Resolutions, opinions and reports search tool

It is resolved to declare that the Department of Health has committed the infringement provided for in Article 83.5a), in relation to Article 5 RGPD, which contemplates the principle of accuracy of personal data, since the platform "My Health" of the complainant contains inaccurate information about health professionals who would have attended it in different medical consultations. The discord is also manifested between the information contained on the one hand in the HC of the health center and the HC3; and on the other hand, in the information that appears in the LMS viewer.

On the basis of the information that the city council has provided for consultation, data protection regulations would not prevent access to the number of disciplinary files initiated in 2022. However, in the event that the applicant is interested in accessing other information that exceeds the number of disciplinary proceedings initiated, the City Council must analyse the possibility of access according to the categories of personal data concerned, taking into consideration the grounds that have been set out.

The person making the claim asked the DGP for access to his personal data contained in the files of the information systems of the Generalitat Police (SIP PF and SIP PFMEN). The claim presented by the person making the claim is appreciated, given that the DGP did not respond to his request in time and no action is required from the DGP, given that he responded in accordance with the law to the request of the claimant person

The claimant asked for the deletion of the data that appeared in the file of the scope of the information systems of the PGD (SIP PF) in relation to police proceedings that led to a short procedure processed by a criminal court. The claim is estimated, since it was based on the lack of response to the request for deletion, but the PGD is required to respond to the request for deletion made by the claimant, even if it is in the negative sense of its request.

The claimant requested the deletion of their data from the City Council's electronic headquarters, since it had already far exceeded the purpose for which they were initially authorized, collected and processed, and for this purpose requested the withdrawal of their data from any physical or digital support for which the entity was responsible. The claim of tutelage formulated by the claimant against the City Council is estimated, without making any other pronouncement or any requirement regarding the fund since the right of the claimant has been made effective.

It is resolved to declare that the City Council of Sant Andreu de Llavaneres has violated Article 83.4, in relation to Article 35; both of the RGPD, since it has not carried out the necessary impact assessment to assess the risks associated with the processing of personal data carried out within the framework of the provision of the waste collection service "port to door".

It resolves to warn the City Council of La Garriga since it has not carried out the necessary impact assessment in relation to the processing of personal data carried out within the framework of the provision of the waste collection service "door-to-door"; it does not have the RAT updated; and it did not provide the right of information to users of the aforementioned service in accordance with article 11 LOPDGDD.

The right of access is estimated because the City Council responded extemporaneously and incompletely. In any case, in relation to the access to the data that would allow the identification of the persons who gave their testimony in a case of risk prevention open against the claimant, it is proposed that before giving access to this information, the City Council can transfer the request of the right of access to the affected persons so that, where appropriate, they can exercise their right of opposition to the processing of their personal data.

The claim is rejected since, in this case, the main requirement is lacking in order to be able to require the data controller to carry out the deletion of personal data, since the person who requested this deletion did not appear as the owner of the personal data to be deleted. In this sense, B:SM has accredited that it has been at all times proactive, because it required the applicant to prove his identity, and has given a response adjusted to the circumstances of the case.

Un club deportivo de fútbol de nueva creación contactó con la Federación Catalana de Fútbol dado que cuando intentaba vincular dieciséis jugadores a su club, la Intranet federativa le mostraba un mensaje mediante el cual se lo informaba que los mencionados jugadores estaban vinculados a otro club deportivo. Al respeto, la persona denunciando se quejaba por el hecho que, desde la FCF se había enviado al mencionado club de nueva creación unas impresiones de pantalla que contenían los datos personales de los 16 jugadores que, en aquel momento, estaban vinculados a otro club. Pues bien, por su parte, la entidad denunciada ha reconocido haber enviado las impresiones de pantalla - con información personal de los jugadores (nombre, apellidos y DNI) - al club de nueva creación, a los efectos de mostrarle los pasos que tenía que seguir para poder inscribir a los jugadores, y ha argumentado que este hecho no constituye una comunicación ilícita de datos personales dado que el receptor de la información, ya era conocedor de estas información. Al respeto, añadía que, la Intranet muestra el mencionado mensaje después de que el club haya introducido los datos personales de los jugadores. En estos términos, procede el archivo de los hechos denunciados dado que, cuando la FCF envió los datos personales de los jugadores al Club que los intentaba inscribir, este ya disponía de la información.