In the area of data protection and, in general, regulatory compliance, we often think in terms of technical and organisational measures, technological tools or protocols of action. However, time and again, the reality of the organizations reminds us that the weakest link in the chain is not always organizational or technological, but the human one.
Recently, a resolution of the Spanish Data Protection Agency has put the focus back on this reality. Even when an organization has internal policies and security tools, a single human error can trigger a violation of the General Data Protection Regulation, not by bad faith, ignorance or disobedience, but simply because the human factor, by its very nature, is not infallible.
The risk of human error and the sanctions of the AEPD
On this occasion, the AEPD has considered that the sending of access credentials in plain text through an unencrypted email constitutes a security breach and an infringement of the GDPR, which obliges to ensure a level of security appropriate to the risk. Although the employee responsible for the shipment did so by mistake and there was no sign of access by third parties, the issue does not change, if the system allows a simple oversight to expose data, then the system is not sufficient. penalty for non-compliance with privacy regulationsin the understanding of the supervisory authority that the risk arising from human error should have been foreseen and managed by the organisation.
Liability of the company in respect of employee shares
This reflection raises a double question: To what extent can an employee’s error exonerate the organization? How far does it reach its responsibility?
GDPR states that employees who handle personal data do so under the authority of the company In other words, the worker is not responsible for the processing of the data.
When the employee assumes responsibility for the treatment
However, in a recent decision, the supervisory authority adopts a broad concept of the term “responsible”. This means that, in scenarios where an employee uses the data for his or her own purposes, acts outside of his or her functions, accesses information without justification or deliberately ignores internal protocols, it can no longer be understood as acting under the authority of the company. the employee can be held responsible the processing of data by itself, but provided that the organization has put in place reasonable measures to prevent such conduct.
This distinction is crucial because it determines not only the scope of administrative responsibility, but also civil or even criminal liability Depending on the severity of the performance.
Labour implications: from improper treatment to disciplinary dismissal
At the level of employment, can improper treatment justify dismissal? Unfair treatment may constitute a breach of good contractual faith and, in certain cases, may justify disciplinary dismissalThis is confirmed by recent jurisprudence.
The High Court of Justice of Andalusia (STSJ of Andalusia 18059/2025) has declared appropriate the disciplinary dismissal of a worker who sent without encrypting PDF files with particularly sensitive information. The Court concluded that:
- They existed. clear internal protocols on how to handle this information.
- The worker had received specific training.
- Undue treatment was absolute bankruptcy of contractual good faith and created a real risk to the rights of third parties.
- The negligence was serious and not excusablethe company was entitled to apply the most severe penalty.
This statement reinforces that, if the organization proves that it has fulfilled its obligations relating to information, instructions, technical and organizational measures, undue treatment may have disciplinary consequences, including termination of contract.
Towards a culture of preventive compliance
The most recent resolutions leave a clear message, organizations should not just react, but anticipate.
Normative compliance is not a document or software, but a culture, and that culture must be built on the continuing training of company staff, the introduction of preventive controls, the design of procedures that make it difficult to error and the existence of clear and effectively applicable policies and protocols.
In a context where each incident may pose a legal, economic and reputational risk, the management of the human factor becomes a central part of the normative complianceIn any case, human error will never disappear, but its impact can be mitigated.
David Moldes Marty
Counselor.
Find out more about David
