Resolutions, opinions and reports search tool

The Public Health Agency of Catalonia communicated to the Labour Risk Prevention Services of the Catalan company in which it provides services denouncing the list of staff who did not have the complete pattern of vaccination against COVID-19. This communication was carried out within the framework of a vaccination campaign by the Health Department. In this respect, the communication in question does not contravene data protection regulations, insofar as both occupational risk prevention regulations and public health regulations empower health authorities to establish mechanisms for collaboration with the occupational risk prevention services of private companies.

The requirement of the COVID certificate in the terms set out and which have been authorized by the Superior Court of Justice of Catalonia, cannot be considered contrary to the regulations for the protection of personal data. Likewise, when this certificate is required, the requirement to show the front of the DNI for the purposes of verifying identity is compatible and provided in accordance with personal data protection regulations.

The Department of Health entrusted|ordered SEMSA the recruitment of the service of follow-up of the narrow contacts with infected persons of covid-19, which entailed|meant the data processing personal. And to|in such effect SEMSA hired the private company Ferroser Servicios Auxiliares, SA, without formalizing the order of the treatment in a contract as the art requires. 28 RGPD, which it|he is constitutive of offense.

In order to be able to process the data relating to the vaccine status of Covid19 of the users of the center for the organization of group therapeutic activities on the basis of articles 6.1.c) and 9.2.i) of the RGPD, it would be necessary that the competent public health authorities establish a decision to this effect, which is not stated on the date of issue of this opinion.

The holders of public facilities and/or private establishments may request, in the exercise of their function of monitoring compliance with the measure adopted by the health authorities consisting of the mandatory use of the mask in any closed space for public use or that is open to the public, the documentation that certifies the concurrence of any of the causes of exemption from the obligation to wear a mask to those who access it without a mask. Not allowing entry to establishments open to the public to those that are applicable to the provisions of Law 11/2009 to those people who refuse to show this documentation on the basis of the right of admission cannot be understood as discrimination, since they are obliged to comply with the established requirements and access and admission rules. These include those adopted by the competent health authorities, such as the use of a mask in certain spaces.

Based on the information available, the processing of data relating to the communication of a university census to the Department of Health, through the Interuniversity Council of Catalonia, does not have authorization from the point of view of the regulations of data protection, as it is not covered by public health regulations.