ASOCIACIÓN DE VIGILANTES DE SEGURIDAD DEL AEROPUERTO DE BARCELONA – €1,800 Fine (Spain, 2020)

A member of the trade union representation committee distributed a census of the workers through a WhatsApp group, in which there were private non-corporate phones. The data controller claimed that he did this so that employees could check whether their data were correct. A worker, whose data had been disseminated in this way, complained to the Spanish DPA that the confidentiality of the processing had been breached. Does the distribution of the census of workers through a Whatsapp group constitute a violation of Article 5 (1) (f) GDPR? The Spanish DPA held that were clear indications that the defendant infringed Article 5 (1) (f) GDPR, principles relating to processing with the duty of confidentiality. This duty of confidentiality, previously a duty of secrecy, does have the purpose to prevent the leakage of data that is not consented to by the holders of the same. Therefore, this duty of confidentiality is an obligation that does not only to the person responsible for and in charge of the processing but to anyone who any phase of the treatment and complementary to the duty of professional secrecy. The fact that it was a non-intentional negligent action, that basic personal identifiers were affected, and that no subsequent prevention measures were carried out of the infringement was considered aggravating factors, determining the amount of the fine in €3000. This amount was reduced by the person responsible for benefiting from the corresponding legal reductions.