Spain

INTERURBANA DE AUTOBUSES, S.A.

70,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2024-12-16.

Rank · Sector

#31

of 213 in Employment

Rank · Spain

#162

of 1,071

Rank · All fines

#600

of 3,042

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2024-12-16
Controller / Processor: INTERURBANA DE AUTOBUSES, S.A.
Sector: Employment
Quoted Articles: Art. 5 (1) c) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Spanish DPA has fined INTERURBANA DE AUTOBUSES, S.A. EUR 70,000 after an employee filed a complaint over the publication of personal data on the company's bulletin boards. According to the data controller, an error in the HR department led to printing a full list of the employees—including sensitive details like addresses—instead of the electoral roll, which is meant to include only the information necessary for union elections. The DPA considered this to be a violation of the principle of data minimization, since, on the one hand, more personal data than necessary for the election was published and, by posting it on the bulletin boards, there was a risk that third parties could see the data from the outside through a window.

Open original source Links to the regulator's original publication or another source.