Resolutions, opinions and reports search tool

The complaint complains that he has received calls from the company Tebex on behalf of the City Council, who does not know who he is and has not consented to the transfer of his personal data. The City Council informs him that Tebex is the adjudicator of providing the labor absentee control service. It is accredited at IP stage by providing a service provision contract and annex regulating data protection clauses. Furthermore, in response to a second requirement, it provides for an employment agreement which includes as Annex 1, a circular providing for the possibility of controlling absenteeism.

Consent is not the legal basis that legitimises the processing of data for the provision of the waste collection service. This treatment is based on carrying out a mission in the public interest or exercising public powers. On the other hand, the fact that the reading of the labels incorporated into the bags or buckets allows the identification of the user of the service, since it is not credited, is archived.

In accordance with the duty of judicial assistance provided for in the articles transcribed in the previous paragraph, it should be stated that the notification carried out by the local police officer did not contravene the data protection rules, since it was carried out in compliance with a legal obligation. In that respect, it should be pointed out that there is also no indication that unauthorised personnel would have accessed the documentation.

The City Council is admonished as responsible for a very serious infringement by having dealt with personal data of its Local Police agents obtained through the installation of geolocation receivers (GPS) in various police vehicles, without having previously informed them of the ends provided for in Article 13 of the GPD, including the purpose of treatment (Art. 13.1.c GDPR). In particular, with regard to this latest information (Art. 13.1.c GDPR), on the possibility of dealing with data obtained for the exercise of worker control functions (disciplinary procedure). In the initiation agreement the part of the complaint was archived regarding the use of recordings through video surveillance cameras by work control, without having previously reported them, since it is not known that through this system the City Council has treated personal data from the agent denouncing for this purpose.

The person making the claim cannot access the personal information of the members of the Local Police, regarding the training tests to be able to carry firearms that have been practiced during the period of time to which the claim refers. It would be necessary to provide aggregated information regarding the pass or fail results obtained for each period, as it seems that the City Council has already done. The data protection regulations would not prevent access to the first and last names and position or category of the people who have certified the various training tests.

The report is archived in relation to the form used by the school to inform families of what computer applications will be used in the case of those confined students who have to follow classes telematically, because it is considered to be in accordance with data protection regulations.

People serving in an old people's home had to point out, in a listing located in the entrance sampler, among others, their name, surnames, phone, DNI and body temperature; so each of these people could know the data from the rest were listed, which violates the principle of confidentiality.It is also briefly analysed that the fact that the residence collected the body temperature of the working people was a performance under data protection regulations.

Forms provided by the entity in which personal data was collected did not contain all the extremes provided by Article 13 GDPR. Within the procedure, other facts that had been the subject of complaint were also filed, the most relevant: a) that the foundation did not implement security measures in data processing in unautomated formats. It is archived because there is no evidence to prove this, even uncritically. Presumance of innocence.b) Communication of data by the Foundation to other companies. As for some of the companies, it was archived for lack of proof, presumption of innocence. As far as the second company is concerned, there is no communication insofar as there is a contract for treatment between the Foundation and the aforementioned entity.