Other legal bases

Public administrations can only disclose data to third parties when the legitimate interest of this third party prevails over the rights and interests of the date subjects.

Public health authorities may process data for reasons of public interest, to control the spread of epidemics or pandemics and, ultimately, when health crises or cross-border threats occur that pose a serious danger to the health of the population. If there is a risk of transmission, the competent public health authorities may take the necessary measures to control infected people, people in their immediate environment and those who are or have been in contact with them.

Yes, but you can object to this. The law governing the general electoral system establishes that the Electoral Census Office is the body in charge of drawing up the electoral census. Registration in this census is mandatory and the town councils register the residents of their municipality ex officio. The electoral census is updated monthly and names, surnames and address are census data that must be collected.

On the day when the candidacies are announced, the representatives of each electoral candidacy may obtain a copy of the electoral census of the corresponding district. They can use it to send election propaganda, only during the campaign period. You may object to the inclusion of your data in these copies of the electoral roll, in order to prevent election propaganda from being mailed to you.

During the election period, political parties may send election propaganda by electronic means or electronic messaging systems, provided that they identify the electoral nature of the message and provide a free means to exercise the right to object.

For this purpose, political parties may use data obtained from websites and other public-access sources. In any case, current regulations do not allow profiles to be developed that take into account special categories of data.

There are many different means of communication or communication services that may be used by public administrations either to interact with citizens or with other public administrations. However, in all cases, the channel used must comply with the requirements of data protection regulations.

In these instant messaging services, it is the user who decides whether install the particular application through which they can interact with third parties, including, where appropriate, public administrations.

If the public administration uses WhatsApp groups or another instant messaging service to communicate with citizens, it must have the consent of all members of the group, unless it has another legal basis, and inform them about the data processing and the possible consequences of using this channel. To this end, the administration may provide users with "good use policy clauses".

In order for the legal basis of the processing to be consent and for this to be freely provided, the participants must have other alternative channels of communication with the administration for the intended purposes. In other words, the instant messaging service should not be imposed on them as the only means of communication.

For more information on this matter, please refer to ruling CNS 13/2018.

Hospitals may provide the room number to family members and civil law partners who are accompanying them during their treatment, unless they have on record that the person concerned opposes the disclosure of this information.

Other people may be informed of the hospital room number if the patient has given their authorisation. Health centres are advised to draw up a protocol so that staff know how to proceed in these cases.

For more information, please refer to ruling CNS 37/2018.

The regulations on patient autonomy state that information on a patient may be disclosed to relatives or related persons who request such a letter, unless the patient objects.

Certificates or letters issued by a health centre must comply with the principle of data minimisation. They may only include essential information to certify the circumstances that justify the right to time off work.

Health centres are advised to establish a protocol to specify the content of certificates or letters. In this way, healthcare workers know how to proceed when issuing these documents.

For more information on this subject, please refer to ruling CNS 60/2018.

In accordance with occupational health and safety regulations, the temperature of the centre's workers can be taken to ensure the health and safety of the people working at the centre. With regard to people who have contact with the centre, such as employees of external companies or people using the services it provides, temperature can only be taken without the consent of the people affected if this measure has been approved by the competent public health authorities.

For details on this subject, please refer to ruling CNS 44/2020.

Companies need to know whether or not their workers are infected so that their health and safety departments can either design a contingency plan or follow a plan provided by the health authorities. In this way, the right to the protection of health of other workers can be ensured and contagion can be avoided within the company.

Workers infected with coronavirus must inform the company of this circumstance, in accordance with the Occupational Risk Prevention Act. In general, in cases where a worker goes on sick leave, the worker is not obliged to report the cause of their sick leave. However, in a pandemic, and to protect the health of the entire population, this right may be secondary to the right to the protection of health of other workers.