19, 2026, proceeded to make the voluntarily, taking advantage of the 20% reduction. In accordance with paragraph 3 of article 85 of the LPACAP, the applicability of the aforementioned reduction is conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty. It should be noted that, in accordance with the provisions of the LPACAP, as well as the case law of the Supreme Court on this matter, the voluntary payment by the alleged offender does not exempt the administration from the obligation to resolve and notify all proceedings, regardless of how they were initiated. Similarly, Article 88 of the aforementioned law establishes that the decision that brings the proceeding to a close shall rule on all issues raised by the data subjects and any other issues arising therefrom. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 12/13 Therefore, in accordance with applicable law and after evaluating the criteria for determining the severity of penalties, the Presidency of the Spanish Data Protection Agency RESOLVES: FIRST: TO DECLARE that the violations have been committed and TO CONFIRM the penalties set forth in the operative part of the proposed resolution transcribed in the present resolution. The sum of the aforementioned amounts totals 200.00 euros. Since A.A.A. has made a voluntary payment, albeit without acknowledging liability, pursuant to Article 85 of the LPACAP, the total amount is reduced by 20%, resulting in a final amount of 160.00 euros. The effectiveness of the aforementioned reduction is contingent, in any case, upon the withdrawal or waiver of any administrative action or appeal. SECOND: TO DECLARE the termination of proceeding EXP202403237, in accordance with the provisions of Article 85 of the LPACAP. THIRD: TO NOTIFY A.A.A. of this decision. FOURTH: In accordance with the provisions of Article 85 of the LPACAP, which makes the reduction for voluntary payment conditional upon the withdrawal or waiver of any action or administrative appeal, this resolution shall be final in administrative proceedings and fully enforceable as of the date of its notification. In accordance with the provisions of Article 50 of the LOPDGDD, this resolution shall be made public. Publication shall take place once the resolution has been notified to the data subjects. This resolution, which brings the administrative proceedings to a close as provided for in Article 114.1.c) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, data subjects may file a contentious-administrative appeal before the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this decision, as provided in Article 46.1 of the aforementioned Law. However, in accordance with the provisions of Article 90.3(a) of the LPACAP, the final administrative decision may be provisionally suspended if the data subject expresses their intention to file a contentious-administrative appeal. If this is the case, the data subject must formally notify the Agency of this fact in writing to the Spanish Data Protection Agency, submitting it through the Agency’s Electronic Registry , or through any of the other registries provided for in Art 16.4 of the aforementioned Law 39/2015, of October 1 The data subject must also provide the Agency with documentation proving that the contentious-administrative appeal has been effectively filed. If the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 13/13 Agency is not notified of the filing of the contentious- administrative appeal within two months from the day following notification of this decision, it will consider the precautionary suspension to have ended. 968-101025 Lorenzo Cotino Hueso President of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es