Resolutions, opinions and reports search tool

The complaining party initiated the present rights protection procedure before this Authority as it considered that the requested entity gave it the requested information (clinical course of visits of 12.09.22 and 21.09.22) in a manipulated manner. In this regard, it demanded access to the original annotations made by doctors doctors to the clinical course of the two reference visits. Well, in consultation with this Authority, the Hospital Clinico has stated that the information it gave to the complainant, in response to his request, is the original version of the notes that doctors made in the clinical course, and that this documentation has not been manipulated or modified. In this regard, the content of the Hospital's response was transferred to the requesting party, so that it would submit the allegations or evidence it considered relevant, warning it that, if within 10 days it did not submit any writings, it would be understood that the Hospital had fully complied with its application for access. After this period, the complaining party has argued nothing against considering their right of access satisfied, which is why it should be concluded that the information that the Hospital gave to the complainant, in response to his request, was all that was in their power. That being the case, it is appropriate to reject the complaint, because the entity gave a full response within the legally envisaged deadline, to the specific terms of the application.

The FCF made available to football sports clubs a form through which clubs had to identify members with a federal license who were positive of Covid-19 and the federated persons with whom they had been close contact. They also had to report the start date of symptoms and their vaccination state. In this regard, the FCF has argued that the collection of data was carried out in compliance with the Action Plan for Sports Deconfinement of the Government of Catalonia, within which the FCF drew up its Protocol to minimize COVID-19 infections. That being the case, it should be noted that Resolution SLT/3652/2021 of 7 December, which was in force at the time of the reported facts, referred to the content of the action plan for sports deconfinement in anything that did not contradict it. In relation to the above, it must be made on the basis that, knowing which people were positive from COVID-19, the date of symptom presentation, and their vaccination state, was information necessary for the adoption of decisions relating to the organisation of the sports competition. In the light of the above, it should be concluded that the reported processing was disabled by Article 6.1c) GDPR, with the exceptions provided for in Article 9.2g) and i), in connection with the current public health regulations and the prevention of COVID-19 infection.

A person, who has requested leave as a nurse at the Terrassa Mutual Hospital, reports two accesses to his HC once he requested leave. It is not proven that these are improper accesses. The organization justifies the access by saying that according to the Department of Health of the Generalitat, it could access to check the vaccination status of its workers.

The data protection regulations do not prevent the claimant from accessing the information relating to the number of jobs corresponding to the call for 300 (internal procedure procedure 361), indicating the date of creation of the place and periods in which the places have been covered by interruptions, including information relating to the order number of persons assigned to each of the places.

In view of the rules governing Equality Plans in companies, it can be said that the members of the Committee of Workers of the entity that are part of the negotiating Commission for the Equality Plan must be able to access information from the Tax Register, which must be in accordance with the terms of Article 28.2 of the ET, despite having professional categories with a small number of workers, while remaining those obliged to respect the confidentiality of this information.

The complainant complained about the fact that the Sports Park Municipal Guiera, managed by the City Council of Cerdanyola del Vallès, conditioned access to the users of the sports center, in the exhibition of Passaport Covid-19. In relation to this, it should be noted that Resolution SLT/3787/2021 of 23 December, in force at the time of the event, provided for the requirement to submit the certificate of vaccination, diagnostic testing or recovery of COVID-19 to access "to rooms and gymnasiums where physical and/or sports activity is practised". In these terms, it should be pointed out that the reported processing was made redundant by Article 6.1 GDPR (c) since it was necessary to comply with a legal obligation and that, according to the exceptions provided for in Article 9.2 g) GDPR, the processing of health data must be necessary for reasons of essential public interest, and for the exception of paragraph 1(i) of the aforementioned article, which provides that the processing must be necessary for reasons of public interest in the field of public health. Ultimately, the complainant complained about the fact that PEM Guiera staff accessed his personal data, without prior consent. However, consulted by this Authority, the complainant confirmed that he had not exhibited the Passaport covid-19 to the staff of the PEM Guiera when required, and the complainant has argued that the staff of the center acted in the exercise of their functions, so no breach of the current legislation is noted.

The Agency for the Housing of Catalonia is admonished for breach of the duty of confidentiality, for having communicated to a person (A) the erroneous renewal of another person's registration (B) in the Register of Housing Applicants with Official Protection of Catalonia. This error in turn stemmed from another mistake made by the municipal company under charge, which linked the request for renewal of A to the letter of B.

The Agency is admonished as being responsible for a serious breach of security measures because its main website did not implement a secure website authentication protocol (HTTPS).

The complaint is filed by the municipal police officer who complained that the City Council had not reported the video surveillance system installed in the City Hall and in the police station located inside it, and that images captured by the cameras were later used to open a disciplinary file. It has been noted that the City Council had installed the posters in the city hall and the police station's accesses, and that they reported on the purpose of the facility's safety. In this regard, the denouncing person's behaviour, captured by video surveillance cameras and leading to the initiation of a disciplinary file, is considered to imply a breach of his or her surveillance functions, and consequently to affect the security of the building.

According to the terms in which the complaint is made, data protection regulations do not prevent the trade union delegate from accessing individualised information regarding the amount of the final destination supplement for senior officials involving high pay levels. As for the other official staff, it can only be made available in an aggregate way, without identifying the workers concerned with names and surnames.