Data protection

The Spanish Agency for Data Protection (AEPD), sanctions a community for disseminating information about health of an owner in groups of WhatsApp . The neighbor had authorized that her problem be informed to certain people, but not to communicate it to all the neighbors.

Everything started with some planned work in the gardens. The owner had a problem of chemical sensitivity and the phytosanitary treatment had been halted until finding a suitable product. The presidency of the community sent to the WhatsApp group of community presidents a document that identified the affected person and mentioned her health problem. That same day, the president of her block forwarding to the neighbors' group . However, the owner's authorization only covered informing the gardener and the president of the community.

The neighbor filed a complaint . The community explained that it only intended to inform , although it acknowledged that the dissemination had not been adequate. It also stated that it had ordered to remove the publications and taken measures to prevent it from happening again. The AEPD initially dismissed the complaint considering it addressed, but the owner appealed and provided a screenshot showing that the messages continued in the group. The AEPD accepted the appeal and opened the investigation.

The community argued that the maximum period after the maximum period has elapsed warning . The AEPD . The AEPD rejected the expiration because it placed the start of the computation at the admission of the claim, in June 2024, and considered the community responsible for the processing of the data.

For the AEPD, the interest of the neighbors in knowing why the work was not being done did not authorize sharing the complete document with health information. Therefore, it imposed two fines , one for breaching confidentiality and another for communicating health data without demonstrating an exception that allowed it. In setting them, it took into account the corrective measures adopted, including the withdrawal of publications and the reinforcement of communication guidelines.

Our lawyers are at your disposal to defend your rights against actions contrary to regulations on personal data protection for which you feel harmed.