Resolutions, opinions and reports search tool

A City Council is reprimanded as being responsible for an infraction due to violation of the principle of legality, for having sent to an inspector of the Generalitat-Mossos d'Esquadra police force two instances with personal data without legal basis, specifically, before the opening of confidential information against the reporting agent, and without there being a real danger to public safety or the investigation and prosecution of a crime.

The City Council of Sant Boi de Llobregat is admonished as responsible for an infringement provided for in Article 83.5.a in relation to Article 5.1.f, both of the GDPR, for sending an email to numerous people without using the hidden copy tool.

The claimant complained about the lack of attention to their rights of access and opposition that he would have exercised before the City Council, within the framework of his participation in a process of citizen participation of urban theme. The claim is estimated and the City Council is required to make effective the rights of access and opposition of the claimant and to account for this Authority.

The complainant complained that the City Council would have shared their personal data, in particular the content of the various SAIPs that it had formulated, with other municipalities, which would have received similar requests. The archiving is resolved as long as no evidence element is available that allows to accredit the communication of reported data.

For the information available, in the specific case examined, from the point of view of data protection regulations, there is no problem in giving the councillor access to the dossier of the stabilisation process for municipal workers, provided that it is information strictly necessary to achieve its functions. However, with regard to personal data of special protection (Article 9 of the GDPR) that may be included, it will be necessary to limit access, so that no more data is communicated than is strictly necessary to achieve the legitimate purpose that justifies access, that is, the development of the functions corresponding to councillors. In any case, once the councillor has access to municipal information on the basis of the functions legally mandated, this must be governed by the duty of reservation imposed by the regulations of local regulations, the principle of purpose limitation (Article 5.1.b) GDPR) and the duty of integrity and confidentiality (Article 5.1.f) GDPR.

Data protection regulations do not prevent access to the requested information consisting of the name and surnames of the person who met the head of the Area of Territory of the City Council in the context of a dossier protecting urban planning law, provided that this person has participated as a collegiate technician in the aforementioned dossier. Outside this assumption, access to the requested information should be denied.

The complaint is shelved because there is no rational indication of the reported facts. The complainant complained that the City Council would have disclosed its data to third parties, in relation to municipal charges.

The access of the councilors to information regarding the amount and reason for the doubtful debts could find its justification in the control and supervision functions legally attributed to the councilors. This, without the need to provide the identity (name and surname) of all affected natural persons, for the purposes of the minimization principle. This, without prejudice to the fact that, once the information is known in the terms indicated, in some cases it may also be pertinent to know the identity of those affected, a possibility that would require specific consideration, taking into account the principles of data protection.

The City Council can keep the minutes of the plenary that are necessary to fulfill the obligations laid down in the transparency law published on the portal. In this case, the minutes of the plenary can be published in the electronic headquarters of the Administer along with the identifying data (name and surname) by reason of the charge, without including, according to the principle of minimization of the data, the publication of the manuscript signature. As for the time it is recommended to keep the full minutes published, this must be temporarily limited to the period necessary to achieve the purpose justifying the publication of the data. As regards the possible application for access to these acts, we should not anonymise the merely identifying data (name, surname) of the ex-registered person who spoke on the occasion of his or her position. As far as handwritten signature is concerned, access would not be justified.

Data protection regulations do not prevent the complainant from having access, if he is delegated from a trade union organisation that has the most representative status, to information on training data, professional experience, as well as punctuation with respect to merits and other valorative elements that have been taken into account in the selection process and the scores awarded in relation to the subject. In the event that the complainant does not belong to a union organization that has the most representative status, the information must be limited to the identity of the person selected in a selective process - if applicable, the worker concerned - and the scores obtained in the different merits or tests.