News

📄 Facts:

• September 28, 2022:
📌 Police in La Palma discovered 1,404 letters abandoned in a field.
📌 A complaint was filed with the AEPD. The provider, Correo Inteligente Postal, was responsible for delivering these letters.
📌 These letters were sent between February and May 2022.

• November 17, 2022:
📌 Following a citizen's report, police in the Balearic Islands uncovered an additional 5,354 letters in two separate locations in La Palma. Most of the letters were unopened.

⚠️ Violations of Articles 5(1)(f) and 32 of the GDPR:
1️⃣ Confidentiality and Data Security:
• The data controller must take all necessary measures to ensure confidentiality and data security.
• The controller failed to prevent thousands of letters from being abandoned in fields and a river.

🛡️ Arguments from the Data Controller:
• The responsible employees were identified, and disciplinary action was initiated.
• According to the company, the letters were unopened, limiting the data disclosed to names and addresses on the envelopes.
• They concluded there was no direct risk to the rights and freedoms of the affected individuals.

💸 Administrative Sanction:
• Total fine of €200,000:
• €120,000 for violating Article 5(1)(f) of the GDPR.
• €80,000 for violating Article 32 of the GDPR.

🔧 AEPD Injuctions:
• Implement:
• A tracking system to prevent future losses.
• Employee training on GDPR-compliant mail delivery practices.

📅 Post-Sanction Control:
On December 28, 2022, the AEPD assessed:
• The measures implemented by the data controller.
• The training provided to employees to ensure compliance.