Ayuntamiento de Burgos (Burgos City Hall) – Violation Found (Spain, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Burgos City Hall accidentally shared personal data by not using the BCC option in an email. The Spanish data protection authority warned them for not protecting privacy properly. This case highlights the importance of safeguarding personal information in digital communications.
What happened
Burgos City Hall shared personal data in an email without using the BCC option.
Who was affected
Individuals involved in a conciliation procedure whose email addresses and personal data were disclosed.
What the authority found
The Spanish data protection authority found Burgos City Hall violated GDPR principles of purpose limitation and integrity and confidentiality.
Why this matters
This case serves as a reminder for organizations to use proper email practices to protect personal data. It underscores the need for businesses to ensure they have measures in place to prevent accidental data exposure.
GDPR Articles Cited
In the context of a conciliation procedure, the Burgos City Council summoned the conflicting parties via email. In doing so, the Council did not use the BCC option therefore disclosing the email address of one of the parties involved and other personal data. The affected party filed a complaint with the Spanish DPA. Is the sharing via email of the ID card and a complaint made with the parties of an arbitration settlement without using the BCC option a violation of Article 5 (1) GDPR? The Spanish DPA imposed a warning penalty on the Municipality of Burgos, under Article 83 (5) GDPR, for infringing Articles 5(1)(b) GDPR and 5(1)(f) GDPR. The Spanish DPA also requested Burgos City Council to prove within one month that it had adopted the necessary measures to comply with the principles of "purpose limitation" and "integrity and confidentiality" under Article 5(1)(b) and (f) of the GDPR.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for Ayuntamiento de Burgos (Burgos City Hall) in ES
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Ayuntamiento de Burgos (Burgos City Hall) - Spain (2020). Retrieved from cookiefines.eu
Last updated: