Homeowners' association in Spain fined for displaying meeting minutes in building lobby with residents names and debts

A homeowners' association in Spain has been fined for displaying the name and debt of one of the neighbours in the lobby of the building for eight months. In this way, it violated regulations associated with the correct processing of personal data. After two years of unsuccessful attempts to notify the association, the Spanish data protection agency (AEPD), which the affected party filed a complaint with, has decided to take action.

As an independent body responsible for safeguarding peoples' privacy, AEPD considers that the homeowners' association has breached its duty of confidentiality by violating article 5.1 of the General Data Protection Regulation (GDPR): "Personal data shall be processed in such a way as to ensure adequate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by implementing appropriate technical or organisational measures (integrity and confidentiality)."

In addition, the association also considered that there had been a breach of Law 49/1960 regarding horizontal property, which establishes that the minutes of meetings must be sent to the owners following a procedure also outlined in the regulation, which states: "If an attempt to summon or notify the owner proves impossible to carry out (…) it shall be understood as having been done by placing the corresponding communication on the community’s notice board, or in a visible place of general use designated for this purpose, with a record indicating the date and reasons for proceeding with this form of notification, signed by the person acting as the community secretary, with the approval of the president. Notification carried out in this manner shall have full legal effect after a period of three calendar days."

The AEPD argued that, in this specific case, the details of name, surname, postal address and debts of residents (a total of 12) have been exposed to third parties, and there is no record in the file of the proceedings stating the reason for placing the minutes of the ordinary general meeting held on 3 August 2023, in the window of the doorway. "Furthermore, the three-calendar-day period required for the notification of the minutes to have legal effect was exceeded, since the minutes were displayed from the date of the ordinary meeting (08/03/2023) until 04/02/2024, as stated by the complainant."

In its decision, the AEPD said it first asked the association to inform the agency within one month about the steps taken to follow the rules. When the homeowners' association didn’t respond to the electronic notification, it was sent again by certified mail. The file shows two attempts to deliver the letter on 11 December 2024 and 12 December 2024, but no one was home, so a notice was left for picking up at the post office. The association didn't collect it, so the notification was published in the official state gazette (BOE) on 27 December 2024. After that, the complaint was accepted, and four months later, a formal sanction process was started.

Since no response or objections were made within the given deadline regarding the content of the initiation agreement, "when it contains a precise pronouncement on the imputed liability, it may be considered as a proposal for a decision".