Resolutions, opinions and reports search tool

A City Council is reprimanded as being responsible for an infraction due to violation of the principle of legality, for having sent to an inspector of the Generalitat-Mossos d'Esquadra police force two instances with personal data without legal basis, specifically, before the opening of confidential information against the reporting agent, and without there being a real danger to public safety or the investigation and prosecution of a crime.

The City Council of Sant Boi de Llobregat is admonished as responsible for an infringement provided for in Article 83.5.a in relation to Article 5.1.f, both of the GDPR, for sending an email to numerous people without using the hidden copy tool.

The claimant complained about the lack of attention to their rights of access and opposition that he would have exercised before the City Council, within the framework of his participation in a process of citizen participation of urban theme. The claim is estimated and the City Council is required to make effective the rights of access and opposition of the claimant and to account for this Authority.

The complainant complained that the City Council would have shared their personal data, in particular the content of the various SAIPs that it had formulated, with other municipalities, which would have received similar requests. The archiving is resolved as long as no evidence element is available that allows to accredit the communication of reported data.

For the information available, in the specific case examined, from the point of view of data protection regulations, there is no problem in giving the councillor access to the dossier of the stabilisation process for municipal workers, provided that it is information strictly necessary to achieve its functions. However, with regard to personal data of special protection (Article 9 of the GDPR) that may be included, it will be necessary to limit access, so that no more data is communicated than is strictly necessary to achieve the legitimate purpose that justifies access, that is, the development of the functions corresponding to councillors. In any case, once the councillor has access to municipal information on the basis of the functions legally mandated, this must be governed by the duty of reservation imposed by the regulations of local regulations, the principle of purpose limitation (Article 5.1.b) GDPR) and the duty of integrity and confidentiality (Article 5.1.f) GDPR.

Data protection regulations do not prevent access to the requested information consisting of the name and surnames of the person who met the head of the Area of Territory of the City Council in the context of a dossier protecting urban planning law, provided that this person has participated as a collegiate technician in the aforementioned dossier. Outside this assumption, access to the requested information should be denied.

The publication of the work census of the Col·legi d'Economistes de Catalunya, which included personal data (name, surnames, sex, DNI, seniority and professional category) of 21 people, relating to the electoral process for choosing the person representing the workers of the CEC, is denounced. It is also reported that the publication was made in a space accessible by people outside the CEC staff. It is archived because the processing has a legal basis and because it has not been proven that the census had been published in a place accessible to third parties.

The complaint is shelved because there is no rational indication of the reported facts. The complainant complained that the City Council would have disclosed its data to third parties, in relation to municipal charges.

Tomando en consideración los términos en que se formula la reclamación la normativa de protección de datos no impide el acceso de la persona reclamante a la información solicitada con la previa pseudonimització de los datos personales.

The access of the councilors to information regarding the amount and reason for the doubtful debts could find its justification in the control and supervision functions legally attributed to the councilors. This, without the need to provide the identity (name and surname) of all affected natural persons, for the purposes of the minimization principle. This, without prejudice to the fact that, once the information is known in the terms indicated, in some cases it may also be pertinent to know the identity of those affected, a possibility that would require specific consideration, taking into account the principles of data protection.