The Catalan Data Protection Authority (APDCAT) has imposed six sanctions on Transports Metropolitans de Barcelona (TMB), the city’s metro and bus operator, totalling €153,000 for exposing personal data of staff on its intranet.
The breach occurred due to a misconfigured Microsoft Teams system set up by an external provider, which automatically created public workgroups, allowing unrestricted access to sensitive files. According to a resolution obtained by elDiario.es, employees could search the intranet using keywords such as 'adaptation' or 'leave' and retrieve confidential information including medical diagnoses, custody rulings, salary claims, and psychiatric reports.
APDCAT found that TMB failed to supervise the privacy configuration despite being contractually responsible, and noted the company had not provided documentation proving oversight. The authority cited 'persistently negligent conduct' and a lack of robust security measures, especially concerning for a public body managing data from 9,000 employees and two million daily passengers.
Forensic reports confirmed that six individuals accessed files without authorisation. One employee downloaded 1,798 documents between 22 and 23 January 2025, while another accessed 68. The breach affected 68 people, including 52 current employees, eight former staff, and eight workers from subcontracted firms.
Whistleblower Data Also Exposed
Separate incidents in October 2025 revealed that a document sent by TMB to judicial police in a workplace harassment investigation remained publicly accessible. Three employees downloaded it between May and October without detection, despite one of the individuals named being a protected informant recognised by the Office of Anti-Fraud of Catalonia.
The company admitted it did not give 'specific technical instructions' on privacy configuration.
The APDCAT resolution described TMB’s defence as 'contradictory and surprising', noting the company denied the breaches despite having acknowledged them in January and November 2025. It also pointed out that TMB’s own internal reports recommended urgent security improvements.
Company Response and Ongoing Consequences
An official source at TMB stated the company strengthened its data protection policies after the January 2025 incident and is implementing APDCAT’s required measures. They attributed the breach to the external provider and said the fine was in the 'low range' compared to a potential maximum of €15 million under data protection law.
The €153,000 penalty was reduced to €91,800 because TMB admitted the facts and paid early. The sanction follows a separate €60,000 fine imposed by the Office of Anti-Fraud of Catalonia on TMB’s legal director, who may be personally liable if the ruling is confirmed.
Both the metro and bus works councils have called for the resignation of the legal director. TMB has not yet confirmed whether it will appeal the APDCAT decision.
Primary sources: transparencia.tmb.cat, noticies.tmb.cat. Reported by eldiario.es, apdnoticies.com, diariodetransporte.com, elDiario.es Catalunya.
