Resolutions, opinions and reports search tool

It is resolved to declare that the City Council of Sant Andreu de Llavaneres has violated Article 83.4, in relation to Article 35; both of the RGPD, since it has not carried out the necessary impact assessment to assess the risks associated with the processing of personal data carried out within the framework of the provision of the waste collection service "port to door".

It resolves to warn the City Council of La Garriga since it has not carried out the necessary impact assessment in relation to the processing of personal data carried out within the framework of the provision of the waste collection service "door-to-door"; it does not have the RAT updated; and it did not provide the right of information to users of the aforementioned service in accordance with article 11 LOPDGDD.

It resolves to warn the City Council of Cardedeu since it has not carried out the necessary data protection impact assessment, in relation to the processing of personal data that it carries out within the framework of the provision of the door-to-door waste collection service. Likewise, the City Council is also admonished for not having accredited compliance with its duty of information, prior to the moment in which the users of this service provide their personal data, to obtain the elements of containment.

A citizen accesses, through his personal folder to the electronic headquarters of the City Council, the documentation of a third person in relation to a file that has nothing to do with his complaint. The violation of the principle of confidentiality is alleged. The infringement of art is also proven. 25 RGPD, of technical measures from the design and by default, although, after a medial competition, it is only charged for the most serious infringement.

The Authority considers that the provisions of the legislation on the prevention of money laundering and terrorist financing on the conduct of an impact assessment in relation to certain data processings could be interpreted, for the case of foundations and associations, to the effect that they should only do so at the same time that, if necessary, they detect facts that might be indications of money laundering or terrorist financing, given the obligation to report them to the SEPBLAC. This is without prejudice to the fact that, in view of the concurrence of certain specificities, the entities consider it appropriate to carry it out in advance in the event that they may encounter any of the communication assumptions imposed by this regulation.

The installation of a video surveillance system inside the classrooms of municipal kindergartens could be proportionate in the face of reasonable indications of the possible commission of a serious illegal act by a person working any of the children, exceptionally and for a limited time, and provided that information is provided in accordance with article 89 of the LOPDGDD. The person in charge, however, would not have sufficient legitimacy to install this system so that parents and/or legal guardians can view live images of the activities carried out by their children.

The impact assessment relating to data protection linked to the implementation of the waste collection service door to door must be carried out before the start of the processing and must assess the risks that the processing entails for the rights and freedoms of the persons concerned.

The City Council could create a register of the residents of the municipality who, given the concurrence of certain circumstances, would require a quick action by the civil protection forces in emergency situations. The use of data from the Register for this purpose would be compatible, but the incorporation of information relating to people's health would require their explicit consent.

Consent is not the legal basis that legitimises the processing of data for the provision of the waste collection service. This treatment is based on carrying out a mission in the public interest or exercising public powers. On the other hand, the fact that the reading of the labels incorporated into the bags or buckets allows the identification of the user of the service, since it is not credited, is archived.

The communication of anonymized information from the Municipal Register to a public company for the development of a predictive tool in the field of social services would not require a legal basis to legitimize it, as the legislation does not apply in these cases of data protection. However, it is necessary to ensure that the anonymization process applied guarantees that the physical persons affected cannot be identified by third parties without disproportionate efforts, as well as to assess the risks of any subsequent re-identification of these persons and, where appropriate, adopt the appropriate measures to mitigate it.