- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DIRECCIÓN GENERAL DE LA GUARDIA CIVIL – Complaint Upheld (Spain, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Spanish DPA found that the police mistakenly sent a sensitive email to the wrong unit, violating data protection rules. This is important because it shows that even public agencies must protect personal information. It highlights the need for proper handling of sensitive data.
What happened
The police sent an email about a firearm license to a generic address accessible by unauthorized personnel.
Who was affected
The individual whose firearm license was affected was impacted by this error.
What the authority found
The Spanish DPA determined that the police violated confidentiality and security principles under GDPR.
Why this matters
This case highlights the importance of data security and confidentiality for all organizations, including public entities. Agencies must implement better measures to protect sensitive information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 March 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA (AEPD) received a complaint against a Directorate from the Spanish Police Force (Guardia Civil) indicating that an email containing an agreement to commence a procedure for the suspension of the data subject's firearm license was sent to a generic email address of a different unit which did not have any relation to the procedure, other than notifying the data subject, and that could be accessed by third parties. The email was accessible by the whole police unit, while the purpose of the sending was only to notify the data subject about the commencement of the procedure. The AEPD held that the facts constituted an infringement of Article 5(1)(f) GDPR for violating the principle of confidentiality and Article 32 GDPR for failing to implement appropriate technical and organisational measures according to the risk and sensitivity of the personal data processed, since third parties that was not in charge of the procedure and did not need to access the data had access to it. The AEPD warned the directorate and provided them with one month to review its processes and bring them into compliance with GDPR.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DIRECCIÓN GENERAL DE LA GUARDIA CIVIL in ES
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DIRECCIÓN GENERAL DE LA GUARDIA CIVIL - Spain (2021). Retrieved from cookiefines.eu
Last updated: