DPA case CN21-012 – Violation Found (Spain, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Basque Data Protection Authority found that a local police force had a legal reason to include personal data in reports sent to local authorities. However, they are still checking if this practice follows the principle of minimizing data collection. This case shows that even police must balance their needs with privacy rules.
What happened
A local police force was ordered to include full personal data in incident reports.
Who was affected
Individuals involved in incidents reported by the local police.
What the authority found
The DPA determined that the police had a legal basis for including personal data in their reports but is reviewing if this complies with data minimization rules.
Why this matters
This ruling indicates that public authorities must carefully consider privacy when handling personal data, even for security purposes.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Basque Union of Police and Emergencies asked the Basque DPA for an assessment of the processing of personal data by a local police force. The normal practice used to be that at the end of each work shift, the operator of the coordinating center generated a PDF file containing all the incidents recorded during the shift. Subsequently, the operator generated another PDF document called "News for the Mayor's Office". This second document contained all the incidents but without the personal data of the involved persons. It only included the initials of the persons‘ names. Three copies of this document were then sent to the Chief of the Police, the Mayor’s Office and the Councilman of Citizen Security. Recently, however, the local police was ordered by the Police Headquarters to change this practice and to include all the relevant personal data, such as the involved persons‘ full names and ID number, in this second file. The Chief of the Police and the City Council claimed that the practice of only including the involved persons‘ initials hindered the work of the police by not identifying the persons with whom the police had to interact. The DPA noted that there was domestic legislation in place that allowed members of local authorities with powers in the field of public security to access information relating to the performance of their duties. Consequently, the DPA held that the police had a legal basis to include the involved persons‘ full names and IDs in the files sent to the Chief of the Police, the Mayor’s Office and the Councilman of Citizen Security under Article 6(1)(c) GDPR, as well as under Article 6(1)(e) GDPR. However, the DPA also noted that it is currently assessing whether this practice is also compliant with the data minimisation principle under Article 5(1)(c) GDPR.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case CN21-012 in ES
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case CN21-012 - Spain (2022). Retrieved from cookiefines.eu
Last updated: