Resolutions, opinions and reports search tool

The right of access that the claimant formulated to the City Council of Sant Quirze del Vallès is estimated in relation to the purpose of processing the data provided to a municipal school. The City Council alleged that the petition had not been presented in the proper way and that it referred to data from a collective.

Infringement of the principle of application is required due to lack of legal basis in Article 6.1 GDPR. The Institute sent a statement with an attached document, to all parents, informing students of the optional subjects they will take, identified with the DNI number, and in order to purchase the school material. The DNI number is personal data, despite being treated in isolation.

Sending an email that included health data for minors.

The Foundation's communication to families and students aged over 14 years of information on activities of external entities may have sufficient legal basis in the legitimate interest (art. 6.1.f) GDPR), provided that it refers to activities or entities linked to or related to the nature of the Foundation's schools, and provided that the Foundation applies the specific guarantees set out in the V Legal Foundation of this opinion.

The data protection regulations would not prevent the claimant's access to the information contained in the application file of the anti-bullying protocol, relating to him and his minor daughter to the extent that it is holder of parental authority. There would also be no problem in facilitating access to the merely identifying data of public employees or public officials in charge of processing the harassment file, nor of the teachers, tutors or the director of the center where the events took place, that may be included. Likewise, access to the identification data of the people who have provided information about the claimant's daughter and the information they provided to the file about her could be facilitated, unless there is some reason that justifies it as a result of the hearing procedure its limitation. In the event that the file contains special categories of data of other people other than the claimant's daughter, access to this information should be denied.

It resolves to admonish the Quermany School because, on the one hand, it disseminated the identity and complete number of DNI members on a selection commission, which violated the principle of minimisation, and on the other, since the publication of this information was made on a public-road notice board, so that anyone outside the educational community could access it, thus contravening the principle of confidentiality.

The request for the right of access to the data of the child of the claimant is dismissed, since the right of access does not understand the right to access information or documentation that does not exist at the moment the request for access is formalised.

It resolves to admonise the Eixample School Institute of the Department of Education since it has been proven that since the School, an email would have been sent to the parents of the pupils (115 persons) without the option of hidden copying, which led to all recipients being able to access the email address of the other people to whom the message was addressed. The contents of the mail reported on the Covid-19 vaccination process in the educational center.

School 30 Steps is admonished by the commission of an infringement concerning the violation of the principle of confidentiality, as it has not used the hidden copy when sending an email.

The school spread the image of the person's daughter without the consent of the parents.