The GDPR establishes that consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her. Silence, pre-ticked boxes or inactivity (such as tacit consent, for example) do not therefore constitute valid consent, according to the GDPR.
Consequently, processing operations initiated prior to 25 May 2018 and based on tacit consent should be brought in line with the requirements of the GDPR before that date, either by obtaining new consent that meets the GDPR stipulations or by another of the legal grounds established by the GDPR.
The law regulating the general electoral system establishes that the Electoral Census Office is the institution responsible for compiling the electoral roll. Registration on the roll is compulsory and the local authorities carry out such registration ex-officio with respect to the residents in their municipal district. The electoral roll is updated monthly and the name, surname(s) and address are census data that the local authority is obliged to collect.
On the day candidacies for an election are declared, the candidates’ representatives can obtain a copy of the electoral roll of the corresponding district or constituency, which they may use to send electoral material solely during the campaign period. You can object to your data being included in these copies of the electoral role to avoid being sent such material by post.
During the election period, political parties may send electoral material electronically or via electronic messaging systems providing they indicate the electoral nature of these deliveries and provide a means of exercising, free of charge, your right to object.
Political parties can use data obtained from websites and other publicly accessible sources for these purposes. Current legislation does not under any circumstance permit profiles to be created using special categories of personal data.
The media or communication services used by the public authorities, whether to communicate with citizens or other public authorities, are many and varied. In any case, the communication channel used must be in line with the requirements of data protection regulations, among others.
With regard to instant messaging services, it is the user who decides to install a particular application, which can be used to communicate with third parties, including, where appropriate, public authorities.
If the authorities use WhatsApp groups or other instant messaging services to communicate with citizens, they must have the permission of all the members in the group, unless they have another legal basis for the same, and must provide information on data processing and the consequences of using this means of communication. For this reason, the authorities may provide users with "good use policies".
If the legal basis for data processing is consent, then to ensure permission is freely given participants must have alternative means of communication with the authorities for the intended purposes, that is, the instant messaging service must not be the only channel of communication available.
For more information on this topic, please see Opinion CNS 13/2018.
Hospitals may provide a patient's room number to anyone related to the patient, whether his/her direct family or partner, who is accompanying the patient during his/her care, unless the patient states that this information should not be shared.
As for anyone else who asks for the room number of a patient who has been admitted, they can be informed if the patient has provided authorisation. It is recommended that medical centres draw up guidelines so that employees know how to proceed in these cases.
For more information, please see Opinion CNS 37/2018.
Guidelines on patient autonomy allow the patient's information to be shared with relatives or persons with ties to the patient when they request a doctor’s note, unless the patient is opposed to this.
A doctor’s note or medical certificate issued by a medical centre must respect the requirements of providing minimal information and may only include the essential information justifying the circumstances that allow for time off work.
Medical centres should establish guidelines specifying what these doctor’s notes or certificates should include, so that the employees at medical centres know how to proceed when issuing these documents.
For more information on this matter, please see Opinion CNS 60/2018