ASOCIACIÓN DE TÉCNICOS Y PROFESIONALES DEL SECTOR AEROESPACIAL – Violation Found (Spain, 2020)

ATPSA's union representative at ITP Aero in Aljavir had sent the electoral roll, which includes the data of the employees, by email to different people addresses inside and outside the company, without the consent of the employers. The defendant did not make any allegations, nor did it demonstrate that it had fulfilled its proactive obligation to respect the GDPR when processing data. Does the fact of sending the electoral roll, which includes the personal data of the claimant, by email to different addresses within the company and outside it, constitute a violation of Article 5 (1) (f) of the RGPD? For infringing Article 5(1)(f) GDPR, in conjunction with Article 72(1)(a) LOPDGDD, the Spanish DPA imposed the sanction of warning under Article 83(5)(a) GDPR. The Spanish DPA required the claimed party to provide evidence within one month that appropriate technical or organizational measures have been taken to ensure adequate security for the personal data it is processing, including protection against unauthorized or unlawful processing and loss, accidental destruction, or damage.