AYUNTAMIENTO DE TOBAR – Complaint Upheld (Spain, 2020)

A citizen sent a complaint with pictures to the Spanish DPA (AEPD) because the Town Hall of Tobar had published in a board exposed in the street a list that contained the name, surname, birthday and ID number of the individuals that had been adjudicated "jury duty". The Spanish DPA (AEPD) sent a request to the Town Hall to remove such lists or to offer an explanation why the lists were published, but it was not answered. If there is a legal requirement to publish a list with personal data for certain amount of time to allow for claims and corrections, can this list be published in a public space (street) accessible to everybody that walks by or does this breach the confidentiality principle of Article 5(1)(f) GDPR? The Spanish DPA (AEPD) acknowledged that there is a legal requirement in Spanish legislation to publish a list with name, surname, birthday and ID number of the individuals that have been adjudicated "jury duty" during 7 days to allow for claims and corrections. However, they argued that to protect the confidentiality of the personal data, these lists should be published in a board inside the premises of the Town Hall and not in a public space (street) where anybody could view that data. Additionally there were indications, although it couldn't be proved by the Spanish DPA, that the lists had been exposed also for longer than they should have. Therefore, the DPA held that there was a breach of Article 5(1)(f) GDPR. For these reasons, the Spanish DPA (AEPD) issued a warning to the Town Hall of Tobar.