APDCAT: Public body violated GDPR by disclosing audio recording to four extra recipients

"In this resolution, references to the affected entity have been redacted in order to comply with Article 17.2 of Law 32/2010, since if the name of the affected entity were disclosed, the affected individuals could also be identified." Case Identification Resolution of enforcement proceeding no. PS-0109/2025 concerning (...). Background 1. On March 12, 2025, and February 23, 2025, complaints were received by the Catalan Data Protection Authority Two written complaints regarding an alleged violation of personal data protection regulations, concerning the entities that make up the (...), group, mentioned in the heading (hereinafter, (...)). The complainant is a union representative at the public company (...), which is part of the (...) group, and stated the following: - That, on January 22, 2025, in exercising the right of access provided for in Article 15 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), the free movement of such data (GDPR), requested for personal reasons from the Data Protection Officer (DPO) of (...) access to and a copy of a telephone conversation held on January 22, 2024, with the head (...) of (...), regarding the activation of a psychological support protocol for a driver who had hit a pedestrian. - That, on February 19, 2025, the DPO sent him a copy of the conversation by email electronic mail, in an unencrypted, password-free audio file, and with copies to several people, as well as to the email of the union chapter to which he belonged, which, according to the complainant, is accessed by many people. - That the conversation was private and that, furthermore, it referred to an employee's health status. - That, after this email was sent, several employees confirmed to him that they had heard the conversation. - That, coincidentally, the email was sent a few weeks after the affected person had filed a complaint with (...) for a very serious security breach.

To prove this, he submitted, among other things, a video showing his email account, the email sent by the DPD of (...) on 02/19/2025 at 12:41 PM, the subject "REQUEST FOR IMAGES AND TELEPHONE CONVERSATION," which contained the aforementioned audio file; in the video file, it was shown how the file was clicked on and the entire conversation was heard. 2. The Authority opened a preliminary information phase regarding the complaints PAGE: 2 of 14 COPY GENERATION DATE AND TIME: 06/05/2026 11:58 This document is a true copy of the original electronic document. You can verify its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=7213843a-b65b-4e74-84d1-8ef0fa69b34f The recipient of this document must handle the secure verification code (CSV) in the header of this document with caution, as communicating it to third parties would allow them to access the document's content.

DOCUMENTS TYPE: Anonymized Resolution NAME: RESOL_A ca_ps_2025_109 UNIT: Inspection and Technical Area of the APDCAT SECURE VERIFICATION CODE: 7213843a-b65b-4e74-84d1-8ef0fa69b34f IDENTIFIER: ES_A09018940_2026_000000000000000000000000143366 PROCESSING STATUS: Final ACCESS LEVEL: REFERENCES FILES: PS-0109/2025 SIGNATURES APDCAT Processor: 06/05/2026 10:56 (IP-0146/2025 and IP-0196/2025), to determine whether the facts were sufficient grounds for initiating an enforcement proceeding, in accordance with Article 7 of the Decree 278/1993, of November 9, on the sanctioning procedure applicable to areas of competence of the Generalitat, and Article 55.2 of Law 39/2015, of October 1, on the common administrative procedure of public administrations (LPAC). In this information phase, on July 28, 2025, (...) was required to provide information on various matters related to the reported facts. 3. On July 30, 2025, (...) responded to the request with a written statement in which they stated the following: − That the request was made in his capacity as a union representative, and not for personal reasons, and on behalf of the affected driver, with the objective of denouncing the failure to activate the psychological support and legal assistance protocol. − That "it is not standard practice for (...) or the Office of the Data Protection Officer to send responses to requests for the exercise of rights to multiple recipients.

As a general rule, these communications are made on an individual basis, addressed exclusively to the data subject, with the appropriate security measures." − That "in the specific case that is the subject of this file, the response was sent to multiple recipients because the applicant himself, Mr. (...) (the complainant), included these people in the copy of his initial request. They are internal staff that he knows and who, by virtue of their function, may have access to the requested information. This action was taken in accordance with the organization's internal operations and with the intention of facilitating the management of the right of access in an operational and transparent manner." − That "the people included in the copy on the response email are professionals with responsibilities directly linked to managing the right of access and protecting the worker. Specifically: • Ms. (...), Director of Human Resources at (...). • Ms. (...), Labor Relations Specialist and Acting Head of Labor Relations. • Mr. (...), Head of Security for (...).

" All of them are individuals authorized to access the phone system in order to properly manage the right of access. Their inclusion is based on functional and operational criteria, as managing this type of request requires the coordinated intervention of several departments; it is not a relatively simple matter. Furthermore, it should be noted that Mr. (...) himself included these individuals in the copy of his initial request, which demonstrates that he himself understood they had to be involved in the process. As for the Union Section (...), its inclusion is justified for two reasons: first, because Mr. (...) copied it on his initial email; and second, because, in his capacity as a union representative, it is understood that he himself PAGE: 3 of 14 COPY GENERATION DATE AND TIME: 05/06/2026 11:58 This document is an authentic copy of the original electronic document. You can verify its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=7213843a-b65b-4e74-84d1-8ef0fa69b34f The recipient of the document must handle the secure verification code (CSV) in the header of this document with caution, as communicating it to third parties would allow them to access the document's content.

DOCUMENTS TYPE: Anonymized Resolution NAME: RESOL_A ca_ps_2025_109 UNIT: Inspection and Technical Area of the APDCAT SECURE VERIFICATION CODE: 7213843a-b65b-4e74-84d1-8ef0fa69b34f IDENTIFIER: ES_A09018940_2026_000000000000000000000000143366 PROCESSING STATUS: Final ACCESS LEVEL: REFERENCES FILES: PS-0109/2025 SIGNATURES APDCAT Processor: 06/05/2026 10:56 manages this account, which makes a response to this address pertinent as well. Certainly, this party may understand that the inclusion of a generic email may not comply with privacy principles; however, it should be contextualized that, historically (and we're talking about years) the person who always writes and communicates through the Trade Union Section's email (...) is the complainant, a fact that, at the time of responding, was understood by the DPD to mean that the only manager of this mailbox was the complainant himself. − That the complainant sent the access request email to multiple recipients, including 3 recipients who were not included as recipients of the DPD's response email (two line drivers and an email with an unknown Hotmail domain). − That the voice message was sent in good faith and responsibly.

The entity under complaint attached various documents to the submission. − That the audio file was not sent encrypted or password-protected. However, it added that "this action must be contextualized within the organization's usual practices and the corrective measures that have been adopted subsequently." − That "the content of the audio in question does not reveal any personal data beyond the names of the two people having the conversation. The content of the call is, basically, a discussion between Mr. (...) (the complainant) and the Chief (...) about whether or not to activate a psychological support protocol for a driver who had hit a pedestrian. At no point is reference made to an employee's health status, as is stated in the complaint." − That "following this same complaint filed by Mr. (…) (complainant) before the regulatory compliance officer of (...), a formal recommendation was issued to the entire organization to strengthen security measures for sending personal information, especially in the exercise of ARSOPOL rights.

As a result of this recommendation: • The systematic implementation of encryption for sent information has been initiated, starting with the internal information system. • This practice is being progressively rolled out across the entire organization through the corporate tool (...), which allows for the application of advanced security controls on shared documents, such as encryption, access control, and traceability. − This measure has been adopted as a preventive measure and for continuous improvement, with the objective of ensuring the highest level of protection for personal data in all corporate communications." PAGE: 4 of 14 COPY GENERATION DATE AND TIME: 05/06/2026 11:58 This document is a true copy of the original electronic document. You can verify its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=7213843a-b65b-4e74-84d1-8ef0fa69b34f The recipient of the document must treat the secure verification code (CSV) in the header of this document with caution, as disclosing it to third parties would allow them to access the document's content.

DOCUMENTS TYPE: Anonymized Resolution NAME: RESOL_A ca_ps_2025_109 UNIT: APDCAT Inspection and Technical Area SECURE VERIFICATION CODE: 7213843a-b65b-4e74-84d1-8ef0fa69b34f IDENTIFIER: ES_A09018940_2026_000000000000000000000000143366 PROCESSING STATUS: Final ACCESS LEVEL: REFERENCES FILES: PS-0109/2025 SIGNATURES APDCAT Processor: 06/05/2026 10:56 4/14 - That "historically, no complaints or grievances have been filed for malpractice in the handling of requests to exercise rights." - That "in light of this situation, it has been established as an internal criterion that, from now on, responses to requests for the exercise of rights will be made exclusively to the interested party, even if other parties were included in the initial request recipients in the cc line. In addition, systematic encryption of information has been implemented using the corporate tool (...), which guarantees the protection, access control, and traceability of shared documents."

(...) provided a copy of the access request that the complainant sent by email to the DPD of (...), with 7 other recipients in CC, including the trade union section to which he belongs. In the body of the email, he stated the following: "Good morning (...), (...) and (...) I request a copy or transcript of the conversation I had today with the head (...) (...), where he tells me that (...) does not want to activate the psychological support protocol for the driver (...) , who was in a hit-and-run yesterday with (...) driving (...)—a hit-and-run reported as minor, when in reality it is serious, as (...) informed him by phone. Today (...) told the driver that the injured person is (...) and that he has to go to give a statement at the police station on (...) Street, next to (...) The driver is, in my opinion, in an enormous state of anxiety and stress. I wish to state that, according to the driver, at no point was he offered psychological support by anyone.

We also request that the accident footage be placed in custody. Please note that I have had to contact (...) for legal assistance in these cases to arrange for the worker to be accompanied to the statement by the company's attorney. (...) PAGE: 5 of 14 COPY GENERATION DATE AND TIME: 06/05/2026 11:58 This document is a true copy of the original electronic document. You can verify its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=7213843a-b65b-4e74-84d1-8ef0fa69b34f The recipient of this document must treat the secure verification code (CSV) in the header of this document with caution, as disclosing it to third parties would allow them to access the document's content. DOCUMENTS TYPE: Anonymized Resolution NAME: RESOL_A ca_ps_2025_109 UNIT: APDCAT Inspection and Technical Area SECURE VERIFICATION CODE: 7213843a-b65b-4e74-84d1-8ef0fa69b34f IDENTIFIER: ES_A09018940_2026_000000000000000000000000143366 PROCESSING STATUS: Final ACCESS LEVEL: REFERENCES FILES: PS-0109/2025 SIGNATURES APDCAT Processor: 06/05/2026 10:56 5/14 (...), LOLS delegate (...)

" (...) also provided a copy of the disputed response email, sent by their DPD on 02/19/2025 to the complainant and 4 other recipients (one of them, the trade union section to which the complainant belongs), which contained the audio file of the conversation as an attachment, and in which he stated the following: "(…) In accordance with your request, I am attaching the audio recording of the conversation you had with the head of the department (…)" 4. On October 21, 2025, the Director of the Catalan Data Protection Authority decided to initiate an enforcement proceeding against (...), for an alleged violation provided for in Article 83(5)(a), in relation to Article 5(1)(a), all of them of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

This initiation agreement was notified to the entity concerned on 10/24/2025. 5. The initiation agreement granted (...) a 10-business-day period to file allegations and propose the admission of evidence it deemed appropriate to defend its interests. 6. On October 28, 2025, (...) filed objections to the initiation notice and submitted various documents. 7. On February 13, 2026, the instructor of this proceeding issued a proposed resolution recommending that the Director of the Catalan Data Protection Authority Data Protection impose a fine of 5,250 euros (five thousand two hundred fifty euros) on all entities of (...) as the party responsible for an infringement provided for in Article 83(5)(a) in relation to Article 5(1)(a), both of the GDPR. This proposed resolution was notified on 02/17/2026, and a 10-day period was granted to file objections. 8. On 02/19/2026, the entity under investigation submitted a written statement acknowledging its liability, accompanied by two annexes.

As Annex 1, it provides documentation proving the prepayment of 3,150 euros (three thousand one hundred fifty euros), corresponding to the monetary penalty proposed by the instructor in the draft resolution, once the two reductions provided for in Article 85 of the Law 39/2015, of October 1, on the common administrative procedure of public administrations (LPAC). As Annex 2, it provides documentation to prove compliance with the corrective measures proposed by the instructor. PAGE: 6 of 14 COPY GENERATION DATE AND TIME: 05/06/2026 11:58 This document is a true copy of the original electronic document. You can verify its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=7213843a-b65b-4e74-84d1-8ef0fa69b34f The recipient of the document must handle the secure verification code (CSV) in the header of this document with caution, as communicating it to third parties would allow them to access the document's content.

DOCUMENTS TYPE: Anonymized Resolution NAME: RESOL_A ca_ps_2025_109 UNIT: Inspection and Technical Area of the APDCAT SECURE VERIFICATION CODE: 7213843a-b65b-4e74-84d1-8ef0fa69b34f IDENTIFIER: ES_A09018940_2026_000000000000000000000000143366 STATUS: Final ACCESS LEVEL: REFERENCES FILES: PS-0109/2025 SIGNATURES APDCAT Processor: 06/05/2026 10:56 6/14 Proved Facts On January 22, 2025, the complainant sent an email to the DPD of (...), with 7 additional recipients in copy, requesting access to and a copy of the recording of a conversation that had with the head (...) of the (...) Center of (...) on the same day regarding the activation of a psychological support protocol for a (...) driver from (...) who had hit a pedestrian. On February 19, 2025, the DPD of (...) sent him an email with the audio file corresponding to the recording, and copied 4 more recipients from (...) on it, one of which was the generic email address of the same union chapter to which the complainant belongs, thereby revealing the conversation to all of them.

1. The LPAC and Article 15 of Decree 278/1993 are applicable to this procedure, as provided for in DT 2nd of Law 32/2010, of October 1, on the Catalan Data Protection Authority. In accordance with Articles 5 and 8 of Law 32/2010, the resolution of the sanctioning procedure is the responsibility of the Director of the Catalan Data Protection Authority. 2. In accordance with Article 85.3 of the LPAC, both admitting liability and voluntarily paying the proposed monetary penalty in advance result in a 20% reduction of the penalty amount, which are cumulative. The effectiveness of these reductions is conditioned on the withdrawal or renunciation of any administrative action or appeal against the sanction. In both cases, paragraphs 1 and 2 of Article 85 of the LPAC provide for the termination of the proceeding. Although it submitted arguments to the Notice of Initiation, the entity under investigation has not submitted arguments to the Proposed Resolution, as it has taken advantage of both options to reduce the amount of the penalty.

Nevertheless, it is considered appropriate to reiterate below the most relevant part of the reasoned response that the investigating officer gave to the objections to the initiation agreement. 2.1.- Regarding authorized communications. First, (...) it was noted that three of the recipients of the email containing the recording of the conversation were "professionals with responsibilities directly linked to the management of the right of access and the protection of the worker," "authorized to access the phone system for the purpose of properly managing the right of access"; also, that "their inclusion was based on criteria of functionality and operativeness" and that these individuals could not be considered "third parties, in the strict sense of the GDPR." These allegations were largely a reiteration of what had already been noted in the previous phase. The aforementioned recipients are the Director of People at (...), a labor relations specialist and acting Head of Labor Relations, and the Head of Security at (...).

PAGE: 7 of 14 COPY GENERATION DATE AND TIME: 06/05/2026 11:58 This document is a true copy of the original electronic document. You can verify its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=7213843a-b65b-4e74-84d1-8ef0fa69b34f The recipient of this document must handle the secure verification code (CSV) in the header of this document with caution, as communicating it to third parties would allow them to access the document's content. DOCUMENTS TYPE: Anonymized Resolution NAME: RESOL_A ca_ps_2025_109 UNIT: Inspection and Technical Area of the APDCAT SECURE VERIFICATION CODE: 7213843a-b65b-4e74-84d1-8ef0fa69b34f IDENTIFIER: ES_A09018940_2026_000000000000000000000000143366 STATUS: Final ACCESS LEVEL: REFERENCES FILES: PS-0109/2025 SIGNATURES APDCAT Processor: 06/05/2026 10:56 7/14 The fact that these individuals may have expertise in labor or security matters does not, in and of itself, justify their access to the recording of an employee's phone conversation.

This does not analyze whether or not they are third parties. The issue here is to analyze the sending of the response to a request for access to personal data, in the exercise of the right provided for in Article 15 of the GDPR. And on this point, there is no doubt: the response must be sent only to the data subject. Therefore, the sending of the recording to these recipients can in no way be justified by the need to perform a contract, as (...) maintains, since no contract can legitimize a processing that constitutes an illegitimate interference with the fundamental right to data protection. And it is illegitimate because, if the purpose of sending this email to these three people was to inform them of the fulfillment of the obligation to respond to the access request, this could have been accomplished without sending them the recording, for example, by sending another informational email to these three recipients.

In the written arguments, (...) added for the first time that these people had already heard the conversation, and that they were indispensable for the complainant to be able to hear it, since "they were the ones who made it possible." Setting aside that (...) did not prove the necessity of this access and that it is not plausible, the issue is that what is being imputed here is sending an email to these people with a conversation that should only have been addressed to the data subject. And on this point, there is no doubt that sending it to these other recipients was not something necessary for the complainant to access the recording. Nor was it something necessary for those people to carry out their duties. Furthermore, regarding the sending of the conversation to the generic email address of the union section (...) (...) justified this by stating that the complainant had included this address in the email requesting access, and that (...) understood the complainant was the person who managed this account.

These allegations were also a reiteration of those presented in the previous phase. It is not plausible that (...) does not know the workers who make up this union section, nor is it reasonable that the complainant would have sent the request to this address if he were its only user. In fact, one of the complainant's reasons for complaint was that his colleagues from the union chapter told him they had overheard his private conversation. In any case, as was already stated in the opening decision, if the DPD had doubts about the nature of the request and about the recipients of the response, it should have clarified those doubts before sending the response. 2.2.- On the nature of the access request. Next, (...) noted that the access request was drafted in ambiguous terms when it came to determining whether the requester's intention was to disseminate the requested information to all recipients.

This issue is already mentioned in the initiation agreement. It was noted there that, certainly, the access request was phrased in a way that could be confusing, in that it might lead one to think, albeit incorrectly, that the requester wanted the response sent to all the recipients to whom they had sent the request PAGE: 8 of 14 COPY GENERATION DATE AND TIME: 05/06/2026 11:58 This document is a true copy of the original electronic document. You can verify its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=7213843a-b65b-4e74-84d1-8ef0fa69b34f The recipient of the document must handle the secure verification code (CSV) in the header of this document with caution, as communicating it to third parties would allow them to access the document's content. DOCUMENTS TYPE: Anonymized Resolution NAME: RESOL_A ca_ps_2025_109 UNIT: Inspection and Technical Area of the APDCAT SECURE VERIFICATION CODE: 7213843a-b65b-4e74-84d1-8ef0fa69b34f IDENTIFIER: ES_A09018940_2026_000000000000000000000000143366 PROCESSING STATUS: Final ACCESS LEVEL: REFERENCES FILES: PS-0109/2025 SIGNATURES APDCAT Processor: 05/06/2026 10:56 8/14 of access.

Thus, certain words were used in the body of the email, such as the first-person plural verb form, the email signature, etc., which could give that impression. However, as was noted, it cannot be denied that the complainant sent an access request to the Data Protection Officer, and not to the unit responsible for storing the recording, nor to the control center to which he made the call, nor to the Human Resources Manager of (...). This is an important indicator that the access request had to be framed as the exercise of the right of access provided for in Article 15 of the GDPR. Because otherwise, it is not understood why the complainant would have addressed the request to the DPO, and not to one of the aforementioned units. Therefore, the response had to be given only to the complainant. And if the Data Protection Officer had doubts about the nature of the request, or about the complainant's willingness to make their private conversation public, what they should have done beforehand is request clarification of the terms of the request.

But not sending the response directly to everyone. Precisely for this reason, the doctrine of estoppel cannot be invoked, as was done (...), since the fact that the complainant sent the access request email to 7 recipients did not unequivocally indicate that he wanted the response sent to all of them. And the fact of copying them all on the email was not incompatible with the recording of the conversation being sent only to him. Furthermore, the fact that the DPD did not send the response email to 3 of the recipients of the complainant's initial email is indicative that the inclusion of the 4 additional recipients by the complainant was not an oversight or an unintentional error, but a conscious act, albeit one done without due diligence. While in another case the terms in which the access request was formulated could alter the degree of reprehensibility of the conduct in question, this cannot be the case here, as the Data Protection Officer is held to a higher standard of diligence.

Therefore, this allegation cannot succeed. 2.3.- On the volume of requests managed and the principle of proportionality. In the third section of the written statement of objections, (...) stated that in recent years it had managed a very high volume of data protection rights requests, and that it had never recorded any incident, complaint, or complaint of malpractice in the handling of rights requests. And in the fourth paragraph of the same document, it was stated that, in accordance with the principle of proportionality, the conduct in question could not be classified as a very serious offense nor serious, but rather minor, and that consequently the opening of an enforcement proceeding was not justified, or that in any case the monetary penalty should be replaced with a warning (Art. 58(2)(b) GDPR). PAGE: 9 of 14 COPY GENERATION DATE AND TIME: 05/06/2026 11:58 This document is a true copy of the original electronic document.

You can verify its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=7213843a-b65b-4e74-84d1-8ef0fa69b34f The recipient of the document must handle the secure verification code (CSV) in the header of this document with caution, as communicating it to third parties would allow them to access the document's content. DOCUMENTS TYPE: Anonymized Resolution NAME: RESOL_A ca_ps_2025_109 UNIT: Inspection and Technical Area of the APDCAT SECURE VERIFICATION CODE: 7213843a-b65b-4e74-84d1-8ef0fa69b34f IDENTIFIER: ES_A09018940_2026_000000000000000000000000143366 STATUS: Final ACCESS LEVEL: REFERENCES FILES: PS-0109/2025 SIGNATURES APDCAT Processor: 06/05/2026 10:56 9/14 As noted in the proposal, these allegations do not alter the facts charged but rather the classification of the infringement, or the severity of the sanction, as was done in the proposal and set forth in legal grounds 3rd and 4th. 3.

Legal Classification of the Proven Facts With respect to the conduct described in the established facts section, we must refer to Article 5.1.a of the GDPR, which provides that personal data must be processed: "(...) in a lawful, fair and transparent manner in relation to the data subject ('lawfulness, fairness and transparency'). For a conduct to be lawful, it is necessary that one of the legal bases provided for in Article 6 of the GDPR is present. In this regard, it should be noted that in accordance with Articles 12 and 15 of the GDPR, the controller ((...)) must provide the requested information to the data subject exercising the right of access. Therefore, these articles do not allow the information to be communicated to persons other than the individual exercising the GDPR's right of access. And this is because, according to the guidelines 01/2022 of the European Data Protection Committee, the general objective of the right of access is "to provide individuals with sufficient, transparent, and easily accessible information about the processing of their personal data, so that they can be aware of and verify the lawfulness of the processing and the accuracy of the data processed.

And this may justify, although it is not a condition, that the person exercise other rights, such as the right to erasure or rectification." This imputed fact constitutes an infringement, as provided for in Article 83.5.a of the GDPR, which thus typifies the violation of "the basic principles for processing," among which is the principle of lawfulness (5.1.a GDPR). The conduct at issue here is classified as a very serious infringement in Article 72.1.a of the LOPDGDD, as follows: "a) The processing of personal data that violates the principles and guarantees established in Article 5 of Regulation (EU) 2016/679." In the written statement of objections to the notice of initiation, (...) stated that several paragraphs of Article 83.2 of the GDPR were applicable, and on that basis argued that the facts alleged could not be considered a serious infringement. In this regard, it is sufficient to note that Article 83.2 of the GDPR sets out the criteria to be taken into account in determining the level of the administrative fine, and not in the decision of whether or not to impose an administrative fine.

On the other hand, the GDPR clearly establishes that processing that violates the principle of lawfulness constitutes a very serious infringement. It is another matter whether the criteria that (...) pointed out can be applied in grading the sanction, as the instructor proposed, and this is provided for in the following legal basis. PAGE: 10 of 14 COPY GENERATION DATE AND TIME: 06/05/2026 11:58 This document is a true copy of the original electronic document. You can verify its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=7213843a-b65b-4e74-84d1-8ef0fa69b34f The recipient of the document must handle the secure verification code (CSV) in the header of this document with caution, as communicating it to third parties would allow them to access the document's content. DOCUMENTS TYPE: Anonymized Resolution NAME: RESOL_A ca_ps_2025_109 UNIT: Inspection and Technical Area of the APDCAT SECURE VERIFICATION CODE: 7213843a-b65b-4e74-84d1-8ef0fa69b34f IDENTIFIER: ES_A09018940_2026_000000000000000000000000143366 PROCESSING STATUS: Final ACCESS LEVEL: REFERENCES FILES: PS-0109/2025 SIGNATURES APDCAT Processor: 06/05/2026 10:56 10/14 4.

Sanction imposed: fine Since entities from (...) do not fall under any of the subjects provided for in Article 77.1 of the LOPDGDD, the general sanctioning regime provided for in Article 83 of the GDPR applies. Below are the criteria that have been applied to determine the fine, which follow the provisions of Article 83 of the GDPR, in accordance with the CEPD's 04/2022 guidelines on the calculation of fines under the GDPR. 4.1. Maximum fine: €27,209,243.68 Article 83.5 of the GDPR provides for an administrative fine of up to 20,000,000 euros or, in the case of an undertaking, an amount equivalent to up to 4% of the total worldwide annual turnover of the previous financial year, and the higher amount must be chosen. The same transparency portal publishes the income statements for the group (...) for the year 2024, and these report that the net amount of the revenue for that year was €680,231,092.07.

In this regard, as established by the Court of Justice of the European Union, a company's volume of business can be an indication of its size and economic power (see case T-25/06 Alliance One International, Inc. v. European Commission). As previously noted, pursuant to Article 83(5), the maximum fine is €20,000,000 or 4% of the turnover. In this case, considering that 4% of the turnover of €680,231,092.07 represents 27,209,243.68 euros, the amount the Authority must take as the reference, as the maximum limit for the amount of the fine for this imputed offense, is 27,209,243.68 euros. 4.2. Starting point. As a starting point for determining the fine, the following factors have been taken into account: - Turnover: exceeds 250 million euros. - Nature of the infringement: very serious (Art. 83.5 GDPR). - Gravity of the specific infringement committed: low (the following circumstances are taken into account: the categories of data subjects concerned -art. 83.2.g GDPR-; the intentional or negligent nature of the breach -art. 83.2.b GDPR- and the nature, gravity, and duration of the breach -art. 83.2.a GDPR-.

The latter, taking into account that the severity of the infringement, in turn, involves assessing: the nature, scope, and purpose of the processing, as well as the number of data subjects and the damages and losses caused. Assessing these circumstances precludes their subsequent use as mitigating or aggravating factors.) PAGE: 11 of 14 COPY GENERATION DATE AND TIME: 05/06/2026 11:58 This document is an authentic copy of the original electronic document. You can verify its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=7213843a-b65b-4e74-84d1-8ef0fa69b34f The recipient of this document must handle the secure verification code (CSV) in the header of this document with caution, as communicating it to third parties would allow them to access the document's content. DOCUMENTS TYPE: Anonymized Resolution NAME: RESOL_A ca_ps_2025_109 UNIT: APDCAT Inspection and Technical Area SECURE VERIFICATION CODE: 7213843a-b65b-4e74-84d1-8ef0fa69b34f IDENTIFIER: ES_A09018940_2026_000000000000000000000000143366 PROCESSING STATUS: Final ACCESS LEVEL: REFERENCES FILES: PS-0109/2025 SIGNATURES APDCAT Processor: 06/05/2026 10:56 11/14 In this case, it has been determined that the disclosure of information occurred within the internal or workplace sphere of (...); that it was a one-time act affecting four people; In particular, the very email by which the complainant requested a copy of their conversation already contained much of the information in the disclosed recording, including information regarding the health status of the driver involved in the accident involving (...)".

This fact limits the disclosure of information as a result of the mistaken sending of the private conversation to the 4 aforementioned recipients (Art. 83.2.a GDPR). In contrast, it was also determined that sending the private conversation to those recipients constituted an interference with the complainant's right to data protection in the genuine sense of the right to freely dispose of their data, and that it indirectly affected their right to freedom of communication. Regarding the latter, although the complainant knew that his conversation was being recorded, he had an expectation of privacy. Moreover, in light of the exercise of the right of access (Art. 83(2)(a) GDPR). On the other hand, it has been considered that, although the recording referred to the driver's health data of (...), this information was already contained in the complainant's email (art. 83.2.g GDPR). Based on these factors, the starting amount of the fine is: 16,250 euros. 4.3.

Mitigating factors: 15,000 euros — The fact that the access request was copied to seven other recipients. This circumstance acts as a mitigating factor for the base amount of the fine, which is applied in an exceptional manner, considering the specific circumstances of the case, for an amount equivalent to 7,000 euros, as it compromises the data protection when the complainant exercises a right of access by including a copy of the request email. to a plurality of individuals, which, as stated, created confusion in responding that, although not justified in form, it can operate as a mitigating factor under the indicated terms (Article 83.2.k GDPR). — The lack of benefits obtained as a consequence of the commission of the infringement (Art. 83.2.k GDPR and Art. 76.2.c LOPDGDD): this circumstance acts as a mitigating factor for the starting amount of the fine, equivalent to 4,000 euros. — The implementation of information encryption using the corporate tool (...), for the purpose of ensuring the protection, access control, and traceability of documents shared (Art. 83.2.k GDPR (the correction of internal criteria regarding the individual response to a personal data access request cannot be considered a mitigating factor): this circumstance acts as a mitigating factor for the starting amount of the fine, which is equivalent to 4,000 euros. 4.4.

Aggravating factors: €4,000 — The link between the activity of (...) and the routine processing of personal data (Art. 83.2.k GDPR and 76.2.b LOPDGDD). This circumstance increases the base amount of the fine by 2,000 euros. PAGE: 12 of 14 COPY GENERATION DATE AND TIME: 06/05/2026 11:58 This document is a true copy of the original electronic document. You can verify its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=7213843a-b65b-4e74-84d1-8ef0fa69b34f The recipient of this document must handle the secure verification code (CSV) in the header of this document with caution, as disclosing it to third parties would allow them to access the document's content. DOCUMENTS TYPE: Anonymized Resolution NAME: RESOL_A ca_ps_2025_109 UNIT: Inspection and Technical Area of the APDCAT SECURE VERIFICATION CODE: 7213843a-b65b-4e74-84d1-8ef0fa69b34f IDENTIFIER: ES_A09018940_2026_000000000000000000000000143366 PROCESSING STATUS: Final ACCESS LEVEL: REFERENCES FILES: PS-0109/2025 SIGNATURES APDCAT Processor: 06/05/2026 10:56 12/14 — The existence of prior infringements committed by the data controller (art. 83.2(e) GDPR).

According to the available data, prior to the initiation of this sanctioning procedure, the Authority has sanctioned the entity now under investigation on several occasions. Specifically, it imposed monetary fines in connection with sanctioning proceedings no. (...), for the commission of various data protection violations. And with regard to the exercise of rights, the ADPCAT upheld the claims in right protection proceedings no. (...). This circumstance increases the base amount of the fine by 2,000 euros. 4.5. Resulting fine amount: 5,250 euros The base amount indicated in point 4.2 has been subject to the following: - The total amount of aggravating circumstances has been added. - The total amount of aggravating circumstances has been added. Accordingly, (...) is fined 5,250 euros (five thousand two hundred fifty euros). This amount is considered proportionate, effective, and dissuasive.

Furthermore, the following circumstances that (...) raised in the written statement of objections to the notice of initiation cannot be accepted, for the reasons the instructor indicated in the proposal, which are confirmed: - As for intent or negligence (Art. 83.2.b GDPR): this circumstance cannot be considered mitigating, as the facts imputed do not question, as (...) maintained, that the DPD acted in good faith or without the intent to violate the regulation, but are based on the lack of due diligence required of them by reason of their functions. - With regard to the measures taken to mitigate the damage suffered (Art. 83.2.c GDPR): this circumstance cannot be considered mitigating, as the actions that (...) stated it had taken did not mitigate the effects of the infringement. Furthermore, these actions have already been considered as a mitigating circumstance in section 4.3). - Regarding the degree of responsibility of the controller (Art. 83.2.d GDPR): this circumstance cannot be considered a mitigating factor, as it is not considered that with the technical measures that (...) indicated it had implemented after the fact, it went beyond the obligations incumbent upon it as the data controller. - Regarding the degree of cooperation with the APDCAT (Art. 83(2)(f) GDPR): this circumstance cannot be considered mitigating, as the action that (...) manifested to justify its application (having responded to the information request two days later, and having provided certain documentation) has not limited the negative consequences that the imputed facts have caused to the affected individuals, especially the complainant.

PAGE: 13 of 14 COPY GENERATION DATE AND TIME: 05/06/2026 11:58 This document is an authentic copy of the original electronic document. You can verify its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=7213843a-b65b-4e74-84d1-8ef0fa69b34f The recipient of the document must handle the secure verification code (CSV) in the header of this document with caution, as communicating it to third parties would allow them to access the document's content. DOCUMENTS TYPE: Anonymized Resolution NAME: RESOL_A ca_ps_2025_109 UNIT: Inspection and Technical Area of the APDCAT SECURE VERIFICATION CODE: 7213843a-b65b-4e74-84d1-8ef0fa69b34f IDENTIFIER: ES_A09018940_2026_000000000000000000000000143366 DRAFT STATUS: Final ACCESS LEVEL: REFERENCES FILES: PS-0109/2025 SIGNATURES APDCAT Processor: 06/05/2026 10:56 13/14 - With regard to the circumstances provided for in Art. 83.2.h of the GDPR (the manner in which the APDCAT became aware of the complaint), Art. 83.2.i of the GDPR (the compliance with measures previously ordered by the APDCAT), and Art. 83.2.j of the GDPR (adherence to codes of conduct or certification schemes): these circumstances cannot be considered mitigating, as the APDCAT became aware of the alleged facts as a result of a complaint; the APDCAT has not ordered (...) to comply with any measures related to the imputed facts; and (...) is not a party to any codes of conduct nor does it hold any certificates of conformity. 5.

Reduction of the sanction In accordance with Article 85.3 of the LPAC and as set forth in the notice of initiation and the proposed resolution, if before the resolution of the sanctioning proceeding the entity the entity imputed acknowledges its liability or voluntarily pays the monetary penalty, a 20% reduction shall be applied to the amount of the provisionally quantified penalty. If both conditions are met, the reduction is applied cumulatively (40%). As previously indicated, the effectiveness of these reductions is conditioned on the withdrawal or renunciation of any action or appeal in the administrative process against the sanction (Art. 85.3 of the LPAC, in fine). As indicated in the background, by means of a document dated 02/19/2026, (...) has acknowledged their liability. Likewise, on the same date, they have paid in advance 3,150 euros (three thousand one hundred fifty euros), corresponding to the amount of the penalty resulting from the application of the 40% cumulative reduction. 6.

Corrective Measures In light of the findings of the violations provided for in Article 83 of the GDPR in relation to files or processing owned by private entities, Article 21.3 of Law 32/2010, of October 1 October, on the Catalan Data Protection Authority, authorizes the Director of the Authority to have the resolution declaring the infringement establish the appropriate measures to cease or correct its effects. As a corrective measure, the instructor proposed that (...) require all recipients of the February 19, 2025 email, other than the complainant, to delete the file containing the recording of the disputed conversation, as well as the email itself. On February 19, 2026, (...) provided a copy of an email sent by its DPD on the same date and addressed to the four recipients of the aforementioned email, in which it requests the deletion of the audio file of the disputed recording, as well as the email itself.

Therefore, it is not appropriate to require the adoption of corrective measures. PAGE: 14 of 14 COPY GENERATION DATE AND TIME: 06/05/2026 11:58 This document is a true copy of the original electronic document. You can verify its validity at https://tramits.apdcat.cat/Ciutadania/ValidarDocuments.aspx?csv=7213843a-b65b-4e74-84d1-8ef0fa69b34f The recipient of this document must handle the secure verification code (CSV) in the header of this document with caution, as communicating it to third parties would allow them to access the document's content. DOCUMENTS TYPE: Anonymized resolution NAME: RESOL_A ca_ps_2025_109 UNIT: Inspection and Technical Area of the APDCAT SECURE VERIFICATION CODE: 7213843a-b65b-4e74-84d1-8ef0fa69b34f IDENTIFIER: ES_A09018940_2026_000000000000000000000000143366 STATUS: Final ACCESS LEVEL: REFERENCES FILES: PS-0109/2025 SIGNATURES APDCAT Processor: 06/05/2026 10:56 14/14 Resolution Therefore, I resolve: 1.

To impose on all entities of (...) the sanction of a fine of 5,250 euros (five thousand two hundred fifty euros), as the party responsible for an infringement provided for in article 83.5.a in relation to Article 5.1.a, both of the GDPR, with the possibility of reducing the fine on the terms set forth in the 5th legal basis. 2. To declare that the entities of (...) have made an advance payment of three thousand one hundred fifty euros (€3,150), which corresponds to the total amount of the imposed sanction, once the 40% deduction corresponding to the reductions provided for in Article 85 of the LPAC has been applied. 3. It is not necessary to require measures to correct the effects of the infringement, in accordance with what has been set forth in the 6th Consideration of this resolution. 4. Notify this resolution to all entities in (...). 5. Order that this resolution be published on the Authority's electronic headquarters, in accordance with Article 17 of Law 32/2010 of October 1.