Resolutions, opinions and reports search tool

The City Council of Sant Boi de Llobregat is admonished as responsible for an infringement provided for in Article 83.5.a in relation to Article 5.1.f, both of the GDPR, for sending an email to numerous people without using the hidden copy tool.

The company did not duly inform about the processing of images for video surveillance purposes. The company has accredited that, as a result of the request for information made within the framework of this research phase, it replaced the information poster of the existence of video surveillance cameras placed at the entrance door of the residence, and placed information posters on each of the floors that had unsignposted video cameras.

The right to data protection would not prevent the claimant from accessing the requested public information that only contains aggregated data. Likewise, in view of the concurrent circumstances in the specific case, it would be justified to release pseudonymized information on the distribution of cases among the lawyers assigned to the TOAD, with an indication of the associated incidences, as well as on the invoices presented by these lawyers, for the period between 2018 and 2022. However, the information on the persons assisted by the TOAD lawyers that may be included would have to be omitted, in any case.

One person reported that he had received a call from a call centre for the purposes of COVID-19 vaccination, in which he was asked why he did not want to be vaccinated, and was informed that the call would be recorded. The Authority processed a sanctioning procedure against the Department of Health, who was warned for not having fulfilled the duty of information provided for in art. 13 RGPD. At the same time, he filed the rest of the reported facts, since, on the one hand, it was found that the call had been made by SEMSA, on behalf of the CatSalut, to whom the Department had commissioned to make those calls; and on the other hand, it was found that the collection of the reason for not wanting to be vaccinated (by free will) was protected by the applicable health regulations.

Apart from the information contained in the information posters, the residence did not make available to the affected people all the information provided for in article 13 GDPR.

There is no element that allows to accredit the commission of an infringement of the data protection regulations by the bar association, the only data of the address of the complainant who has registered, and that the bar association provided to the Consejo General de la Abogacía Espa'ola (CGAE) is the one that the same person denouncing them in the moment of registration, without any modification.

Data protection regulations do not prevent the claimant from having access to information concerning public employees who had intervened in the various previous research actions and disciplinary proceedings processed between 2020 and 2022, both of which have been resolved and who have not participated in the irregular conduct, unless there are exceptional circumstances. However, in accordance with the fundamentals that have been laid down, access to the files can be facilitated through the anonymisation mechanism or, where this measure is not effective, through a summary of the files, so that in no case are the natural persons concerned (people investigated and, if applicable, complainants or witnesses) identifiable.

The claimant requested the deletion of their data from the City Council's electronic headquarters, since it had already far exceeded the purpose for which they were initially authorized, collected and processed, and for this purpose requested the withdrawal of their data from any physical or digital support for which the entity was responsible. The claim of tutelage formulated by the claimant against the City Council is estimated, without making any other pronouncement or any requirement regarding the fund since the right of the claimant has been made effective.

It is resolved to declare that the City Council of Sant Andreu de Llavaneres has violated Article 83.4, in relation to Article 35; both of the RGPD, since it has not carried out the necessary impact assessment to assess the risks associated with the processing of personal data carried out within the framework of the provision of the waste collection service "port to door".

It resolves to warn the City Council of La Garriga since it has not carried out the necessary impact assessment in relation to the processing of personal data carried out within the framework of the provision of the waste collection service "door-to-door"; it does not have the RAT updated; and it did not provide the right of information to users of the aforementioned service in accordance with article 11 LOPDGDD.