The Spanish Data Protection Authority (AEPD) sanctioned a hotel company for publishing a former employee's personal phone number as the establishment's contact on a booking platform without a valid legal basis.

Facts and context

The Spanish Data Protection Authority (AEPD) today published a sanction decision against LARDIANA, S.L. (including the imposition of a 2,000 € fine) for breaches related to the absence of a legal basis for the processing of personal data.

The case originated from a complaint by a former employee of the company, who noticed that her personal phone number was used as the hotel's contact on an online platform, more than a year after the end of her employment relationship.

Grounds for the decision

• Lawfulness obligation of processing (Article 6(1) of the GDPR): The authority found that the company had published the complainant's personal mobile phone number on the ***PLATAFORMA.1 platform as the hotel's contact. This processing of personal data was carried out without the data subject's consent, who had expressly requested by email on April 10, 2023, that her number not be used for this purpose. In the absence of any other valid legal basis under this provision, the authority concluded that the processing was unlawful.

Authority's decision

Consequently, the authority imposed a fine of 2,000 € on LARDIANA, S.L.

Furthermore, the authority ordered the company to remove, within one month, the publication of any personal phone number on the platform if such processing is not based on a legitimate legal basis, and to provide proof thereof.

Lessons learned

This decision reminds that:

• The use of an employee's personal phone number for professional purposes, such as its publication as a company contact, constitutes data processing that requires a separate and valid legal basis, as consent cannot generally be presumed within an employment relationship.
• An explicit request from an employee to cease the use of their personal data must be handled diligently, with failure to do so constituting a clear violation of the lawfulness principle.
• Employee exit processes must include a systematic review and deletion of their personal data from the company's external communication channels to prevent continued and unlawful use.