Resolutions, opinions and reports search tool

The city council of Vic, as responsible for the offence provided for in Article 83.5a, is resolved to be admonished in relation to the principle of confidentiality, since the communication of the medical data of the complainant to the Commissariat of Mossos d'Esquadra de Vic has been credited as a result of a human error.

The whistleblower complained that during DPD's time in the entity, DPD had not allowed it to perform its functions independently. The complaint is filed on the basis of the principle of presumption of innocence as there is no evidence, not even indicative of the fact that the entity has prevented the DPD from carrying out its functions without interference.

It is archived to the extent that it has not been proven that the complainant has revealed or communicated to third parties data linked to the complainant and to professionals who would have visited it.

The resolution of the PDB is declared extemporaneous, which resolves the request of the claimant for refusal to delete data. It is dismissed in substance, since the judicial pronouncement of provisional oversecution, as the PDB maintains, does not prevent the police investigation from being kept open, when the corresponding limitation period has not been exceeded.

The claimant requested access to information about access to his or her clinical history (HC), and the claimed entity responded, lately, that they did not record undue access to his HC. The Authority estimated the claim of guardianship of the right of access, since the claimed entity did not respond to it within the time frame set to the applicable law, nor did it inform it about whether data communications existed in the shared clinical history of Catalonia, or about other data communications to other recipients, whether they were external recipients to the claimed entity, or other health centers that, while belonging to the claimed entity, have information systems other than that of the health center assigned to the claimant.

The claimant requested an entity, by exercising the right of access, to hand over a copy of the document that another public entity had sent him, accrediting in the workplace his status as a victim of gender violence, as well as the original document. The claim is partially estimated as the claimant entity extemporarily resolved the request for access to the copy of the requested document, and is dismissed as regards the request for the submission of the original document, since the right of access provided for in Article 15 of the RGPD does not include the delivery of the original document, but only access to those personal data and to the copying of those data, as well as the right to copy them.

The claimant asked a Foundation, by exercising the right to data portability, to submit an original document that had been sent to it by another public body, accrediting in the workplace his status as a victim of gender violence. The claim was dismissed, as: (1) the right to portability does not include the delivery of the original document, but of the data in a structured, common-use and mechanical readership format; (2) the person concerned had not been the person who submitted this data to the claimed entity; and (3) the right to portability does not apply to the treatment needed to fulfil a mission performed in the public interest or in the exercise of public powers conferred to the responsible.

Since it has been proven that the Department of Health has notified the liquidation of a fee of one third person to the party denouncing as a result of a human error, and given the liability regime is objective and therefore does not require the concurrence of guilt, the Department of Health is resolved to be responsible for the infringement provided for in Article 83.5 GDP in relation to Article 5.1f), relating to the principle of confidentiality.

Aside from the person's manifestations, no other element is available to corroborate that a third person accessed the data of the padron of the now complainant. It is admitted that, on the other hand, the City Council denies that this has happened. Nor can it be ruled out that, as the accused entity points out, it was a third person or a consultation of a public register, the source of the information. Consequently, the procedure should be shelved because it is not possible to prove that the City Council has allowed undue access to the data of the complainant's sponsor.

In the face of various attempts at notice on unsuccessful paper, a city council published in the BOE Notification Supplement several acts handed down in a disciplinary procedure to a municipal worker, committing three offences for which he was warned. Specifically:1) By violation of the principle of accuracy, by having made an attempt to notify an incorrect address;2) By violation of the principle of Application, by having published an ad in the BOE after having made a single prior notification attempt and an incorrect address; by having published another announcement in the BOE before running out the 10-day deadline granted to the person assigned to collect the documentation in the headquarters; and by having included in several announcements the name and surname of the person concerned, instead of his DNI.3) By violating the principle of minimization, by having included in several announcements in the BOE information on the disciplinary nature of the procedure, as well as other information.