Resolutions, opinions and reports search tool

The incorporation of the address relative to the domicile in the notifications that must be made through electronic means would be contrary to the principle of data minimization. In this case, it is necessary to adopt the appropriate measures to ensure that the program used to generate the notifications does not incorporate this personal data by default. It is also necessary to proceed with the blocking of this data in the electronic notifications already made to a working person, given their deletion request.

There are four unjustifiable accesses to the HC3 of the person denouncing by staff of the Sanitary Corporation Parc Taulí de Sabadell. It resolves to admonish the Corporation as the person responsible for an infringement provided for in Article 83.5.a) in relation to Article 5.1.a), both of which are in the GDPR, for 2 undue access to the HC3 which have not been prescribed, for the violation of the basic principles for processing, specifically the principle of application.

It is decided to admonise the City Council of Tarragona since, in a call made by the person denouncing the Urban Guard of this City Council, he was collected personal data (name, surnames, DNI number and voice) and was not informed of the content provided in Article 13 GDPR. In addition, the city council is also credited with violating the principle of confidentiality since the Guardia Urbana informed the House denouncing that the "Seva Más" would have called, from the same home, to denounce the same facts. With regard to the collection of personal data, which the complainant considers excessive, it is appropriate to archive the facts since, according to the rules of administrative procedure, when a citizen submits a complaint, it must be identified.

The Department for Climate Action, Food and Rural Agenda notified the person denouncing a resolution addressed to a third person and containing personal data. It is decided to admonish the Department as the person responsible for a breach provided for in Article 83.5.a) in relation to Article 5.1.f), both of which are in the GDPR, for breach of the confidentiality principle.

It is decided to archive the present complaint since the access to the clinical history of the complainant was made from a Primary Care Center, by a professional who had assigned administrative and statistical management tasks, within the framework of the National Statistical Plan (2021-2024). In this respect, it should be concluded that the aforementioned access is covered by Article 6.1e) GDPR on the exercise of public powers, in accordance with Law 12/1989 of 9 May, on the Public Statistical Function.

The person complained that he had unduly accessed his clinical history. The ICS recognises this and states that it has taken steps to prevent any further undue access. A final resolution is issued, implying a violation of the principle of confidentiality.

A final resolution is issued, in violation of the principle of accuracy. The IMA notified a provision for mandatory execution in a domicile that had been in its own database since 2007, bypassing the domicile provided by the administration that imposed the sanction, transit, and which is in the DGT database. In addition, it uses a third address, which appears on a payment letter attached to the provision, which has also been in its own database (since 1997), for another vehicle. The facts charged constitute a violation of the principle of accuracy, for having circumvented the implementing regulation in relation to notifications of traffic fines, Article 90 Traffic Law.

A final resolution is issued on the basis of a request in relation to Article 9.2, in the same terms as the resolution resolving the previous appeal for repossement. The City Council has processed the health data of a career official without complying with Article 9.2 of the GDPR (which provides for a rule with the status of law or has a working agreement that complies with all the guarantees of the data subject). The city council provides a labor agreement but this one has no regulatory value and erga omnes effects since it has not been published.

The decision is to sanction the Foundation denounced for the use of a system of video surveillance cameras in certain rooms in the residence. In this respect, this imputed fact is considered to be a violation of the principle of minimisation insofar as such treatment is excessive for the intended purpose, and since there were other measures less intrusive to the privacy and privacy of the persons concerned.