The Spanish authority closes a procedure for violation of the data minimization principle due to the prescription of the infringement, the facts dating back more than three years before the notification of the opening of the sanction procedure.

Facts and context

The Spanish Data Protection Authority (AEPD) published a decision closing a procedure against the General Secretariat of the Canary Islands Health Service for a prescribed infringement related to the data minimization principle.

The case originated from two complaints filed in May 2023, denouncing the disclosure of the complainants' identity in administrative resolutions dating from December 2022.

Reasons for the decision

• Data minimization obligation (Article 5(1)(c) of the GDPR): The authority initiated a sanction procedure considering that the publication of resolutions mentioning the name and professional category of the complainants could constitute a violation of the minimization principle. However, the authority's analysis does not address the substance of the breach but a procedural defect. It notes that the facts date from 2 December 2022 and that the notification of the opening of the procedure only took place on 9 December 2025, i.e., after the expiration of the three-year prescription period provided by national law. As the infringement is prescribed, the authority could no longer rule on the merits of the violation.

Authority's decision

Consequently, the authority declared the prescription of the infringement and closed the sanction procedure against the General Secretariat of the Canary Islands Health Service.

Furthermore, the authority ordered the notification of its decision to the implicated body as well as to the Spanish Ombudsman.

Lessons learned

This decision reminds that:

• National prescription periods bind supervisory authorities and may lead to the extinction of enforcement action, even in the presence of a potential GDPR violation.
• The date interrupting the prescription period is the date of notification of the opening of the sanction procedure to the implicated body, not the date of the opening act itself.