Resolutions, opinions and reports search tool

It is appropriate to warn the City Council, since it did not duly inform about the treatment of images captured by video surveillance cameras installed in the control points of access to restricted traffic areas, since, apart from the information contained in the information posters, in the complementary information that was available on the website of the consistory, the City Council did not inform about the right to file a claim provided to this Authority, and all extremes

The company did not duly inform about the processing of images for video surveillance purposes. The company has accredited that, as a result of the request for information made within the framework of this research phase, it replaced the information poster of the existence of video surveillance cameras placed at the entrance door of the residence, and placed information posters on each of the floors that had unsignposted video cameras.

One person reported that he had received a call from a call centre for the purposes of COVID-19 vaccination, in which he was asked why he did not want to be vaccinated, and was informed that the call would be recorded. The Authority processed a sanctioning procedure against the Department of Health, who was warned for not having fulfilled the duty of information provided for in art. 13 RGPD. At the same time, he filed the rest of the reported facts, since, on the one hand, it was found that the call had been made by SEMSA, on behalf of the CatSalut, to whom the Department had commissioned to make those calls; and on the other hand, it was found that the collection of the reason for not wanting to be vaccinated (by free will) was protected by the applicable health regulations.

Apart from the information contained in the information posters, the residence did not make available to the affected people all the information provided for in article 13 GDPR.

The City Council in relation to video surveillance cameras for traffic control purposes installed in the municipality, did not make the right of information fully effective, since it did not make available to those affected all the information that is collected in article 13 of the RGPD.

It resolves to sanction the City Council as responsible for three infringements: 1) lack of contract for the processor or equivalent document, 2) lack of information on the ends provided for in art.

It is decided to admonise the Department of Justice, Rights and Memory since, as of 02/02/2023, when the Organic Law 7/2021, on the protection of personal data processed in the enforcement of criminal sanctions, was already fully applicable, the Department did not provide the prison population with all the information provided for in art. In this regard, no corrective measures are required since, in the letter of allegations that the Department has submitted to the Authority, it claims to have updated the right of information it provides to the prison population when entering a prison, in accordance with the IT 7/2021. In this regard, the entity has provided a copy of the right of information signed by persons who have entered prison during February and March 2023, and it is noted that these are already adapted to the IT 7/2021.

The form of the application in paper format did not include all the information in Article 13 GDPR. The online application form included all the ends of Article 13 of the GDPR, although through a chain of links that made it unreachable and transparent.

The complaint is filed by the municipal police officer who complained that the City Council had not reported the video surveillance system installed in the City Hall and in the police station located inside it, and that images captured by the cameras were later used to open a disciplinary file. It has been noted that the City Council had installed the posters in the city hall and the police station's accesses, and that they reported on the purpose of the facility's safety. In this regard, the denouncing person's behaviour, captured by video surveillance cameras and leading to the initiation of a disciplinary file, is considered to imply a breach of his or her surveillance functions, and consequently to affect the security of the building.

The right to information of the users of the entity, due to lack of documentary accreditation at the time of collection (Articles 12, 13, and 14 GDPR); and due to violation of the principle of application, due to the improper use of the data, which consists of subjective and negative comments on a group of members who wish to submit their candidature.