The Spanish authority declared a municipality in breach for disclosing to the press information about the administrative situation of an employee, considering that she was identifiable even without her name being mentioned, due to the unique nature of her position.

Facts and context

The Spanish Data Protection Agency (AEPD) today published a decision declaring an infringement against the municipality of ***LOCALIDAD.1 for a breach related to the disclosure of personal information of an employee to the press.

The case originated from a complaint by an employee of the municipality, the sole holder of her position, following the publication in a newspaper of information about her leave and its reasons, which were allegedly provided by her employer.

Grounds for the decision

• Obligation of integrity and confidentiality (Article 5(1)(f) of the GDPR): The authority found that the municipality had communicated to a newspaper information concerning the leave of one of its employees. Although the person's name was not mentioned, the AEPD considered that she was clearly identifiable as she was the only one holding her position within the municipality. Relying on the broad definition of personal data, the authority concluded that the combination of information (unique position, leave situation, municipality of less than 40,000 inhabitants) allowed the complainant to be singled out. Consequently, the disclosure of this information, which exposed aspects of her private life that were not necessary, constituted a violation of the obligation to ensure data confidentiality.

Authority's decision

Consequently, the authority declared that the municipality of ***LOCALIDAD.1 violated Article 5(1)(f) of the GDPR.

Furthermore, the authority ordered the municipality to adopt, within three months, appropriate technical and organizational measures to ensure the security and confidentiality of the personal data it processes.

Lessons learned

This decision reminds that:

• A natural person can be considered "identifiable" even if their name is not disclosed, as soon as a set of clues (such as the uniqueness of a position and a specific context) allows them to be singled out without unreasonable effort.
• Communication by an employer, including a public one, to third parties of information relating to the administrative situation of an agent constitutes a violation of the confidentiality principle if this information is not strictly necessary and relevant.
• Public bodies are not systematically subject to administrative fines in Spain; the supervisory authority may issue a declaration of infringement and impose binding corrective measures.