The Spanish data protection authority ('AEPD') published, on 17 May 2022, its Decision in Proceeding No. PS/00444/2021, in which it imposed a fine of €4,000 on Estudio La Florida 2009 S.L., for the violation of Articles 5(1)(f) and 32 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following a complaint submitted by an individual.

Background to the decision 

In particular, the AEPD stated that the complainant owns a property which they rented to La Florida. Moreover, the AEPD detailed that, upon termination of the lease, the complainant found documentation, supposedly from La Florida's clients, regarding invoices, original notarial deeds, contracts of sale, personal data such as ID cards, and telephone numbers, among others.

Findings of the AEPD 

Notably, the AEPD found that the complainant had access to the personal data of third parties, collected by La Florida, which it improperly stored in the rented property, thus violating the principles of integrity and confidentiality under Article 5(1)(f) of the GDPR. Furthermore, the AEPD noted that La Florida had not put in place any appropriate measures to prevent the exposure of personal data, as the documentation was left on the premises, rather than being destroyed or removed prior to the termination of the rent, thus infringing Article 32 of the GDPR.

Outcomes

As a result, the AEPD imposed a total fine of €4,000 against the La Florida, namely €2,500 for the violation of Article 5(1)(f) of the GDPR and €1,500 for the violation of Article 32 of the GDPR.

You can read the decision, only available in Spanish, here.