Disciplinary sanctions and personal data: what can be disclosed and what cannot?

Imagine someone requests to know what sanctions a town...displayed as if it were the front page of a newspaper.

The Catalan Data Protection Authority (APDCAT) analyzed this dilemma in a very extensive opinion, and what it states serves as a practical guide for administrations and citizens.

Who has the right to know?

In principle, any citizen can request access to public information, including disciplinary sanctions. But be careful: access is not absolute. If the requested data directly affects a specific person (for example, their name associated with a sanction), we enter delicate territory.

The key lies in distinguishing:

Positions of special responsibility or trust: in these cases, it can be legitimate to disclose who has been sanctioned and why. The reason? Their actions directly affect citizens’ trust in the administration.

General staff: here the criteria changes. Revealing full names is not justified, because the public interest can be satisfied by providing the data in another way.

Information yes, but in aggregated form

One solution proposed by the APDCAT is to provide anonymized or aggregated information. That is, instead of saying “Juan Pérez, administrative assistant, sanctioned for minor tardiness”, it is possible to provide something like:

  • Total number of sanctions in the past year.
  • Types of offences committed (serious, minor, very serious).
  • Duration and consequences of the sanctions.

In this way, the administration remains accountable while protecting the identity of the individuals involved.

Proportionality: the middle ground

The key concept here is proportionality. Transparency does not mean publishing every detail with names and surnames. And data protection cannot be used as an excuse to hide everything. The goal is to provide the information necessary for citizens to have a clear view of how the town hall operates, without violating workers’ privacy.

In simple terms: disclose enough to ensure real public oversight, but without putting someone in the spotlight for a minor offence that may not be relevant.

Exceptions and special cases

The opinion also acknowledges that there may be exceptional situations. For example:

  • If a sanction affects a high-level executive, it is reasonable for the public to know exactly what happened and who was involved.
  • If there are delicate personal circumstances (such as situations of vulnerability), access may be limited even for relevant positions.
  • If the law expressly establishes the obligation to publish certain data, there is no room to conceal them.

Conclusion

The management of disciplinary sanctions in the public sector is a good example of how difficult it is to balance two legitimate rights: the right to know how the administration works and the right to protect individuals’ privacy.

The solution proposed by the APDCAT is a reasonable one:

  • Yes to transparency, but in the form of general and aggregated data.
  • Yes to identifying by name only when the responsibility of the position justifies it.
  • No to unnecessarily exposing individuals who are simply doing their job and make minor mistakes.