Resolutions, opinions and reports search tool

It is necessary to apply the principle of presumption of innocence since the professional who attended and responded to the consultation of the complainant acted in the exercise of its functions and only treated the personal data that the same complainant provided him for the purpose of managing his query.

It resolves to sanction the City Council as responsible for three infringements: 1) lack of contract for the processor or equivalent document, 2) lack of information on the ends provided for in art.

The complainant complains that the ITV station provided a third party with the ITV card of their vehicle. This was due to human error and the accused entity proceeded to take measures to correct the situation. Despite this, the registration of a vehicle is personal data and therefore constitutes a breach of data protection regulations.  The principle of confidentiality must be upheld.

The complainant complains that the City Council has not replied either to the right of access, or to the right of rectification in relation to the waste collection service 'door to door'. With regard to the right of access, although the claimant requested access to public information, in reality, he referred to access to his personal data; and with regard to the right of rectification, although it was initially inferred that the City Council would have complied with the right exercised by the claimant, in reality the City Council did not rectify the data relating to the claimant's postal address. The petition formulated by the claimant in relation to both rights is appreciated.

The City Council does not have sufficient empowerment to install a video monitoring system in a delimited space that is part of the public track in order to control and, if applicable, exercise sanctioning power over inactive conductions relating to the waste deposit in the collection areas. In the event of installation to control vandalism against public security, it could be considered legitimate if carried out by the local police in accordance with obtaining prior authorisation from the Directorate-General for Security Administration.

Security measures must be determined by taking into account the risks arising from the loss or unauthorised access to data (among others). In the present case, it has been proven that the person responsible for the processing of the data concerned did not take appropriate technical and organisational measures to ensure their safety (thinking to prevent unauthorised persons from accessing these data).

Publication in the Board of Advertisements of the City Council's Electronic Headquarters, of a document with personal data of citizens (among them, whistleblowers) who had participated in the advisory process on the regulated parking system (blue area) carried out by the consistory. In particular, the personal data disseminated are: name and surname, DNI number, telephone, postal address and email address, of each person who had submitted allegations, as well as their content and the resulting personal information derived from them.

Choosing the most appropriate selective collection model in the municipality requires an impact assessment on data protection. The City Council, in view of the powers it has been assigned in matters of waste management, would be entitled to carry out the processing of data arising from the implementation of the selective collection system. However, in the absence of a specific legal provision, the development of profiles that produce legal effects on the person using the service or that significantly affect them in a similar way, requires the explicit consent of the persons affected. The participation of third parties in the implementation of this system requires the formalization of a contract of manager and, where applicable, of sub-manager, as well as, where applicable, the fulfillment of the obligations established in this regard in the LCSP.

The claimant exercised the right to delete before the City Council the data he had provided for the waste collection service "door-to-door". The City Council refused to delete the data on the grounds that the treatment was necessary to fulfil a mission in the public interest based on a municipal competence. But he also stated that the only data necessary to provide the service was the address of the housing.