Resolutions, opinions and reports search tool

The medical history of the reported foundation is configured in such a way that, by design and by default, the foundation's own and external doctors can access it, through the foundation's information systems. This fact caused an external doctor who treated the reporting person within the framework of private healthcare to access his medical history, without his explicit consent or any other legal basis that legitimized this treatment. In this case, the violation of the duty of data protection by design and by default is not imputed, since there is an ideal competition of infringements and only the most serious infringement is imputed; that is, the violation of the principle of legality (qualified as very serious). Nor is the violation of the principle of purpose limitation imputed, because it is subsumed in the infringement relating to the principle of legality.

It is resolved to declare that the City Council of Sant Andreu de Llavaneres has violated Article 83.4, in relation to Article 35; both of the RGPD, since it has not carried out the necessary impact assessment to assess the risks associated with the processing of personal data carried out within the framework of the provision of the waste collection service "port to door".

It resolves to warn the City Council of La Garriga since it has not carried out the necessary impact assessment in relation to the processing of personal data carried out within the framework of the provision of the waste collection service "door-to-door"; it does not have the RAT updated; and it did not provide the right of information to users of the aforementioned service in accordance with article 11 LOPDGDD.

It resolves to warn the City Council of Cardedeu since it has not carried out the necessary data protection impact assessment, in relation to the processing of personal data that it carries out within the framework of the provision of the door-to-door waste collection service. Likewise, the City Council is also admonished for not having accredited compliance with its duty of information, prior to the moment in which the users of this service provide their personal data, to obtain the elements of containment.

A citizen accesses, through his personal folder to the electronic headquarters of the City Council, the documentation of a third person in relation to a file that has nothing to do with his complaint. The violation of the principle of confidentiality is alleged. The infringement of art is also proven. 25 RGPD, of technical measures from the design and by default, although, after a medial competition, it is only charged for the most serious infringement.

The Authority considers that the provisions of the legislation on the prevention of money laundering and terrorist financing on the conduct of an impact assessment in relation to certain data processings could be interpreted, for the case of foundations and associations, to the effect that they should only do so at the same time that, if necessary, they detect facts that might be indications of money laundering or terrorist financing, given the obligation to report them to the SEPBLAC. This is without prejudice to the fact that, in view of the concurrence of certain specificities, the entities consider it appropriate to carry it out in advance in the event that they may encounter any of the communication assumptions imposed by this regulation.

The installation of a video surveillance system inside the classrooms of municipal kindergartens could be proportionate in the face of reasonable indications of the possible commission of a serious illegal act by a person working any of the children, exceptionally and for a limited time, and provided that information is provided in accordance with article 89 of the LOPDGDD. The person in charge, however, would not have sufficient legitimacy to install this system so that parents and/or legal guardians can view live images of the activities carried out by their children.

The impact assessment relating to data protection linked to the implementation of the waste collection service door to door must be carried out before the start of the processing and must assess the risks that the processing entails for the rights and freedoms of the persons concerned.

The City Council could create a register of the residents of the municipality who, given the concurrence of certain circumstances, would require a quick action by the civil protection forces in emergency situations. The use of data from the Register for this purpose would be compatible, but the incorporation of information relating to people's health would require their explicit consent.

Consent is not the legal basis that legitimises the processing of data for the provision of the waste collection service. This treatment is based on carrying out a mission in the public interest or exercising public powers. On the other hand, the fact that the reading of the labels incorporated into the bags or buckets allows the identification of the user of the service, since it is not credited, is archived.