Vulneration of the obligations of the person responsible for treatment for not having carried out a risk analysis.

The City Council did not carry out a risk analysis to determine the security measures applicable to ensure the security of personal data linked to 12,500 audited SIP queries, the effects of verifying whether they had been performed in the exercise of the functions entrusted to two officers of the Urban Guard.The effect was to verify whether they had been performed in the performance of reports with data of third persons; the actions performed by the head of the GU while on leave; the communication of the incoation of disciplinary files to the SIP; the communication of the incoation of disciplinary files to the trade union representatives; the request of the auditing of SIP accesses; and the encryption of the mail through which the audit of SIP access was requested.