Spain’s data protection authority, the Agencia Española de Protección de Datos, provided guidance for agencies that send mail notifying individuals about sensitive matters after a city council allegedly included personal financial information on an envelope. The guidance noted to comply with the EU General Data Protection Regulation, data controllers “must implement technical and organizational measures to prevent unauthorized access to personal data, guaranteeing its integrity and confidentiality.”
Full story