Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Property Owner Community: Non-compliance with general data processing principles

€1,200 Fine
Property Owner Community
SPAIN
Art. 5 GDPR
IP Address Controllers Anonymization Processing Agreement Processing Security Data Controller Supervisory Authorities
Jan 21, 2022 Source

How it connects

Related across sources

News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet Guidance Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 EDPB Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Guidance Opinion 15/2025 on the draft decision of the Austrian Supervisory Authority (AT SA) regarding the certification criteria of BDO Consulting GmbH EDPB Case Law VB v Natsionalna agentsia za prihodite CJEU Case Law Deutsche Wohnen SE v Staatsanwaltschaft Berlin CJEU

Full text

The Spanish DPA (AEPD) has fined a property owners' community EUR 1,200. A property manager had sent a copy of the general meeting minutes to the director of the security company 'CMM Seguridad'. The document the said document contains the names and addresses of residents, a list of defaulters and the accounts with all income and expenses of the community. According to the controller, the purpose of sending the minutes in question to the security company was to inform them about the members of the Board of Directors appointed at the respective ordinary general meeting. Therefore, the controller should have limited to only providing this information or to transmitting the minutes document after it had been duly anonymized. For this reason, the DPA notes that the transmission of the full minutes would not have been necessary. As a result, the controller violated the principle of data minimization.

Industry: Individuals and Private Associations

Original document at the source www.aepd.es

Similar Content