What happened
The Spanish Data Protection Agency announced it will launch a formal, ex officio investigation into a Ministry of Interior communication office report that includes journalists' names and alleged political ideologies. The probe will examine the nature, scope, use and legal basis of the personal data processing. The agency reminded that such processing must meet GDPR article 5 purpose‑limitation, article 6 lawful basis, and, for special‑category data like political opinions, an exemption under article 9.1.
Why it matters for trust and compliance
- Its status is announced. It is not law yet. Track it, but do not treat it as an obligation.
- The investigation could impact how government bodies handle journalists' personal and political data under GDPR.
Who is affected
government controller Ministerio del Interior Agencia Española de Protección de Datos
Recommended actions
- Check that privacy notices describe the practices this addresses.
- Revisit retention schedules and data minimisation for the data involved.
- Map the security requirements to existing controls and close gaps.