Resolutions, opinions and reports search tool

It is decided to archive the present complaint since the access to the clinical history of the complainant was made from a Primary Care Center, by a professional who had assigned administrative and statistical management tasks, within the framework of the National Statistical Plan (2021-2024). In this respect, it should be concluded that the aforementioned access is covered by Article 6.1e) GDPR on the exercise of public powers, in accordance with Law 12/1989 of 9 May, on the Public Statistical Function.

It is decided to sanction FMB S.A. because the lack of implementation of appropriate technical and organisational measures has prevented it from locating the personal file of the person who provided services to the complained company. This fact violates Article 32.1 of the GDPR, which provides for the controller's obligation to guarantee the availability and security of personal data.

The entity had not notified the Catalan Data Protection Authority the designation of a data protection officer who, according to Article 37.1 of the GDPR, is a mandatory designation for the entity. This obligation provided for in the GDPR was fully applicable and enforceable to the entity, since May 2018.

The person complained that he had unduly accessed his clinical history. The ICS recognises this and states that it has taken steps to prevent any further undue access. A final resolution is issued, implying a violation of the principle of confidentiality.

A final resolution is issued, in violation of the principle of accuracy. The IMA notified a provision for mandatory execution in a domicile that had been in its own database since 2007, bypassing the domicile provided by the administration that imposed the sanction, transit, and which is in the DGT database. In addition, it uses a third address, which appears on a payment letter attached to the provision, which has also been in its own database (since 1997), for another vehicle. The facts charged constitute a violation of the principle of accuracy, for having circumvented the implementing regulation in relation to notifications of traffic fines, Article 90 Traffic Law.

The claimant requested the right of access to his data (copy of medical documentation and medical record). The Department replied to him within a deadline, although there is no record of him providing the requested information. Following the reiteration of his request on two more occasions, the Department tried to submit all the requested documentation, but the complainant refused to receive it. The complaint is dismissed on the grounds that the Department would have fulfilled its obligation, even if the person refused to receive the requested documentation.

The resolution of the DGP is declared untimely, given that the right to erasure was resolved and notified beyond the 1 month deadline established for the purpose, without going into other considerations with regard to the substance, since the DGP has decided to delete the data of the complainant.

The claimant cannot access the name of the natural persons holding a tourist dwelling activity license associated with the registration number in the Tourism Register of Catalonia, but could be presented with anonymized information with a territorial aggregation level guaranteeing the non-identification of the persons concerned.

Taking into account the terms in which the complaint is made and the elements that collide, data protection regulations do not prevent the claimant from accessing information regarding the entities in which the student has carried out university practices.

From the point of view of data protection regulations, there must be no impediment in providing the person by claiming information regarding the amounts received by each of the city councillors and mayor from June 2019 until October 2022 broken down by years and by concepts.