Resolutions, opinions and reports search tool

Revelation of health data to the complainant's father, the age of the person at the time of the event.

It is appropriate to file the complaint insofar as the access to HC3, made during the year 2020, was justified because it was for welfare and epidemiological surveillance reasons. As regards the alleged undue access to HC3, carried out during the year 2019, it is appropriate to file the actions due to prescription.

It is decided to sanction Badalona Health Services for the infringement of the principle of confidentiality, since the complained entity has confirmed that a worker from Badalona Municipal Hospital, managed by Badalona Health Services S.A, would have unduly accessed a third person's clinical history. The proposed sanction is EUR 2 000.

The complainant explained that the Lleida City Council would have provided a third person (the new acquirer of a license) with the document relating to the "Joint declaration of change of ownership of activities", which would contain the personal data (name, surnames, address and number of DNI) of the complainant. However, since it has not been possible during the previous information phase to prove that the communication of personal data is attributable to the Lleida City Council, as the complainant stated, it is appropriate to archive the present complaint.

La persona reclamante se quejaba que el centro médico no había atendido su pretensión de añadir a las anotaciones efectuadas a su HC por la psicóloga que lo había tratado, determinados párrafos redactados por ella misma. La persona interesada tendrá derecho a que se completen sus datos, siempre y cuando esta adición se adecue a las finalidades del tratamiento. En este caso, se desestima la reclamación en la medida que no hay ningún elemento que permita cuestionar el criterio médico-profesional de no completar la historia clínica de la persona reclamante en los términos solicitados por esta.

The complainant complained that the City Council had provided a neighbour of its building with a document containing his personal data. He also denounces the neighbor's lawyer for having exhibited this document in an oral hearing of a trial. As regards this second fact, the AEPD was transferred. As regards the reported fact against the City Council, RA is prepared on the basis of Article 48 and 52 LJCA, on the obligation to transfer a copy of the administrative file to the court by the requested administration. Since his neighbor had filed a judicial appeal, he had access to the file to formulate suit. This access is also provided for in Article 236 LOPJ quinquies.

The complainant complained that the City Council had revealed her data to a third party (a person who ran a bar and had called her to warn her that she would take a party). He does not provide any evidence or evidence to prove that his mobile phone was indeed revealed. RA is dictated by the lack of evidence to prove the communication of the complainant's mobile phone to the third person. In addition, both the City Council and the person who called her deny that it was the City Council that had provided the data.

There is no indication that the denounced City Council is the holder of the e-mail account from which a message was sent to certain local agents, criticising trade union behaviour. In this respect, it is also inappropriate to argue that the City Council has filtered information regarding corporate electronic addresses of members of the Police Corps, since, apart from the city council workers who may obviously have access to such corporate addresses, it cannot be ruled out that third parties have obtained this information by their own means (e.g., persons who have provided services to the City Council, or citizens who have related to these public employees).

Data protection regulations do not prevent the claimant from accessing information relating to legal entities or reports that do not contain personal information. Nor does it prevent access to the merely identifying information of the compliance officer and the external lawyers who wrote the reports. However, with respect to the information relating to the persons allegedly responsible, the reporting person and, where appropriate, witnesses, must be provided anonymously. And to the extent that effective anonymization is not possible, access must be facilitated through a summary of the actions taken, so that the physical persons affected are not identifiable.

It is decided to file the present complaint, given that the accused City Council and, in particular, the Chief Inspector of the Local Police, included references to the data on the person's health reporting - who holds the status of local agent - since these were necessary to resolve the desirability of initiating a disciplinary file against him, for alleged withdrawal from service on health grounds. Thus, this Authority concludes that the processing of controversial personal data was covered by Article 6.1e) - processing carried out in the exercise of public powers - and that the circumstances provided for in Article 9.2 (f) and g) GDPR, which lift the prohibition on processing health data in Article 9.1 (GDPR).