Resolutions, opinions and reports search tool

The claim is estimated because it is considered that the request contained in the submitted request would fit within the framework of an art access claim 15 of the RGPD, and was not given a formal response in these terms. The claimant had the right to receive an answer from the person responsible for the treatment in this regard, regardless of whether or not he had the status of person interested in an ongoing procedure, or whether emails are part of the administrative file under Article 70 LPAC, as every physical person has the right to access personal information about themselves.

The claim is estimated because it is considered that the request contained in the submitted request would fit within the framework of an art access claim 15 of the RGPD, and was not given a formal response in these terms. The claimant had the right to receive a response from the person responsible for the treatment, even to indicate that he did not have the information requested. All of this, however, may have been required to amend his request by accrediting that he was acting on behalf of his son.

The City Council did not have an information system to ensure the traceability of the actions it carried out in relation to the information contained in a digital folder. This meant that it was not possible to verify which users had accessed it, at what time, and what actions they had carried out.

The body responsible for managing the minimum living income can consult the data from the Municipal Register that is necessary for the processing of the benefit at the INE. In the event of a discrepancy with the details specified in the application for the benefit, this body may require the contribution of the certificate of historical and collective registration. If you do not provide this information, you can request this information from the City Council on the basis of the authorization conferred by article 28.2 of the LPAC, unless one of the affected persons objects. In any case, it is important to warn them of the consequences of this opposition.

The current regulations do not give sufficient authorization to the City Council to install a video surveillance system in an open space that is part of the public road in order to control and, where appropriate, exercise the sanctioning power with respect to uncivil conduct related to waste disposal in collection areas. If the video surveillance system is installed in closed and delimited waste collection areas that do not involve the capture of the public road, the city council may be authorized for this treatment, without prejudice to the fact that it must also comply with the rest of the principles and obligations provided for in the regulations on the protection of personal data in the terms provided for in the RGPD, the LOPDGDD and Instruction 1/2009. A system of video surveillance on public roads in order to control acts of vandalism against public security could be considered legitimate from the point of view of data protection regulations if carried out by the local police in accordance with the principles and guarantees of the specific regulations of police video surveillance

Vulnerabilities detected in the platform set up for the public to request a vaccination appointment, and which allowed access to data from third parties. Lack of risk analysis.

Although the communication of student data carried out by the institute may be based on one of the legal bases that legitimize the treatment, it is necessary to respect the other principles provided for in the RGPD, such as the principle of minimization. In application of the principle of minimization, the data of the students can only be communicated to the research group if the data is necessary to achieve the intended research purpose.

The data protection regulations do not prevent the access of the claimant to the claimed documentation, including their own personal data and the identity of the persons who may have intervened in the exercise of their functions in its processing, as well as the identity of the other complainants and of the witnesses who have intervened by providing information about the complainant, which are included in the documentation, unless there are specific circumstances regarding these third parties that justify their limitation. The contact details of the other complainants or of third parties who have provided information about the complainant (for example, the DNI number) or other data of these or third parties that may appear in the information must be deleted from the information. documentation claimed, which are excessive for the intended purpose.

The data protection regulations do not prevent the person claiming the information they request from communicating information regarding the traceability of access to their medical history, in particular from knowing the identity of the people who have consulted their medical history during the requested two-year period.

Given the regulatory provisions (art. 6.1.a), art. 9.2.a) RGPD, in connection with Additional Provision 17a of the LOPDGDD) the explicit consent of the data subjects could enable the processing of data. The study may also be carried out with pseudonymous data, in accordance with subparagraph (d) of the said Additional Provision 17a. In any case, the principles and guarantees established in the data protection regulations, the aforementioned additional provision 17 and, where applicable, the Biomedical Research Act must be complied with. The communication of anonymous and aggregated information on the results of the operation carried out by the Foundation to the business fabric of the region would not be contrary to data protection regulations.