DIRECCIÓN GENERAL DE LA GUARDIA CIVIL – Complaint Upheld (Spain, 2021)

The Spanish DPA (AEPD) received a complaint against a Directorate from the Spanish Police Force (Guardia Civil) indicating that an email containing an agreement to commence a procedure for the suspension of the data subject's firearm license was sent to a generic email address of a different unit which did not have any relation to the procedure, other than notifying the data subject, and that could be accessed by third parties. The email was accessible by the whole police unit, while the purpose of the sending was only to notify the data subject about the commencement of the procedure. The AEPD held that the facts constituted an infringement of Article 5(1)(f) GDPR for violating the principle of confidentiality and Article 32 GDPR for failing to implement appropriate technical and organisational measures according to the risk and sensitivity of the personal data processed, since third parties that was not in charge of the procedure and did not need to access the data had access to it. The AEPD warned the directorate and provided them with one month to review its processes and bring them into compliance with GDPR.