Resolutions, opinions and reports search tool

The City Council of Sant Boi de Llobregat is admonished as responsible for an infringement provided for in Article 83.5.a in relation to Article 5.1.f, both of the GDPR, for sending an email to numerous people without using the hidden copy tool.

Resolution is issued due to violation of the principle of confidentiality because a Consocio's collector, within the framework of a delegation of competences in matters of management and collection of taxes of the Bolvir City Council, sent emails to a wrong email address, linked to a particular, that contained personal data of taxpayers of the municipality of Bolvir.

The corporate email address of a city council, since it allows the identification of the account holder, is a personal data protected by data protection regulations. The processing of personal data resulting from the sending of email messages by a public worker, in particular the inclusion of third-party corporate mail addresses and the submission to an external recipient, may be legal if a legal basis (art. 6.1 GDPR) occurs and compliance with the principle of purpose (art. 5.1.b) GDPR is met. According to the system of liability provided for in the GDPR, the responsibility for infringements of data protection regulations rests with the controllers, without prejudice to the consequences of disciplinary proceedings.

The right to information of the users of the entity, due to lack of documentary accreditation at the time of collection (Articles 12, 13, and 14 GDPR); and due to violation of the principle of application, due to the improper use of the data, which consists of subjective and negative comments on a group of members who wish to submit their candidature.

The councilors' access to personal data included in the Municipal Register of Inhabitants may be enabled when, taking into account the specific purposes of the Register, access is necessary and provided for the development of the control functions of the activities of the municipal corporation, or other functions that may be attributed to the councilor, in the terms provided for in the LRBRL. It is not justified for the councilor to access the municipal register of inhabitants to configure the electoral program of the municipal group in relation to the tax ordinances, to perform the relevant calculations, identifying the people who are registered there.

The municipal policy for the use of digital information systems and devices must cover clear rules on the management to be made of the personalised corporate email account, and on the access to the information contained in it, both for the purpose of ceasing the employment relationship and in the event of temporary absence of the worker. It must also include specific provisions regarding the proper use of information systems by its staff and the control that the City Council can make of them to ensure their safety and good functioning. With regard to requests for access to and copying of e-mails by ex-workers, the observations made in this opinion must be taken into account.

There is no indication that the denounced City Council is the holder of the e-mail account from which a message was sent to certain local agents, criticising trade union behaviour. In this respect, it is also inappropriate to argue that the City Council has filtered information regarding corporate electronic addresses of members of the Police Corps, since, apart from the city council workers who may obviously have access to such corporate addresses, it cannot be ruled out that third parties have obtained this information by their own means (e.g., persons who have provided services to the City Council, or citizens who have related to these public employees).

The complainant complains that they made him send medical documentation by email and that this would facilitate access to medical data by non-health administrative staff. RA is issued since this was an exceptional shipment since the patient requested urgent assistance by phone for the prescription of pain medication and since the last medical report was not yet included in the HC3, since the same one had been issued day at another medical center, he was asked to send it by e-mail in order to carry out the medical prescription. These emails are managed by the administrative staff entrusted with these functions and, moreover, management does not involve access to medical documentation; only if it becomes essential for the performance of its functions. Art. 16 Law 41/2022.

It resolves to admonise the Official College of Veterinaries of Barcelona, because of the violation of the principle of application, given that this entity transferred to a veterinary centre the deontological consultation that a passenger raised with the COVB, in relation to the care received at the aforementioned veterinary centre, without there being a legal basis legitimising the processing of the data of the current complainant.

It is decided to fine the company that has been complained of, which is responsible for providing the public service of the tourist office in Alella, by means of a fine fine of  1.5001,500, since an e-mail was sent from that same office, without using hidden copying, to people who had booked a visit to a winery. This fact meant that the recipients of the message could see the email address of the other recipients and that they knew that the recipients had also reserved a visit to the cellar, in contravention of the principle of confidentiality of data.