Resolutions, opinions and reports search tool

The complainant complains that the hospital where he is receiving medical treatment has provided his personal data to an external company, without his consent. It is established that the company that has processed the data is a data processor that uses his data to fulfill one of the purposes of the data controller, CatSalut. Specifically, for a medical treatment subscribed to by the complainant. For this reason, an archiving resolution is issued.

One person reported that he had received a call from a call centre for the purposes of COVID-19 vaccination, in which he was asked why he did not want to be vaccinated, and was informed that the call would be recorded. The Authority processed a sanctioning procedure against the Department of Health, who was warned for not having fulfilled the duty of information provided for in art. 13 RGPD. At the same time, he filed the rest of the reported facts, since, on the one hand, it was found that the call had been made by SEMSA, on behalf of the CatSalut, to whom the Department had commissioned to make those calls; and on the other hand, it was found that the collection of the reason for not wanting to be vaccinated (by free will) was protected by the applicable health regulations.

A person (A) submitted to a municipal company a request to renew their registration in the Register of Housing Applicants with Official Protection of Catalonia. The company incorrectly incorporated this request into the Register file that corresponded to another person (B), which led to error in the Housing Agency of Catalonia, which erroneously renewed the registration in B and modified its telephone number and its email address. The municipal company is sanctioned with a fine, due to violation of the principle of accuracy.

The claimant complained that the municipal company that manages the service of crane, withdrawal and deposit of vehicles of the City Council had responded in an incomplete way to its request to exercise the right of access. The claim of guardianship is estimated, since the City Council (who was responsible for the treatment) had provided in an incomplete way the information provided in sections 1st and 2nd of article 15 of the RGPD.

It resolves to sanction the City Council as responsible for three infringements: 1) lack of contract for the processor or equivalent document, 2) lack of information on the ends provided for in art.

A city council initiated the use of a computer application developed by a private company for the management of files processed by the municipal service of home care and dependency, without signing a contract of processor and without taking the necessary measures to detect that it sent emails to a particular company with user data from that service.

The claimant exercised his right to object to the effects that the FUOC did not provide his personal data to (...). In this respect, this Authority cannot ignore the fact that (...) it has the status of processor of the FUOC and that, the legal basis that legitimises the submission of data to (...) is, precisely, the execution of a contract. Given that the processing of controversial personal data does not fall within the scope of Article 21 of the GDPR, in order to exercise the right of opposition, it is appropriate to reject this claim to guardianship of the right of opposition.

One entity is sanctioned, absorbing another, within the framework of the provision of a health monitoring service. He sent citation emails to various workers who mistakenly contained data from other workers.

A private entity is sanctioned for having entrusted the management of the medical check appointments of workers to another entity without having formalised the contract of sub-responsor of the treatment, and without having requested the controller to authorise the sub-response of the treatment.

Els Serveis Socials Bàsics (SSB) de l'Ajuntament va encarregar a una entitat externa el seguiment psicoterapèutic d'algunes famílies, sense haver subscrit el preceptiu contracte d'encarregat del tractament.
En aquest procediment també s'arxiven d'altres fets denunciats, en concret:
1) La recollida per part del SSB d'un informe que l'EATAF havia elaborat en el marc d'un procés judicial de família, en el que constaven les dades del denunciant, sense comptar amb el seu consentiment. El tractament d'aquest informe pel SSB està habilitat per la normativa de serveis socials i de protecció a la infància i l'adolescència.
2) El tractament del citat informe de l'EATAF per part dels SSB, sense haver informat a la persona denunciant. El dret d'informació estava excepcionat d'acord amb el que disposa l'art. 14.5.c RGPD
3) Cessió de dades, sense consentiment del denunciant, entre els SSB i l'entitat externa. No hi ha comunicació de dades en la mesura que l'entitat actua com encarregada del tractament dels SSB.