Resolutions, opinions and reports search tool

The complainant considered that, by publishing the results of the chess competitions, organised by the FCE, the participants' health data were disseminated and preserved whenever, to participate in the competition, the Passaport Covid-19 had to be exhibited. In this respect, information regarding whether a person is vaccinated or has suffered a disease constitutes health data in accordance with Article 4 of the GDPR. However, in this case, the ECF has argued sufficiently that, on the one hand, in order to comply with the legality in force, it should require the display of Passport Covid-19 to competition participants and, on the other hand, that there were people who displayed an antigen test, PCR or vaccination exemption document. In these circumstances, it cannot be claimed that the publication of the aforementioned acts allowed third parties to relate the persons identified to the acts, to the fact that they had been vaccinated against COVID-19, whenever, there were people who might not be vaccinated, and to have presented a PCR or an antigen test, and others who had a vaccination waiver document. For these reasons, the reported facts should be archived.

The FCF made available to football sports clubs a form through which clubs had to identify members with a federal license who were positive of Covid-19 and the federated persons with whom they had been close contact. They also had to report the start date of symptoms and their vaccination state. In this regard, the FCF has argued that the collection of data was carried out in compliance with the Action Plan for Sports Deconfinement of the Government of Catalonia, within which the FCF drew up its Protocol to minimize COVID-19 infections. That being the case, it should be noted that Resolution SLT/3652/2021 of 7 December, which was in force at the time of the reported facts, referred to the content of the action plan for sports deconfinement in anything that did not contradict it. In relation to the above, it must be made on the basis that, knowing which people were positive from COVID-19, the date of symptom presentation, and their vaccination state, was information necessary for the adoption of decisions relating to the organisation of the sports competition. In the light of the above, it should be concluded that the reported processing was disabled by Article 6.1c) GDPR, with the exceptions provided for in Article 9.2g) and i), in connection with the current public health regulations and the prevention of COVID-19 infection.

The complainant complained about the fact that the Sports Park Municipal Guiera, managed by the City Council of Cerdanyola del Vallès, conditioned access to the users of the sports center, in the exhibition of Passaport Covid-19. In relation to this, it should be noted that Resolution SLT/3787/2021 of 23 December, in force at the time of the event, provided for the requirement to submit the certificate of vaccination, diagnostic testing or recovery of COVID-19 to access "to rooms and gymnasiums where physical and/or sports activity is practised". In these terms, it should be pointed out that the reported processing was made redundant by Article 6.1 GDPR (c) since it was necessary to comply with a legal obligation and that, according to the exceptions provided for in Article 9.2 g) GDPR, the processing of health data must be necessary for reasons of essential public interest, and for the exception of paragraph 1(i) of the aforementioned article, which provides that the processing must be necessary for reasons of public interest in the field of public health. Ultimately, the complainant complained about the fact that PEM Guiera staff accessed his personal data, without prior consent. However, consulted by this Authority, the complainant confirmed that he had not exhibited the Passaport covid-19 to the staff of the PEM Guiera when required, and the complainant has argued that the staff of the center acted in the exercise of their functions, so no breach of the current legislation is noted.

A private center communicated the result of an antigen test to the Health Department and this one, provided the said information to the educational center where the complainant provided his services. In this regard, Article 23 of Law 2/2021 of 29 March, on urgent measures for prevention, containment and coordination to deal with the health crisis caused by Covid-19 obliges establishments that carry out COVID-19 diagnostic tests to submit, on a daily basis, the results of the tests they carry out to the health authority and, in turn, Article 8.4 of Decree Law 41/2020, on extraordinary measures in the field of education to deal with the consequences of Covid-19, determines that the Health Department must communicate to the directors of educational centres, the health data corresponding to the results of the diagnostic tests. This being the case, it is appropriate to file the facts indicted since the communications concerned were carried out under Article 6.1 of the GDPR, in compliance with a legal obligation (in the case of the private laboratory), and in the exercise of public powers (in the case of the Ministry of Health). It should also be noted that, despite the notification of health data, the exceptions provided for in Article 9(2) and (i) of the GDPR would apply, which would allow the lifting of the ban on Article 9(1) of the GDPR.

The Public Health Agency of Catalonia communicated to the Labour Risk Prevention Services of the Catalan company in which it provides services denouncing the list of staff who did not have the complete pattern of vaccination against COVID-19. This communication was carried out within the framework of a vaccination campaign by the Health Department. In this respect, the communication in question does not contravene data protection regulations, insofar as both occupational risk prevention regulations and public health regulations empower health authorities to establish mechanisms for collaboration with the occupational risk prevention services of private companies.

The Human Resources unit of a City Council ended up accessing, through its Occupational Risk Prevention Service, information on whether one of its workers had been inoculated with the 2nd dose of covid19.

The requirement of the COVID certificate in the terms set out and which have been authorized by the Superior Court of Justice of Catalonia, cannot be considered contrary to the regulations for the protection of personal data. Likewise, when this certificate is required, the requirement to show the front of the DNI for the purposes of verifying identity is compatible and provided in accordance with personal data protection regulations.

The Department of Health entrusted|ordered SEMSA the recruitment of the service of follow-up of the narrow contacts with infected persons of covid-19, which entailed|meant the data processing personal. And to|in such effect SEMSA hired the private company Ferroser Servicios Auxiliares, SA, without formalizing the order of the treatment in a contract as the art requires. 28 RGPD, which it|he is constitutive of offense.

In order to be able to process the data relating to the vaccine status of Covid19 of the users of the center for the organization of group therapeutic activities on the basis of articles 6.1.c) and 9.2.i) of the RGPD, it would be necessary that the competent public health authorities establish a decision to this effect, which is not stated on the date of issue of this opinion.