Resolutions, opinions and reports search tool

Consent may be a legal basis for the processing of biometric data for the purpose of time control, provided that it constitutes a manifestation of free, specific, informed and unambiguous will on the part of the data subject to accept the processing, in the terms stated. In any case, before processing such as that provided for in the consultation, an impact assessment on data protection must be carried out in view of the specific circumstances in which the processing is carried out where, among other things, the application of the processing is analysed.

Data protection regulations would not allow the trade union delegate to access a copy of the payrolls of the work staff affected by the application for access. However, it is possible to communicate the information contained in payrolls in an aggregate way, so as to ensure that they are not identified.

El tratamiento de los datos necesarios para la realización de las pruebas de los procesos de selección de personal, incluidas los datos de salud de los participantes, tiene como base jurídica el cumplimiento de una misión en interés público y el cumplimiento de obligaciones específicas de las administraciones competentes establecidas por la normativa de función pública. La grabación de las pruebas psicotécnicas requiere, además de su previsión en las correspondientes bases de las convocatorias (con la concreción y determinación de las garantías específicas necesarias), la realización previa de una AIPD. No parece que la base jurídica del consentimiento sea adecuado para legitimar el tratamiento de los datos de los aspirantes a un proceso selectivo con la finalidad descrita, dado que no se puede considerar que en el caso planteado pudiera haber un consentimiento realmente libre, ni la posibilidad de establecer medios alternativos que garantizaran el principio de igualdad que tiene que regir los procedimientos selectivos.

Access by the bodies representing public workers to the remuneration information of these people on a case-by-case basis will be conditional upon the applicable legislative provisions and concurrent circumstances in the specific case. University workers' committee members on the negotiating Commission for the Equality Plan must be able to access the information in the Retributive Register, which must comply with the terms of Article 28.2 of the ET, despite having professional categories with a small number of workers, while remaining those obliged to respect the confidentiality of the information obtained, as well as the principle of purpose.

The publication of the work census of the Col·legi d'Economistes de Catalunya, which included personal data (name, surnames, sex, DNI, seniority and professional category) of 21 people, relating to the electoral process for choosing the person representing the workers of the CEC, is denounced. It is also reported that the publication was made in a space accessible by people outside the CEC staff. It is archived because the processing has a legal basis and because it has not been proven that the census had been published in a place accessible to third parties.

In view of the rules governing Equality Plans in companies, it can be said that the members of the Committee of Workers of the entity that are part of the negotiating Commission for the Equality Plan must be able to access information from the Tax Register, which must be in accordance with the terms of Article 28.2 of the ET, despite having professional categories with a small number of workers, while remaining those obliged to respect the confidentiality of this information.

The lack of a sufficient legal basis to enable the processing of workers' personal data in an electoral procedure by electronic voting prevents a response to the questions raised, since it would be necessary to keep to the specific provisions of legal empowerment and possible regulatory deployment, in order to assess the specific aspects relating to compliance with data protection regulations.

It is decided to sanction FMB S.A. because the lack of implementation of appropriate technical and organisational measures has prevented it from locating the personal file of the person who provided services to the complained company. This fact violates Article 32.1 of the GDPR, which provides for the controller's obligation to guarantee the availability and security of personal data.

Notification of a resource to third parties without deleting the data of the recurring person.

The principle of application is imposed. The transfer of the resolution involved communicating the identity of persons who were allegedly harassed and harassed; and, furthermore, some health data of the person who was harassed to the president of the trade union. Article 5.1.a) and 6.1 GDPR are being violated, as there is no legal basis for legitimisation. Furthermore, with regard to the communication of health data, Article 9.2 GDPR is also infringed.