News

? Facts:

• September 28, 2022:
? Police in La Palma discovered 1,404 letters abandoned in a field.
? A complaint was filed with the AEPD. The provider, Correo Inteligente Postal, was responsible for delivering these letters.
? These letters were sent between February and May 2022.

• November 17, 2022:
? Following a citizen's report, police in the Balearic Islands uncovered an additional 5,354 letters in two separate locations in La Palma. Most of the letters were unopened.

?? Violations of Articles 5(1)(f) and 32 of the GDPR:
1?? Confidentiality and Data Security:
• The data controller must take all necessary measures to ensure confidentiality and data security.
• The controller failed to prevent thousands of letters from being abandoned in fields and a river.

?? Arguments from the Data Controller:
• The responsible employees were identified, and disciplinary action was initiated.
• According to the company, the letters were unopened, limiting the data disclosed to names and addresses on the envelopes.
• They concluded there was no direct risk to the rights and freedoms of the affected individuals.

? Administrative Sanction:
• Total fine of €200,000:
• €120,000 for violating Article 5(1)(f) of the GDPR.
• €80,000 for violating Article 32 of the GDPR.

? AEPD Injuctions:
• Implement:
• A tracking system to prevent future losses.
• Employee training on GDPR-compliant mail delivery practices.

? Post-Sanction Control:
On December 28, 2022, the AEPD assessed:
• The measures implemented by the data controller.
• The training provided to employees to ensure compliance.