Resolutions, opinions and reports search tool

Un club deportivo de fútbol de nueva creación contactó con la Federación Catalana de Fútbol dado que cuando intentaba vincular dieciséis jugadores a su club, la Intranet federativa le mostraba un mensaje mediante el cual se lo informaba que los mencionados jugadores estaban vinculados a otro club deportivo. Al respeto, la persona denunciando se quejaba por el hecho que, desde la FCF se había enviado al mencionado club de nueva creación unas impresiones de pantalla que contenían los datos personales de los 16 jugadores que, en aquel momento, estaban vinculados a otro club. Pues bien, por su parte, la entidad denunciada ha reconocido haber enviado las impresiones de pantalla - con información personal de los jugadores (nombre, apellidos y DNI) - al club de nueva creación, a los efectos de mostrarle los pasos que tenía que seguir para poder inscribir a los jugadores, y ha argumentado que este hecho no constituye una comunicación ilícita de datos personales dado que el receptor de la información, ya era conocedor de estas información. Al respeto, añadía que, la Intranet muestra el mencionado mensaje después de que el club haya introducido los datos personales de los jugadores. En estos términos, procede el archivo de los hechos denunciados dado que, cuando la FCF envió los datos personales de los jugadores al Club que los intentaba inscribir, este ya disponía de la información.

It resolves to warn the Autonomous University of Barcelona since it disseminated through the internet the list corresponding to the "Result of the draw for allocation of hospital teaching unit (2022-2023)" that contained personal data of certain students of the degree of medicine. Specifically, their name, surnames and university identification number (hereinafter, NIU). The aforementioned publication allowed third parties to know the hospital center assigned to each student, as well as their NIU, from which you can access other university data of the student (such as academic results). The aforementioned publication violated the principle of minimization of personal data, and constitutes the infringement foreseen in art. 72.1 a) LOPDGDD.

The claimant complained that the municipal company that manages the service of crane, withdrawal and deposit of vehicles of the City Council had responded in an incomplete way to its request to exercise the right of access. The claim of guardianship is estimated, since the City Council (who was responsible for the treatment) had provided in an incomplete way the information provided in sections 1st and 2nd of article 15 of the RGPD.

The complainant complains that the ITV station provided a third party with the ITV card of their vehicle. This was due to human error and the accused entity proceeded to take measures to correct the situation. Despite this, the registration of a vehicle is personal data and therefore constitutes a breach of data protection regulations.  The principle of confidentiality must be upheld.

The right to information of the users of the entity, due to lack of documentary accreditation at the time of collection (Articles 12, 13, and 14 GDPR); and due to violation of the principle of application, due to the improper use of the data, which consists of subjective and negative comments on a group of members who wish to submit their candidature.

The disclosure of data of a user of the Legal Orientation Service of the ICB is reported in a private law firm. ICAB responsibility has not been accredited.

The City Council of Argentona reported that a councillor of the All per Argentona Municipal Group would have accessed the personal data contained in the pre-enrolment and enrolment files of the municipal nursery schools for the 2021-2022 year, would have collected the contact details of the families who would not have obtained a place for their children, and would have contacted them via Whatsapp with the aim of asking them for personal data and summoning them to a meeting and then submitting an application to the City Council. For its part, the Municipal Group refused to contact the families on the basis of the consultation of the file, and stated that contacts were initiated earlier and based on personal acquaintances and relationships. In this respect, since the Authority does not have evidence that the denounced municipal group collected the personal data of the controversial file and used it to contact different families, it is necessary to archive the facts that are involved here.

Infringement of the principle of application is required due to lack of legal basis in Article 6.1 GDPR. The Institute sent a statement with an attached document, to all parents, informing students of the optional subjects they will take, identified with the DNI number, and in order to purchase the school material. The DNI number is personal data, despite being treated in isolation.

The complainant complained about the fact that certain GU agents asked him to identify, without this action - according to the complainant - being enabled by any rule. However, the police report provided by the City Council, signed by three agents, describes the events that occurred and justifies identification for the prevention of a major conflict on the road. In this respect, it should be concluded that the processing was necessary for the exercise of public powers conferred on the controller (art. 6.1 e) GDPR) in accordance with the Organic Law for the Protection of Citizen Safety, and therefore the file of the complaint proceeds. The complainant also complained that the Lleida City Council has a register of social activists. However, in the absence of sufficient indications, and given that the accused entity has denied these facts, his file is proceeded.

The complainant explained that the Lleida City Council would have provided a third person (the new acquirer of a license) with the document relating to the "Joint declaration of change of ownership of activities", which would contain the personal data (name, surnames, address and number of DNI) of the complainant. However, since it has not been possible during the previous information phase to prove that the communication of personal data is attributable to the Lleida City Council, as the complainant stated, it is appropriate to archive the present complaint.