Resolutions, opinions and reports search tool

The Foundation could send an e-mail reporting on the training it will give this summer to its pupils on the legal basis of legitimate interest, provided that the information is limited to the training programme examined and is addressed exclusively to the pupils of up to 35 years of vocational training cycles, who should be given the option of opposing receiving communications of this kind.

The Authority considers that the provisions of the legislation on the prevention of money laundering and terrorist financing on the conduct of an impact assessment in relation to certain data processings could be interpreted, for the case of foundations and associations, to the effect that they should only do so at the same time that, if necessary, they detect facts that might be indications of money laundering or terrorist financing, given the obligation to report them to the SEPBLAC. This is without prejudice to the fact that, in view of the concurrence of certain specificities, the entities consider it appropriate to carry it out in advance in the event that they may encounter any of the communication assumptions imposed by this regulation.

Una madre denunció que la escuela había pedido que el primer día del curso escolar 2021-2022 aportaran el certificado de vacunación de covid-19 de su hijo menor de edad (de 12 años o más); que el dedo certificado también se pedía al personal de la escuela, y que la escuela tenía acceso a la aplicación informática Traçacovid. La denuncia se archiva porque, si bien se cierto que inicialmente la escuela se lo pidió, antes de iniciar el curso escolar comunicó a las madres y padres de alumnos que no lo aportaran (en base a una modificación de última hora del Plan de actuación para el curso 2021‐2022 para centros educativos en el marco de la pandemia); por otro lado, también se archiva porque no hay constancia que la escuela hubiera recogido ningún certificado de vacunación, y que la escuela negó tanto que requiriera el certificado a su personal, como haber accedido a la Traçacovid, y tampoco constan indicios. Además de los motivos de archivo, se concluye que el tratamiento de datos de salud por parte de los centros educativos por motivo de la gestión de los casos positivos de covid-19, estaría amparada por los 6.1.e) y 9.2.g) y y) del RGPD.

The complaint against a healthcare Foundation is filed, in which the complainant considered that his shared clinical history in Catalonia (HCCC) had been abused, since it was found that the doctor who accessed it did so to assist the complainant in a medical test, and that the information recorded about the access centre actually corresponded to the information about the centre where the doctor regularly provided his services, which was in his user profile.

Infraction of security measures within the framework of an internal audit conducted by the Foundation: 1) in the process of assigning new passwords, it was not guaranteed that credentials were under the exclusive control of users, as in the first entry the system did not force change by the user. 2) This also meant that it could not be guaranteed to know in an undoubted way what, who and when he performed a certain amount of work in the computer system. This lack of security was particularly apparent when auditors created new "ex novo" credentials for the system technician, and with these new credentials they accessed their work team in order to avoid risks in the system.

In order to be able to process the data relating to the vaccine status of Covid19 of the users of the center for the organization of group therapeutic activities on the basis of articles 6.1.c) and 9.2.i) of the RGPD, it would be necessary that the competent public health authorities establish a decision to this effect, which is not stated on the date of issue of this opinion.

The junction of anonymized data coming from different sources in order to develop a mathematical model for the prevention of epidemics and pandemics could end up identifying concrete persons, for which it is necessary to measure, to evaluate and to manage this risk of re-identification adopting the measures adapted to reduce it.

The requesting parent has the right to access a copy of the referral report prepared by the social services, except for the information that refers to the contact details of the other parent, as well as the data of the partner. this one and his daughter. This, except with regard to information affecting minor children, may also have to be restricted in the event that social services detect that there is a conflict of interest between the interests of the requesting parent and those of the minor children. to justify it.

The facts denounced because the sealed|stamped card|letter, user of the home-residence service addressed to the person for disabled persons, deposited in a deprived place for its|his|her|their addressee|recipient (in the rucksack) and accessible are filed by its|his|her|their legal tutors, in spite of the lack of concrete warning|notice to the parents of such performance|action.

The accusing person complained because the managing entity of a home residence for persons with disability, it|he|she would have collected images of its|his|her|their son without its|his|her|their consent. The complaint|denunciation is filed because the entity has denied that it|he|she has collected images, and the generic electronic mail that the entity sent in a massive way is not a sufficient test|proof of the existence of treatment.