Spain: AEPD fines Gesthotel Activos Balagares €15,000 for GDPR violation
The Spanish data protection authority ('AEPD') issued, on 9 March 2020, a resolution ('the Resolution') in proceeding PS/00358/2019, fining Gesthotel Activos Balagares, S.L. €15,000 for violation of Article 5(1)(f) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). In particular, the Resolution outlines that an individual claimant argued that he had forwarded to the hotel management and the union staff delegates a private letter containing information on a harassment episode he suffered, detailing a specific medical condition. In addition, the Resolution highlights that the hotel management and the union delegates had a meeting with other coworkers where they read the content of the letter, in violation of the principle of integrity and confidentiality. As a consequence, the Resolution imposes on Gesthotel Activos Balagares a fine of €15,000.
You can read the Resolution, only available in Spanish, here.