Resolutions, opinions and reports search tool

The claim was partially considered when it was noted, with regard to the traceability application, that there was no need to report on the identity of the natural persons who accessed the HC; and with regard to the copy of the HC, that although the ICS had submitted copy of the clinical course, it was missing to submit a medical report, as well as to inform the complainant that they did not have the other medical documentation cited in the submitted documentation.

A private center communicated the result of an antigen test to the Health Department and this one, provided the said information to the educational center where the complainant provided his services. In this regard, Article 23 of Law 2/2021 of 29 March, on urgent measures for prevention, containment and coordination to deal with the health crisis caused by Covid-19 obliges establishments that carry out COVID-19 diagnostic tests to submit, on a daily basis, the results of the tests they carry out to the health authority and, in turn, Article 8.4 of Decree Law 41/2020, on extraordinary measures in the field of education to deal with the consequences of Covid-19, determines that the Health Department must communicate to the directors of educational centres, the health data corresponding to the results of the diagnostic tests. This being the case, it is appropriate to file the facts indicted since the communications concerned were carried out under Article 6.1 of the GDPR, in compliance with a legal obligation (in the case of the private laboratory), and in the exercise of public powers (in the case of the Ministry of Health). It should also be noted that, despite the notification of health data, the exceptions provided for in Article 9(2) and (i) of the GDPR would apply, which would allow the lifting of the ban on Article 9(1) of the GDPR.

On the basis that the proposed assumption would not refer, by means of the information available, to senior management positions, trust, free designation, special responsibility or involving high levels of pay, from the point of view of the general purpose of transparency, and taking into account the principle of minimisation (Art. 5.1.c) GDPR), it does not seem justified to give access to the identity of the workers concerned.

A final resolution is issued on the basis of a request in relation to Article 9.2, in the same terms as the resolution resolving the previous appeal for repossement. The City Council has processed the health data of a career official without complying with Article 9.2 of the GDPR (which provides for a rule with the status of law or has a working agreement that complies with all the guarantees of the data subject). The city council provides a labor agreement but this one has no regulatory value and erga omnes effects since it has not been published.

The resolution of the DGP is declared untimely, given that the right to erasure was resolved and notified beyond the 1 month deadline established for the purpose, without going into other considerations with regard to the substance, since the DGP has decided to delete the data of the complainant.

The decision is to sanction the Foundation denounced for the use of a system of video surveillance cameras in certain rooms in the residence. In this respect, this imputed fact is considered to be a violation of the principle of minimisation insofar as such treatment is excessive for the intended purpose, and since there were other measures less intrusive to the privacy and privacy of the persons concerned.

The City Council of Argentona reported that a councillor of the All per Argentona Municipal Group would have accessed the personal data contained in the pre-enrolment and enrolment files of the municipal nursery schools for the 2021-2022 year, would have collected the contact details of the families who would not have obtained a place for their children, and would have contacted them via Whatsapp with the aim of asking them for personal data and summoning them to a meeting and then submitting an application to the City Council. For its part, the Municipal Group refused to contact the families on the basis of the consultation of the file, and stated that contacts were initiated earlier and based on personal acquaintances and relationships. In this respect, since the Authority does not have evidence that the denounced municipal group collected the personal data of the controversial file and used it to contact different families, it is necessary to archive the facts that are involved here.

The entity must answer clearly and precisely whether the personal data of the complainant has been transferred to third parties or not, and if so, identify the recipients of the personal data. The entity must inform the complainant of the specific reasons why it is decided not to follow up one of the requests made by the complainant.

Notification of a resource to third parties without deleting the data of the recurring person.