Collection by a concerted school of data through a web form.

The school is reported to have committed two offences: Firstly, a minor offence (Art. 83.5.b GDPR and Art. 74.a LOPDGDD) for having collected, through a form accessible via the school website, data from applicants for free dentistry treatment provided by pupils within the framework of the practices of two academic courses, without having previously informed them of all the ends envisaged in the art. 13 GDPR, and a fine of EUR 1000 is imposed. And secondly, a very serious infringement (Art. 83.5.a GDPR and art. 72.1.i LOPDGDD), for having allowed unrestricted access, through a school Internet address, to the data of applicants for dentistry treatment, in violation of their duty of confidentiality, and imposing a fine of 4,000 euros.