CABRERA & GIL ABOGADOS, S.L.P – €2,000 Fine (Spain, 2020)

A lawyer from the Cabrera y Gil law firm, sent a letter to a third company, providing the knowledge of the personal data and private address without the knowledge or consent of the data subject for that purpose, being that company totally unrelated to the applicant, without any corporate, labour or shareholder relationship or any other relation. The law firm in question sent a reply to the AEPD's request for information, claiming that the procedure for security breach and/or leakage of confidential information and personal data of the company itself had been carried out. They also justified that all processing of personal data was carried out for the purpose of providing legal defense and representation before the courts, as provided for in Article 24 of the Spanish Constitution. At the same time, they replied that the protection of information has been carried out in a correct manner, respecting the three basic principles: confidentiality. integrity and availability. From the law firm, they defend that the processing of data serves a legitimate purpose as set out in Article 6 (1) (f) GDPR, since it is necessary to carry out their work of defence and legal representation. Is the processing of personal data for legal defense purposes a situation that complies with legitimate purposes, as stated in article 6 (1) (f) GDPR? On 20/07/20, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the entity complained of for failing to comply with the provisions of the regulations in force and imposing on the entity complained of a sanction of EUR 2000 (two thousand euros) for the infringement of Article 6 of the RGPD.