Resolutions, opinions and reports search tool

The reported entity sent the unpaid invoices by the leaseholder of a property owned by the complainant, to the complainant since this was the owner of the contracted policy for the supply of water and, therefore, the one obliged to pay the invoices. In this case, regardless of what the parties stipulated in the rental contract, the person who owned the property was obliged to pay before AGISSA. In this regard, it is worth saying that, later, the complainant changed the ownership of the policy in favor of a third person who leased his property and, when he left the property, he asked for the billing to be returned to his name. In this second case, the complainant also asked AGISSA to know the outstanding debt of the tenant since the transfer of rights and obligations of the aforementioned policy could only be carried out if the complainant assumed the amounts not satisfied. Likewise, he also alleged that he needed to know the outstanding amounts in order to be able to claim them judicially to the leased person of his property, to breach the clauses of the rental contract. In accordance with the above, the Authority considered that the sending of said information was protected by Article 6.1 f) RGPD since it was carried out to satisfy the legitimate interests of the complainant. Specifically, to satisfy the legitimate interest of the complainant to obtain the necessary evidence, to claim to the tenant of the property the amounts that he did not satisfy.

The Foundation could send an e-mail reporting on the training it will give this summer to its pupils on the legal basis of legitimate interest, provided that the information is limited to the training programme examined and is addressed exclusively to the pupils of up to 35 years of vocational training cycles, who should be given the option of opposing receiving communications of this kind.

The Foundation's communication to families and students aged over 14 years of information on activities of external entities may have sufficient legal basis in the legitimate interest (art. 6.1.f) GDPR), provided that it refers to activities or entities linked to or related to the nature of the Foundation's schools, and provided that the Foundation applies the specific guarantees set out in the V Legal Foundation of this opinion.

The hospital could communicate pseudonymized data relating to the health of patients treated with medicines for compassionate use in the pharmaceutical laboratory that facilitates the drug for clinical research purposes (Article 9.2.j) GDPR and paragraph 2.d) of DA 17a LOPDGDD) on the basis of the legitimate interest pursued by the laboratory.

The capture, recording and diffusion of images of natural persons identified or identifiable in the municipal pavilion constitutes a processing of personal data subject to the principles and obligations of the GPD, which could be permissible for the effects of Article 6.1.f) GDPR, provided that specific guarantees are applied, specifically, in relation to the duty of information and the principle of minimisation. The responsibilities of the intervening subjects should be clarified in order to determine who is responsible for treatment, as well as the justification of the use of mechanisms based on artificial intelligence.

The telephone number and e-mail address, as long as it can be directly or indirectly associated with an individual, are personal data whose processing must comply with the principles and guarantees of data protection regulations. The publication of data relating to the name of the establishment, the industrial address of the establishment, telephone number, e-mail address, website, direct link to the location on the map and geographical location coordinates of the companies registered in the RIAAC, may based on the consent of those affected. The dissemination of this data may also be based on the provisions of Articles 19.3 LOPDGDD and 6.4 RGPD, provided that the persons concerned are offered the possibility of requesting the exclusion of their company from the dissemination.

The inclusion in the registration certificates or flyers of the name and surnames of all the persons registered in the same address, at the request of one of the registered persons, may be protected by the consent of all the persons affected or, in the absence of consent, in the legitimate interest of the applicant, unless there are circumstances in the specific case that, after making the appropriate weighting, should lead to the prevalence of the right to the protection of personal data of the other people affected. To this end, it is of particular importance to inform the affected persons of the communication in advance of the effects that may be exercised, where appropriate, by the right of opposition.

The complainant complained that the City Council had given a company a copy of some of his invoices -without his consent-, who in turn would have contributed them in a judicial process initiated against the complainant for pecuniary claim. The complaint was filed, as it was not inferred from the documentation provided by the City Council that he had communicated his data, and these were allegations without evidentiary support. In addition, all indications are that, if a communication of data had taken place, it would be covered by Article 7.f) of Directive 95/46 / EC, due to the concurrence of a legitimate interest.

The consent of the physical persons who at present are part of the educational community or who have been part,means a suitable and sufficient juridical basis for the publication of photographs of these persons in the commemorative book (art. 6.1 a) RGPD). Regarding photographs of identified physical persons or identifiable that are not part of the educational community any more, its publication in the commemorative book can find sufficient juridical basis in the article 6.1.f) RGPD, in connection with the HIM 1/1982, without having to have the consent of the ones affected, whenever the Foundation applies specific guarantees.

In attention to the examined statutory forecasts, it would be justified to give a listing of the ones registered in the professional association with right to vote to the elections to the Executive Council, in what they are evident its name, surnames and address of electronic mail, to the person who has requested it electoral information for electronic mail, once it has been proclaimed their candidature, to the effects of sending them.