Due to practices considered illegal in the treatment of personal dataa real estate company was fined in Spain by the Spanish data protection agency. The case was revealed after the complaint of an old employee who refused to comply with the entity’s orders.
Data collection without consent
According to AEPD’s resolution, the company directed its workers to capture images and videos of the mailboxes of the housing visited, with the purpose of collecting names, nicknames and addresses. The practice aimed to create a database with residents of the areas where they intended to act commercially.
The investigation concluded that this data collection violated Articles 6 and 14 of the General Regulation on Data Protection. These data were collected without any consent of the holders, contrary to the principles of transparency and lawfulness of treatment.
AEPD confirmed that the data collected allowed it to clearly identify individuals and associate them with their homes, thus being personal data protected by the European regulation.
The regulatory entity also pointed out that the data holders were never informed of the existence of the treatment or its purpose, contrary to the duty of information provided for by law.
Denunciation of a former employee
The infraction was denounced by a worker who refused to follow these instructions and, therefore, was fired, reports the work. The former employee presented evidence to AEPD, including three photographs and an audio recording of a conversation with a superior, where the imposition of the practice was confirmed.
In the recording, it is possible to hear the superior stating that “this moment, this is the only way we have to create a zone” and that, because there is no agreement with the method, the worker would be dismissed. This phrase, cited in the resolution, underlies the title of this news: “The company knew that the practice was illegal.”
This testimony was considered decisive for the agency’s decision, which enhanced the severity of the company’s conduct by consciously ignoring the rules in force.
AEPD’s decision also considered the existence of intimidation by the company to the worker, creating an environment where to refuse to follow illegal instructions resulted in labor sanctions.
Initial denial of the real estate
Confronted with the complaint, the real estate company fined refused to have given orders in this regard, although it did not reject the existence of a database. He argued that the data were accessible in online public directors, but AEPD concluded that such a claim was not plausible.
The investigators found that the information collected, including the number of apartment, is not made available on public bases, contrary to the explanation of the company.
During the process, AEPD asked the real estate to justify the origin of personal data. The answers were considered inconsistent and insufficient to justify the systematic collection of private information.
The agency concluded that there were no adequate internal measures to ensure compliance with the RGPD, nor clear policies to process data directed to workers, explains the.
We recommend:
Decision and legal consequences
AEPD has decided to apply a fine of 20,000 euros, divided into two offenses of 10,000 euros each. However, by admitting the infraction and paid in advance, the company benefited from a reduction in the fine to 12,000 euros.
It was also determined the immediate termination of the practice and the elimination of all illegally collected data. In addition, the company is now required to inform the data holders, as provided for in the legislation.
The agency also imposed that the real estate implement a compliance plan with data protection legislation, including mandatory training for all employees involved in contact activities with the public.
AEPD stressed that in future cases of recurrence, sanctions may be more severe, including the suspension of commercial activity associated with the violation of fundamental rights.
IMPACT OF THE DECISION
The resolution of this case underlines the importance of strict compliance with the data protection regulation, even in sectors such as real estate. The real estate company fined was considered responsible for the creation and maintenance of a database without proper legal basis.
This decision may serve as a warning to other entities that adopt similar practices, reinforcing the supervision of personal data processing in the commercial context.
In a context where citizens’ privacy becomes increasingly relevant, decisions like this reiterate the fundamental role of regulatory authorities in the protection of fundamental rights.
Also read:
