Resolutions, opinions and reports search tool

One entity is sanctioned, absorbing another, within the framework of the provision of a health monitoring service. He sent citation emails to various workers who mistakenly contained data from other workers.

A private entity is sanctioned for having entrusted the management of the medical check appointments of workers to another entity without having formalised the contract of sub-responsor of the treatment, and without having requested the controller to authorise the sub-response of the treatment.

Els Serveis Socials Bàsics (SSB) de l'Ajuntament va encarregar a una entitat externa el seguiment psicoterapèutic d'algunes famílies, sense haver subscrit el preceptiu contracte d'encarregat del tractament.
En aquest procediment també s'arxiven d'altres fets denunciats, en concret:
1) La recollida per part del SSB d'un informe que l'EATAF havia elaborat en el marc d'un procés judicial de família, en el que constaven les dades del denunciant, sense comptar amb el seu consentiment. El tractament d'aquest informe pel SSB està habilitat per la normativa de serveis socials i de protecció a la infància i l'adolescència.
2) El tractament del citat informe de l'EATAF per part dels SSB, sense haver informat a la persona denunciant. El dret d'informació estava excepcionat d'acord amb el que disposa l'art. 14.5.c RGPD
3) Cessió de dades, sense consentiment del denunciant, entre els SSB i l'entitat externa. No hi ha comunicació de dades en la mesura que l'entitat actua com encarregada del tractament dels SSB.

The complaint is shelved because the Pere Media Foundation, as responsible for the treatment of CSSB, was considered to have access to the meetings held by the DS Department and CSSB dealing with the matter concerning the return of the child of the claimant to the residence house managed by the aforementioned Foundation.

Choosing the most appropriate selective collection model in the municipality requires an impact assessment on data protection. The City Council, in view of the powers it has been assigned in matters of waste management, would be entitled to carry out the processing of data arising from the implementation of the selective collection system. However, in the absence of a specific legal provision, the development of profiles that produce legal effects on the person using the service or that significantly affect them in a similar way, requires the explicit consent of the persons affected. The participation of third parties in the implementation of this system requires the formalization of a contract of manager and, where applicable, of sub-manager, as well as, where applicable, the fulfillment of the obligations established in this regard in the LCSP.

The communication of information on the trainers to impart the formative action to companies and organizing entities, limited to the identifying data, of contact and of training or experience, would be lawful and would adjust to the principle of minimization of data, to be necessary both for the execution of the contract and for the fulfillment of legal obligations. In addition, the competent authorities may require the information related to the training action necessary to control the execution and application of the bonus by the companies. With the information available, it does not seem justified to communicate information relating to the data relating to the user and password for access to the virtual classroom assigned to students in the training activity, nor those relating to the professional situation of the training staff or responsible for the activity.

From the point of view of data protection regulations, the performance of medical examinations to control the absenteeism of workers subject to the scope of application of the ET, by the medical staff of a company contracted by the The City Council would have as its legal basis Article 20.4 of the ET in relation to Articles 6.1.b) and 9.2.b) of the RGPD. This legal basis would not apply but to civil servants. For the performance of statistics and for the monitoring and management of absenteeism, it is not justified for the company to access information from all municipal employees but only from those who have had an absence. The city council must keep the data of the workers necessary for the execution of the contract and compliance with the applicable labor regulations for the duration of the employment relationship. These data must include identification and contact details that would allow him to contact the worker in cases of absenteeism. With regard to the time control data, and their justifications, it will be necessary to take into account the 4-year period established by current regulations, without prejudice to the duty to block the data from being deleted, in order to meet any responsibilities.

In the case of subcontracting that has been examined here, the repealed Organic Law 15/1999, of 13 December, of data protection of a personal nature, and also of public procurement rules, applies. In the case that has been examined, it has been proven that the subcontracting of cloud service provision met the requirements laid down in the aforementioned regulation.

The city council can access the information available to the concessionaire of the water supply relating to homes for which there is no water consumption in the last 2 years or when this consumption is abnormally low, in order to 'apply the surcharge to the IBI provided for in the TRLRHL with respect to these homes.