Resolutions, opinions and reports search tool

Taking into account the applicable regulations, it can be considered that there is a sufficient legal basis for the publication and dissemination of the academic qualifications of the group of university students (eg art. 6.1, sections e) and f) RGPD), without prejudice to the necessary compliance with the rest of the principles and guarantees of the data protection regulations. Given the principle of minimization, only the data necessary to comply with the intended purpose should be disseminated, taking into account the parameters and guidelines derived from the seventh additional provision of the LOPDGDD.

It is resolved to reprimand the accused entity given that, following a request for permanent disability, presented by the complainant here, a doctor issued a medical opinion, which included data referring to her health, which had nothing to do with the pathology that caused it. the disability petition. The complainant based her request on certain chronic back and foot injuries, and the controversial opinion included medical information related to a gynecological pathology, which had nothing to do with the IP file. This fact is considered to have violated the principle of minimization of personal data, which is why the General Subdirectorate of Medical Evaluations is reprimanded.

It resolves to warn the Autonomous University of Barcelona since it disseminated through the internet the list corresponding to the "Result of the draw for allocation of hospital teaching unit (2022-2023)" that contained personal data of certain students of the degree of medicine. Specifically, their name, surnames and university identification number (hereinafter, NIU). The aforementioned publication allowed third parties to know the hospital center assigned to each student, as well as their NIU, from which you can access other university data of the student (such as academic results). The aforementioned publication violated the principle of minimization of personal data, and constitutes the infringement foreseen in art. 72.1 a) LOPDGDD.

The access of the councilors to information regarding the amount and reason for the doubtful debts could find its justification in the control and supervision functions legally attributed to the councilors. This, without the need to provide the identity (name and surname) of all affected natural persons, for the purposes of the minimization principle. This, without prejudice to the fact that, once the information is known in the terms indicated, in some cases it may also be pertinent to know the identity of those affected, a possibility that would require specific consideration, taking into account the principles of data protection.

The incorporation of the address relative to the domicile in the notifications that must be made through electronic means would be contrary to the principle of data minimization. In this case, it is necessary to adopt the appropriate measures to ensure that the program used to generate the notifications does not incorporate this personal data by default. It is also necessary to proceed with the blocking of this data in the electronic notifications already made to a working person, given their deletion request.

The decision is to sanction the Foundation denounced for the use of a system of video surveillance cameras in certain rooms in the residence. In this respect, this imputed fact is considered to be a violation of the principle of minimisation insofar as such treatment is excessive for the intended purpose, and since there were other measures less intrusive to the privacy and privacy of the persons concerned.

A city council published in several official newspapers and on the municipal website, a notice notice of a mayoral decree to a plurality of people, containing a list of 381 buildings that the city council initially considered permanently unemployed, and identifying with the cadastral reference and exact address of each property, along with the full number of the DNI of the corresponding IBI passive persons in each case. The Advice is sanctioned, as the person responsible for the very serious infringement due to violation of the principle of application, for having made the publication without the concurrence of any legal basis. The publication of the real estate address along with the other published data (ref. cadastral and No. DNI) is considered excessive for the intended purpose (notification of the act), but the corresponding infringement, referring to the violation of the minimization principle, is subsumed in the infringement of the principle of application.

The open publication of an Act of the plenary, with more data than necessary and its publication for longer than is required, constitutes a violation of the principle of minimisation and the principle of limiting the period of conservation.

The installation of a video surveillance system inside the classrooms of municipal kindergartens could be proportionate in the face of reasonable indications of the possible commission of a serious illegal act by a person working any of the children, exceptionally and for a limited time, and provided that information is provided in accordance with article 89 of the LOPDGDD. The person in charge, however, would not have sufficient legitimacy to install this system so that parents and/or legal guardians can view live images of the activities carried out by their children.