Resolutions, opinions and reports search tool

The Authority considers that the provisions of the legislation on the prevention of money laundering and terrorist financing on the conduct of an impact assessment in relation to certain data processings could be interpreted, for the case of foundations and associations, to the effect that they should only do so at the same time that, if necessary, they detect facts that might be indications of money laundering or terrorist financing, given the obligation to report them to the SEPBLAC. This is without prejudice to the fact that, in view of the concurrence of certain specificities, the entities consider it appropriate to carry it out in advance in the event that they may encounter any of the communication assumptions imposed by this regulation.

The installation of a video surveillance system inside the classrooms of municipal kindergartens could be proportionate in the face of reasonable indications of the possible commission of a serious illegal act by a person working any of the children, exceptionally and for a limited time, and provided that information is provided in accordance with article 89 of the LOPDGDD. The person in charge, however, would not have sufficient legitimacy to install this system so that parents and/or legal guardians can view live images of the activities carried out by their children.

The impact assessment relating to data protection linked to the implementation of the waste collection service door to door must be carried out before the start of the processing and must assess the risks that the processing entails for the rights and freedoms of the persons concerned.

The City Council could create a register of the residents of the municipality who, given the concurrence of certain circumstances, would require a quick action by the civil protection forces in emergency situations. The use of data from the Register for this purpose would be compatible, but the incorporation of information relating to people's health would require their explicit consent.

Consent is not the legal basis that legitimises the processing of data for the provision of the waste collection service. This treatment is based on carrying out a mission in the public interest or exercising public powers. On the other hand, the fact that the reading of the labels incorporated into the bags or buckets allows the identification of the user of the service, since it is not credited, is archived.

The communication of anonymized information from the Municipal Register to a public company for the development of a predictive tool in the field of social services would not require a legal basis to legitimize it, as the legislation does not apply in these cases of data protection. However, it is necessary to ensure that the anonymization process applied guarantees that the physical persons affected cannot be identified by third parties without disproportionate efforts, as well as to assess the risks of any subsequent re-identification of these persons and, where appropriate, adopt the appropriate measures to mitigate it.

The consent of the affected personnel cannot be considered an adequate legal basis for the implementation of a time control system through facial recognition such as the one described in the consultation. It would be necessary to foresee this control system in a legal provision or in an applicable collective agreement, or where appropriate, in a pact or agreement resulting from collective bargaining, circumstances that do not seem to occur in the case analyzed.In any case, before the implementation of such a system, it is necessary to make an assessment of the impact on data protection in light of the specific circumstances in which the treatment is carried out to determine its legality and proportionality, including the analysis of the existence of less intrusive alternatives, and establish the appropriate guarantees.

Choosing the most appropriate selective collection model in the municipality requires an impact assessment on data protection. The City Council, in view of the powers it has been assigned in matters of waste management, would be entitled to carry out the processing of data arising from the implementation of the selective collection system. However, in the absence of a specific legal provision, the development of profiles that produce legal effects on the person using the service or that significantly affect them in a similar way, requires the explicit consent of the persons affected. The participation of third parties in the implementation of this system requires the formalization of a contract of manager and, where applicable, of sub-manager, as well as, where applicable, the fulfillment of the obligations established in this regard in the LCSP.

The proposed anonymization process would not guarantee the treatment of anonymous data within the Project to be developed by the University. However, the option of articulating the treatment on the basis of the explicit consent of the persons concerned could be considered, without prejudice to the adoption of appropriate measures to ensure that this treatment is in line with the RGPD, such as providing detailed and clear information in this regard, and applying the measures indicated in the opinion to make re-identification difficult.

The collection of data has to respect the principle|beginning of loyalty. For the treatment of special categories of data, it is necessary that one of the foreseen circumstances contributes to article|item 9.2 RGPD. In the collection of data cash has to be made the law|right of information. To determine the appropriate technical and organizational measures to guarantee the security|certainty of the data, it is necessary to make one analysis of risks. With character previous to the treatment, it is necessary to carry out an evaluation of impact related to the data protection when the treatment entails a high risk for the rights and freedoms of the affected persons. The representative of data protection has to take part in all the questions related to the data protection personal in a suitable way and in the appropriate moment.