Resolutions, opinions and reports search tool

The Authority considers that the provisions of the legislation on the prevention of money laundering and terrorist financing on the conduct of an impact assessment in relation to certain data processings could be interpreted, for the case of foundations and associations, to the effect that they should only do so at the same time that, if necessary, they detect facts that might be indications of money laundering or terrorist financing, given the obligation to report them to the SEPBLAC. This is without prejudice to the fact that, in view of the concurrence of certain specificities, the entities consider it appropriate to carry it out in advance in the event that they may encounter any of the communication assumptions imposed by this regulation.

The installation of a video surveillance system inside the classrooms of municipal kindergartens could be proportionate in the face of reasonable indications of the possible commission of a serious illegal act by a person working any of the children, exceptionally and for a limited time, and provided that information is provided in accordance with article 89 of the LOPDGDD. The person in charge, however, would not have sufficient legitimacy to install this system so that parents and/or legal guardians can view live images of the activities carried out by their children.

The impact assessment relating to data protection linked to the implementation of the waste collection service door to door must be carried out before the start of the processing and must assess the risks that the processing entails for the rights and freedoms of the persons concerned.

The City Council could create a register of the residents of the municipality who, given the concurrence of certain circumstances, would require a quick action by the civil protection forces in emergency situations. The use of data from the Register for this purpose would be compatible, but the incorporation of information relating to people's health would require their explicit consent.

Consent is not the legal basis that legitimises the processing of data for the provision of the waste collection service. This treatment is based on carrying out a mission in the public interest or exercising public powers. On the other hand, the fact that the reading of the labels incorporated into the bags or buckets allows the identification of the user of the service, since it is not credited, is archived.

The communication of anonymized information from the Municipal Register to a public company for the development of a predictive tool in the field of social services would not require a legal basis to legitimize it, as the legislation does not apply in these cases of data protection. However, it is necessary to ensure that the anonymization process applied guarantees that the physical persons affected cannot be identified by third parties without disproportionate efforts, as well as to assess the risks of any subsequent re-identification of these persons and, where appropriate, adopt the appropriate measures to mitigate it.

The start agreement was charged with the Department of Agriculture (now, Department of Climate Action, Food and Rural Agenda) Two violations: a) The violation of the principle of legality for having accessed the Personal Personal

The consent of the affected personnel cannot be considered an adequate legal basis for the implementation of a time control system through facial recognition such as the one described in the consultation. It would be necessary to foresee this control system in a legal provision or in an applicable collective agreement, or where appropriate, in a pact or agreement resulting from collective bargaining, circumstances that do not seem to occur in the case analyzed.In any case, before the implementation of such a system, it is necessary to make an assessment of the impact on data protection in light of the specific circumstances in which the treatment is carried out to determine its legality and proportionality, including the analysis of the existence of less intrusive alternatives, and establish the appropriate guarantees.

A city council is admonished as responsible for 4 infringements: 1) to capture images of the public track through cameras installed outside the micro-weapon, disproportionately (the public pathway was captured beyond what is required); 2) to use images captured for security purposes to identify the person who had not correctly deposited a residue; 3) Because the RAT does not include all prescriptive information and contains inaccurate information; and 4) To not fully inform the persons concerned.

Choosing the most appropriate selective collection model in the municipality requires an impact assessment on data protection. The City Council, in view of the powers it has been assigned in matters of waste management, would be entitled to carry out the processing of data arising from the implementation of the selective collection system. However, in the absence of a specific legal provision, the development of profiles that produce legal effects on the person using the service or that significantly affect them in a similar way, requires the explicit consent of the persons affected. The participation of third parties in the implementation of this system requires the formalization of a contract of manager and, where applicable, of sub-manager, as well as, where applicable, the fulfillment of the obligations established in this regard in the LCSP.