Resolutions, opinions and reports search tool

One person reported that he had received a call from a call centre for the purposes of COVID-19 vaccination, in which he was asked why he did not want to be vaccinated, and was informed that the call would be recorded. The Authority processed a sanctioning procedure against the Department of Health, who was warned for not having fulfilled the duty of information provided for in art. 13 RGPD. At the same time, he filed the rest of the reported facts, since, on the one hand, it was found that the call had been made by SEMSA, on behalf of the CatSalut, to whom the Department had commissioned to make those calls; and on the other hand, it was found that the collection of the reason for not wanting to be vaccinated (by free will) was protected by the applicable health regulations.

The claim is rejected since, in this case, the main requirement is lacking in order to be able to require the data controller to carry out the deletion of personal data, since the person who requested this deletion did not appear as the owner of the personal data to be deleted. In this sense, B:SM has accredited that it has been at all times proactive, because it required the applicant to prove his identity, and has given a response adjusted to the circumstances of the case.

A person (A) submitted to a municipal company a request to renew their registration in the Register of Housing Applicants with Official Protection of Catalonia. The company incorrectly incorporated this request into the Register file that corresponded to another person (B), which led to error in the Housing Agency of Catalonia, which erroneously renewed the registration in B and modified its telephone number and its email address. The municipal company is sanctioned with a fine, due to violation of the principle of accuracy.

With regard to the request for access to information on the list of workers, from 1 January 2020 until the present, by years, indicating names and surnames, workplace and equipment where the activity is carried out, number of morning and afternoon days held in person and at a distance, and whether or not tickets have been paid in restaurants, it is justified only if this information is provided without identification by workplace and equipment where it performs its activity and replacing the name and surnames of workers with a code that does not allow them to be identified.

The entity gave an incomplete response to the claimant, which only referred to the deletion of any data contained in his or her clinical history, without referring to the claimant's statements about the existence of incorrect data in a medical report.

In view of the rules governing Equality Plans in companies, it can be said that the members of the Committee of Workers of the entity that are part of the negotiating Commission for the Equality Plan must be able to access information from the Tax Register, which must be in accordance with the terms of Article 28.2 of the ET, despite having professional categories with a small number of workers, while remaining those obliged to respect the confidentiality of this information.

The entity must answer clearly and precisely whether the personal data of the complainant has been transferred to third parties or not, and if so, identify the recipients of the personal data. The entity must inform the complainant of the specific reasons why it is decided not to follow up one of the requests made by the complainant.

Data protection regulations do not prevent the claimant from accessing information relating to legal entities or reports that do not contain personal information. Nor does it prevent access to the merely identifying information of the compliance officer and the external lawyers who wrote the reports. However, with respect to the information relating to the persons allegedly responsible, the reporting person and, where appropriate, witnesses, must be provided anonymously. And to the extent that effective anonymization is not possible, access must be facilitated through a summary of the actions taken, so that the physical persons affected are not identifiable.

The complainant complains that several of his data are entered in a report on his care issued during the emergency transport health service, which he considers to be wrong.

The treatment of driving staff's health data or functions related to the traffic safety of rail transport services to detect, by the company, alcohol or drug consumption, at the start or during working time, is enabled in Articles 6.1.c) and 9.2.h of the GPD in relation to rail legislation. In the case of personnel who carry out these duties in the transport services of the bus or cable network, the data protection regulations do not prevent regular controls on the consumption of the aforementioned substances, when it is established, justifiably, by the occupational risk prevention service, insofar as it may constitute a risk for third parties.