Resolutions, opinions and reports search tool

The data protection regulations do not prevent the complainant from communicating the information he requests, regarding access to his clinical history, including the identity of the professionals, rank and professional category, who have accessed it.

The claimant, as holder of parental authority, exercised the right of access to the documentation presented by his underage daughter, which contained data from third parties affected who opposed the processing of data derived from the application for access, which is why the Department dismissed the request for access made by the claimant. The complaint is partially estimated as the Department responded to the request in an extemporaneous manner.

The complaint is partially appreciated, since the Directorate General of Police of the Department of the Interior did not respond in time to the request of the complainant, without it being appropriate to require any action, insofar as the DGP gave a reply adjusted to the right of request, albeit temporarily.

It resolves to sanction the City Council as responsible for three infringements: 1) lack of contract for the processor or equivalent document, 2) lack of information on the ends provided for in art.

For the information available, in the specific case examined, from the point of view of data protection regulations, there is no problem in giving the councillor access to the dossier of the stabilisation process for municipal workers, provided that it is information strictly necessary to achieve its functions. However, with regard to personal data of special protection (Article 9 of the GDPR) that may be included, it will be necessary to limit access, so that no more data is communicated than is strictly necessary to achieve the legitimate purpose that justifies access, that is, the development of the functions corresponding to councillors. In any case, once the councillor has access to municipal information on the basis of the functions legally mandated, this must be governed by the duty of reservation imposed by the regulations of local regulations, the principle of purpose limitation (Article 5.1.b) GDPR) and the duty of integrity and confidentiality (Article 5.1.f) GDPR.

The claimant asks for the rectification of the health data contained in a medical report, but does not provide any evidence to prove the error, the report's optional (and superior) report confirms that the report is correct, accurate and adequate, and the Authority considers that the information entered in the report is not lacking in any logic or meaning, nor inconsistent in view of the other information entered. Disappointment.

The complaint is partially estimated as the Health Department did not respond in time to the request submitted by the complaining party, which was aimed at access to traceability and HC3 for a specific period of time. However, it is not necessary to require the Department to carry out any action since the latter responded extemporaneously to the request and provided the party requesting all documentation held by it.

Disapproval of the claim of guardianship by right to delete a report and other data from the clinical history on the grounds of the optional person.

The claimant requested the removal of certain records of his clinical history which he considered incorrect. It is necessary to partially estimate the claim, since the entity gave an incomplete response, since it only referred to the deletion of any data that might appear in the clinical history of the applicant, without referring to demonstrations about the alleged falseness/incorrection of these data. The entity is required to request the amendment of the application so that the applicant can provide the proof of the alleged incorrections in the said background.

It is decided to admonise the Department of Justice, Rights and Memory since, as of 02/02/2023, when the Organic Law 7/2021, on the protection of personal data processed in the enforcement of criminal sanctions, was already fully applicable, the Department did not provide the prison population with all the information provided for in art. In this regard, no corrective measures are required since, in the letter of allegations that the Department has submitted to the Authority, it claims to have updated the right of information it provides to the prison population when entering a prison, in accordance with the IT 7/2021. In this regard, the entity has provided a copy of the right of information signed by persons who have entered prison during February and March 2023, and it is noted that these are already adapted to the IT 7/2021.