DPA case PS-0127/2025 – Complaint Upheld (Spain, 2026)

A Catalan city council (the controller) included, in a mayoral decree initiating disciplinary proceedings against an employee, a local police officer (the data subject), information concerning the activation of a workplace harassment protocol involving that person. The decree reproduced verbatim extracts from a report prepared by the head of the local police, referring to isolated incidents that occurred at a later date and had no connection with the initiation of the disciplinary proceedings. However, the purpose of the decree was to initiate disciplinary proceedings for matters unrelated to the facts that had led to the activation of the harassment protocol. According to the operative part of the decree, it was served on the data subject and on the officials appointed as investigating officer and secretary. Nevertheless, the controller itself acknowledged that up to five additional individuals, all of whom were council employees, had access to the decree. These individuals were therefore able to access the data subject’s personal data relating to the activation of the harassment protocol. The DPA found that the city council, as controller of the personal data included in the mayoral decree, had infringed the principles of data minimisation and integrity and confidentiality under Articles 5(1)(c) and 5(1)(f) GDPR, in conjunction with Article 83(5)(a) GDPR, by including unnecessary and excessive personal data to justify the initiation of disciplinary proceedings and allowing additional council employees to access personal data relating to the activation of the workplace harassment protocol without a legal basis. However, no corrective measures were required, as the infringement concerned an isolated and already completed incident.