Resolutions, opinions and reports search tool

The City Council of Sant Boi de Llobregat is admonished as responsible for an infringement provided for in Article 83.5.a in relation to Article 5.1.f, both of the GDPR, for sending an email to numerous people without using the hidden copy tool.

The complainant complained that the City Council would have shared their personal data, in particular the content of the various SAIPs that it had formulated, with other municipalities, which would have received similar requests. The archiving is resolved as long as no evidence element is available that allows to accredit the communication of reported data.

The incorporation of the address relative to the domicile in the notifications that must be made through electronic means would be contrary to the principle of data minimization. In this case, it is necessary to adopt the appropriate measures to ensure that the program used to generate the notifications does not incorporate this personal data by default. It is also necessary to proceed with the blocking of this data in the electronic notifications already made to a working person, given their deletion request.

The open publication of an Act of the plenary, with more data than necessary and its publication for longer than is required, constitutes a violation of the principle of minimisation and the principle of limiting the period of conservation.

The City Council of Tordera is admonished as publishing the final qualifications obtained for applicants suspended in a selection process constitutes a violation of the principle of application. Furthermore, the dissemination to the municipal website of the list of applicants excluded from the selection process for a time beyond what is strictly necessary constitutes a violation of the principle of limiting the term of conservation. And, ultimately, the dissemination of the names and surnames of the applicants and the last four figures of their DNI and the letter is a violation of the principle of data minimization, since the LOPDGDD does not foresee that, in the publication of administrative acts, the letter of the DNI should be added.

Persons participating or having participated in a staff selection process, as well as workers' representatives, shall have the right to access certain personal information contained in the resulting file, in the terms indicated in the opinion, and may exercise their right of access as long as the health consortium has this public information available. It may be a good practice to inform aspiring recipients of your data as a result of their participation in a selection process.

The City Council may keep published on the portal the information of ex-councilors of the corporation that may be necessary to comply with the obligations established in the transparency legislation, as long as the publication deadlines provided for in these regulations have not elapsed. Instead, it must delete from the municipal website the published information in respect of which this legal obligation does not exist, unless there are any other exceptions provided for in article 17.3 RGPD. Once these deadlines have elapsed, the historical interest may justify the maintenance of the publication of information on the names and surnames of the councilors and ex-councilors, the position they held, the municipal group of which they were part and the period in which they held office. not the rest of the information.

It is up to the people in charge of the liquidation of the professional association to make the decision on the destination that should be given to the documentation that it has. However, from the point of view of data protection, the legal basis of article 6.1.e) RGPD would enable the delivery to the Catalan territorial demarcation of the state-level professional association of that documentation in which they appear. personal data linked to the exercise of the public functions of the professional associations. With regard to data linked to the exercise of private functions, their communication to that demarcation could be articulated on the basis of consent. With regard to those data that are not provided to him, they will have to examine the need for their treatment and, consequently, determine their conservation or deletion.