The Dirección General de la Guardia Civil was sanctioned by the Agencia Española de Protección de Datos after promoting in 2022 the use of IMBOX DEFENSE as a substitute for WhatsApp for service communications, a tool that was also installed on agents' personal devices and through which sensitive data circulates, including information on victims of gender violence and detained persons.
The resolution finds an infringement of Article 37 of Organic Law 7/2021 and orders the institution to adopt corrective measures within a period of six months. The body questions the processing of personal data in an environment in which not all personnel had corporate terminals despite the fact that 70,000 licenses for the application were acquired.
Licenses without an equivalent allocation of terminals
The implementation of IMBOX DEFENSE was promoted two years ago as a replacement for WhatsApp in internal service communications. The purchase of 70,000 licenses, however, was not accompanied by an equivalent number of corporate devices for the staff, a circumstance that has ended up placing part of those communications on private phones.
That use affects specially protected information. Among the data that have circulated through the application are references to victims of gender violence and to detainees, an extreme that has motivated the action of the control authority.
Increase of files for queries in internal databases
In parallel, during the fourth quarter of 2024, 48 disciplinary files were opened for queries in the internal SIGO databases. The same cause led to another 36 disciplinary investigations in the first quarter of 2025, which keeps the focus on the access and treatment of reserved information within the body.
The very serious offenses included in article 7.7 of Organic Law 12/2007 can entail separation from service or suspension from employment for up to six years, depending on the final classification of each case and its disciplinary processing.
Internal complaint due to the lack of instructions
The Unified Association of Civil Guards also denounces that the Technical Instruction on IMBOX DEFENSE has not been distributed to the personnel. That lack of internal guidelines, they maintain, leaves the agents without a clear framework on the use of an application intended to handle service communications with personal data of special sensitivity.
The situation now forces the General Directorate to review its communications system and to apply the corrections demanded by the data protection authority, while both the use of the application and access to internal databases remain under examination.