Resolutions, opinions and reports search tool

The form of the application in paper format did not include all the information in Article 13 GDPR. The online application form included all the ends of Article 13 of the GDPR, although through a chain of links that made it unreachable and transparent.

It is reported that a notification has been made as a natural person rather than as a representative of a legal person. The facts have not been proven to constitute an administrative infringement.

The Agency is admonished as being responsible for a serious breach of security measures because its main website did not implement a secure website authentication protocol (HTTPS).

The incorporation of the address relative to the domicile in the notifications that must be made through electronic means would be contrary to the principle of data minimization. In this case, it is necessary to adopt the appropriate measures to ensure that the program used to generate the notifications does not incorporate this personal data by default. It is also necessary to proceed with the blocking of this data in the electronic notifications already made to a working person, given their deletion request.

The open publication of an Act of the plenary, with more data than necessary and its publication for longer than is required, constitutes a violation of the principle of minimisation and the principle of limiting the period of conservation.

The CTTI, in its capacity as processor, did not implement adequate security measures to guarantee the personal data it processed on behalf of the controller (Dept EDU). This allowed a student, when making a telematic pre-enrolment at a given training, to display the data of a third party on screen.

A city council is admonished for violating the principle of application, for having published in its electronic headquarters the Minutes of a session of the municipal plenary, which contained in the section of requests and questions the name and first name of the complainant, on a matter other than the minutes debated in plenary.

The City Council published in its Electronic Office the minutes of the Plenary Session dated 11/22/2017 and 04/02/2019 with personal data of the people chosen to form part of an electoral board in violation of the principle of minimization. In order to identify who had been elected in the draw for the polling stations, it was sufficient to state the name and surname of the person chosen, and only in the event that the name and surname matched another person, could add the four random numeric digits of the DNI.