The Agencia Española de Protección de Datos has sanctioned the Dirección General de la Guardia Civil for the use of the internal messaging application IMBOX DEFENSE in the processing of personal data. The resolution finds a serious infringement and orders the institution to adopt corrective measures within a maximum period of six months.
The procedure was initiated after a complaint registered in 2023 by the representative of the AUGC union in Las Palmas. Following that action, the AEPD examined the operation of this internal tool used for service communications.
Deficiencies in treatment security
The resolution concludes that the Guardia Civil has violated what is provided in Article 37 of Organic Law 7/2021, referring to the security of personal data processing. Among the communications sent through the application were references to victims of gender violence or service incidents, especially sensitive aspects within police activity.
The AEPD warns that the use of the application by Guardia Civil personnel was not restricted to official or corporate phones. It also points out that there was a single role for all users, so that all shared the same permissions within the tool.
The body also understands that an adequate analysis was not carried out based on the type of data that were going to be processed. That lack of prior evaluation is one of the elements that support the declaration of infringement.
Without economic fine, but with obligation to correct
The Agency has declared the existence of a serious infraction, although without imposing an economic sanction as it is a public administration. In its resolution, it requires the Guardia Civil to adopt several measures to correct the detected deficiencies.
- The elaboration of a technical instruction on the use of the application
- The training of the users
- The analysis of the possible definition of differentiated roles
The Guardia Civil must implement these measures within a maximum of six months. The resolution thus sets a specific deadline to adapt the use of IMBOX DEFENSE to the legal requirements for protection and security in the processing of personal data within the police scope.