Resolutions, opinions and reports search tool

The regulations on the protection of personal data would enable, for the purpose of tax management, the communication of data with tax significance to the Tax Administration through a procedure to request the information, in each specific case, when it refers to a specific person or set of people, such as creating a specific mailbox to address requests. On the other hand, in the absence of a general provision establishing this, the regulations would not enable the periodic supply of information. In cases where the protection regulations enable the communication of data, it is not necessary to inform the people affected by the communication to the Tax Administration, in accordance with what is set out. With regard to communication with the aim of improving annual market forecasts and studies, and to complement the information system on the market, it will be necessary to be aware of the provisions of the additional provision of the Tax Code of Catalonia.

The local police officer with TIP (...) sent documentation to the Human Resources Department of the City Council, among which was a letter referring to the health and reasons for the medical leave (depression or anxiety) of the person denouncing. The agent stated on the written finger that he had access to confidential information because he was administratively responsible for receiving the casualties, and because the complainant mistakenly sent the personal part of the medical document and not the corresponding one to the company. Vulneration of the confidentiality principle art. 5.1.f) GDPR (very serious infringement in Article 72.1.i) of the LOPDGDD).

Infringement of the principle of application is required due to lack of legal basis in Article 6.1 GDPR. The Institute sent a statement with an attached document, to all parents, informing students of the optional subjects they will take, identified with the DNI number, and in order to purchase the school material. The DNI number is personal data, despite being treated in isolation.

The complainant complained about the fact that certain GU agents asked him to identify, without this action - according to the complainant - being enabled by any rule. However, the police report provided by the City Council, signed by three agents, describes the events that occurred and justifies identification for the prevention of a major conflict on the road. In this respect, it should be concluded that the processing was necessary for the exercise of public powers conferred on the controller (art. 6.1 e) GDPR) in accordance with the Organic Law for the Protection of Citizen Safety, and therefore the file of the complaint proceeds. The complainant also complained that the Lleida City Council has a register of social activists. However, in the absence of sufficient indications, and given that the accused entity has denied these facts, his file is proceeded.

The open publication of an Act of the plenary, with more data than necessary and its publication for longer than is required, constitutes a violation of the principle of minimisation and the principle of limiting the period of conservation.

Sending an email that included health data for minors.

The Public Health Agency of Catalonia communicated to the Labour Risk Prevention Services of the Catalan company in which it provides services denouncing the list of staff who did not have the complete pattern of vaccination against COVID-19. This communication was carried out within the framework of a vaccination campaign by the Health Department. In this respect, the communication in question does not contravene data protection regulations, insofar as both occupational risk prevention regulations and public health regulations empower health authorities to establish mechanisms for collaboration with the occupational risk prevention services of private companies.

The councilor has the right to access the Local Police holiday calendars for the years 2021 and 2022, albeit with pseudonymisation of the personal data, given that providing the information in this way would a priori be sufficient to achieve the intended purpose of control.

The councilor has the right to access the Local Police holiday calendars for the years 2021 and 2022, albeit with pseudonymisation of the personal data, given that providing the information in this way would a priori be sufficient to achieve the intended purpose of control.

The installation of a video surveillance system inside the classrooms of municipal kindergartens could be proportionate in the face of reasonable indications of the possible commission of a serious illegal act by a person working any of the children, exceptionally and for a limited time, and provided that information is provided in accordance with article 89 of the LOPDGDD. The person in charge, however, would not have sufficient legitimacy to install this system so that parents and/or legal guardians can view live images of the activities carried out by their children.