Resolutions, opinions and reports search tool

The Foundation could send an e-mail reporting on the training it will give this summer to its pupils on the legal basis of legitimate interest, provided that the information is limited to the training programme examined and is addressed exclusively to the pupils of up to 35 years of vocational training cycles, who should be given the option of opposing receiving communications of this kind.

The corporate email address of a city council, since it allows the identification of the account holder, is a personal data protected by data protection regulations. The processing of personal data resulting from the sending of email messages by a public worker, in particular the inclusion of third-party corporate mail addresses and the submission to an external recipient, may be legal if a legal basis (art. 6.1 GDPR) occurs and compliance with the principle of purpose (art. 5.1.b) GDPR is met. According to the system of liability provided for in the GDPR, the responsibility for infringements of data protection regulations rests with the controllers, without prejudice to the consequences of disciplinary proceedings.

The City Council stored a common electronic folder, to which all agents and administrative staff of the Local Police could access, a complaint that the complainant filed about the counting of hours of the service days carried out.

The complainant complained that, within the framework of the processing of a request for access to public information, the GAIP would have revealed to third parties affected by the access, their identity without the latter having requested it. However, in the pre-information phase initiated by this Authority, the complained entity has stated that, one of the persons affected by the access asked to know who was requesting controversial information. In this regard, in accordance with Article 62 RLTC, the GAIP considered, after consulting the applicant, that the submission of the application with its identity could be essential for the defense of the rights and interests held by the third party concerned. That being so, it should be noted that, consulted by the GAIP, the person here denouncing consented to the revelation of his identity. According to the above, therefore, the reported treatment was left open by Article 6.1(a) and c), in connection with the LLT and the LTTE, which is why the present actions are being closed.

In this case, for the information available, access by the applicant to a copy of the users' register of the drinking water supply service in a town planning, supply contracts and receipts liquidated between May 2022 and February 2023 cannot be considered as justified, nor can it be considered to be the personal data that may appear in the accounting register system established during the replacement in the provision of this service. However, there would be no problem, if necessary, in providing him with economic information, broken down and aggregated on the cost arising from the provision of the service, in the terms indicated in the opinion.

Resolution is issued, we imput the principle of accuracy given that a resolution is notified executively in a postal address corresponding to another vehicle of the person concerned; and not in the postal address that is specifically linked to the vehicle sanctioned in the registers of the DGT and that is the correct one in accordance with Article 90 of the LLei transit.

It is reported that a notification has been made as a natural person rather than as a representative of a legal person. The facts have not been proven to constitute an administrative infringement.

The access of the councilors to information regarding the amount and reason for the doubtful debts could find its justification in the control and supervision functions legally attributed to the councilors. This, without the need to provide the identity (name and surname) of all affected natural persons, for the purposes of the minimization principle. This, without prejudice to the fact that, once the information is known in the terms indicated, in some cases it may also be pertinent to know the identity of those affected, a possibility that would require specific consideration, taking into account the principles of data protection.

The FCF made available to football sports clubs a form through which clubs had to identify members with a federal license who were positive of Covid-19 and the federated persons with whom they had been close contact. They also had to report the start date of symptoms and their vaccination state. In this regard, the FCF has argued that the collection of data was carried out in compliance with the Action Plan for Sports Deconfinement of the Government of Catalonia, within which the FCF drew up its Protocol to minimize COVID-19 infections. That being the case, it should be noted that Resolution SLT/3652/2021 of 7 December, which was in force at the time of the reported facts, referred to the content of the action plan for sports deconfinement in anything that did not contradict it. In relation to the above, it must be made on the basis that, knowing which people were positive from COVID-19, the date of symptom presentation, and their vaccination state, was information necessary for the adoption of decisions relating to the organisation of the sports competition. In the light of the above, it should be concluded that the reported processing was disabled by Article 6.1c) GDPR, with the exceptions provided for in Article 9.2g) and i), in connection with the current public health regulations and the prevention of COVID-19 infection.

A person, who has requested leave as a nurse at the Terrassa Mutual Hospital, reports two accesses to his HC once he requested leave. It is not proven that these are improper accesses. The organization justifies the access by saying that according to the Department of Health of the Generalitat, it could access to check the vaccination status of its workers.