Sanction to the City Council of Reus for throwing documents of neighbors to a landfill
The Catalan Dades Protection Authority (APDCat) has reprimanded the Reus City Council for sending hundreds of documents containing personal data of residents of the municipality to a landfill near La Savinosa, in Tarragona. A man who was walking in the area found at least a dozen bags with papers scattered among mountains of rubble just two years ago, in October 2020. Inside the folders were files from the Social Services Area with information on minors, citizens served by the District V Welfare Area between 2012 and 2015 and also lists on the productivity of workers and suppliers of the Economic Services Area that should have been destroyed.
The APDCat, a body dependent on the Generalitat, then initiated an investigation for data security violation. And it has now concluded that the City Council did not have the necessary measures to avoid situations of this type, "so that unauthorized third parties would have had access" to the pages in question.
The sanctioning resolution, which the Diari has been able to consult, sheds some light on how the documentation ended up in the dump. It indicates that the reports had been transferred, “at the request of the council staff”, to the facilities of the City Council brigade unit and deposited around an industrial paper destruction machine “without any perimeter closure, a few meters from the containers of rubble". That led to “outside companies taking them to the landfill”, most likely by mistake.
The internal investigations launched by the City Council itself after being alerted to the loss of documents point in the same direction. They admit that "the relevant protocol" was not activated to refer the documentation to the Municipal Archive and that, later, it was destroyed by some entity that did so in accordance with data protection regulations. Instead, the files were housed in the brigade compound, a unit that was also entrusted with the elimination of the pages without this task being its responsibility and the staff not knowing how to carry it out.
The City Council reflects in its analysis of the facts that "the only connection" between the lost reports and the landfill "is the subcontracted company that collects the debris and then throws it in different dumps", among which is this one near Savinosa. In spite of everything, the consistory points out, "it cannot be determined with certainty" the reason that explains how they appeared intact, with a multitude of personal data in sight and in another city.
On the other hand, "it has not been possible to prove or appreciate the intentionality of any worker" and "neither has it been possible to specifically identify a subject or group as responsible" for the escape. In this sense, the City Council attributes everything to "a chain of ignorance and errors."
"I warned, but they ignored me"
The person who found the folders in the landfill was a Tarragona resident who, one Sunday morning, was walking by the place and was surprised to see that the wind was dragging "loose files that you could see were from the City Council," he said then. The man, who goes by the initials JO D, tried to contact the council but "I was on the phone for about fifteen minutes and nobody paid any attention to me, they just passed me from one person to another."
Given the lack of response, he contacted this newspaper to publicly denounce what he interpreted as "a very serious malpractice that can harm many people." And she provided images taken in the same landfill that the APDCat has taken into account in its investigation.
As the witness explained, the folders kept economic, clinical and personal records of a large number of users of municipal services. There would be details of bank account numbers and their movements, medication or disease tracking, and identity-related data such as passports or IDs, and even home addresses and family histories.
In the video sent to this newspaper, the man explained that "papers that should have been destroyed are thrown away" and warned that "anyone who finds them, just as I have seen them, can misuse them and there are hundreds of documents ». The events caused a special stir as sensitive areas were involved, such as Serveis Socials, and being focused on a specific district of the city.
Municipal sources consulted in this regard after the warning defend that "the Reus City Council acted urgently to activate the protocols and manage the incident, as well as bring the facts to the attention of the competent authority." They assure that "up to three directions were worked on", fundamentally "data recovery, clarifying the origin of the incident and taking measures to reinforce the management and custody of the information". The papers were recovered.
Upon being notified of the decision of the APDCat to sanction, the municipal government requested the dismissal arguing that the landfill is in an inaccessible point and that, after making the public communication of the incident, none of the affected people had filed a complaint or complaint. But the Generalitat recalls that it is not necessary for the neighbors to consider their privacy violated for that violation to have occurred.
Likewise, the City Council maintained that it applied technical and organizational measures to prevent episodes like this, and that it had guides available to its workers. The Catalan Dades Protection Authority clarifies that none of these guides establish circuits for the safe destruction of paper documents with personal data, a process that should be followed through the Municipal Archive.
Therefore, it determines that “the security of the data was not effectively guaranteed” and “the security of the data was compromised”. He concludes that the council "did not implement the appropriate organizational measures" to preserve the documentation, which contained sensitive data, and admonishes him.
New protocol and airtight containers
As a result of the detection of papers with personal data in the landfill, the Reus City Council implemented a new action protocol for the destruction of personal information. The events of 2020 led him to install hermetic containers in different municipal rooms and workplaces for the transfer of data to the Municipal Archive and its subsequent elimination by an accredited company.
Although the brigade continues to participate in the process of transferring the files, it is no longer competent to carry out documentation destruction functions of this type. And the Municipal Archive is emerging as the only body that coordinates the safe disposal service through the aforementioned company. This was communicated by the same consistory to the APDCat, which, consequently, has not had to require the adoption of more corrective measures after imposing the reprimand.
Why the reprimand is not economic
The warning from the APDCat to the City Council derives from its responsibility for infringing article 32 of the European General Data Protection Regulation. This requires, among others, to guarantee the encryption of personal data and confidentiality.
Despite the fact that the Regulation does provide for a scenario of economic fines, and consulted about the Reus case, the APDCar specifies that "the decision of the Spanish legislator has been not to impose economic sanctions on public administrations, but to sanction them with a reprimand (disapproval or declaration of the incorrectness of the conduct) and the requirement of measures to stop the conduct or correct the effects of the infraction”.