Resolutions, opinions and reports search tool

The claimant complained that the municipal company that manages the service of crane, withdrawal and deposit of vehicles of the City Council had responded in an incomplete way to its request to exercise the right of access. The claim of guardianship is estimated, since the City Council (who was responsible for the treatment) had provided in an incomplete way the information provided in sections 1st and 2nd of article 15 of the RGPD.

Prenent en consideració les circumstàncies que concorren en el cas particular, i d’acord amb l’anàlisi que s’ha dut a terme, des del punt de vista de la finalitat general de transparència no estaria justificat l’accés a la informació relativa a l’antiguitat, titulació, formació i nivell de català de les persones ocupants de determinats llocs de treball, més enllà de la informació relativa a la concurrència dels requisits mínims exigits per ocupar els dits llocs de treball, com ara, que la persona ocupant disposa dels coneixements de llengua catalana o la formació mínima exigida per al lloc de treball concret que ocupa, d’acord amb la relació de llocs de treball de la Diputació.

The claimant, as holder of parental authority, exercised the right of access to the documentation presented by his underage daughter, which contained data from third parties affected who opposed the processing of data derived from the application for access, which is why the Department dismissed the request for access made by the claimant. The complaint is partially estimated as the Department responded to the request in an extemporaneous manner.

The complaint is partially appreciated, since the Directorate General of Police of the Department of the Interior did not respond in time to the request of the complainant, without it being appropriate to require any action, insofar as the DGP gave a reply adjusted to the right of request, albeit temporarily.

It resolves to punish a city council as responsible for 2 offences provided for in police regulations (LO 7/2021), which were caused by the transfer of the police station to new municipal premises: 1) it lacks the placement of video surveillance camera information posters; and 2) it lacks security measures, due to the fact that everyone has a panel of screens in which real-time images were reproduced through cameras installed in public spaces.

It resolves to sanction the City Council as responsible for three infringements: 1) lack of contract for the processor or equivalent document, 2) lack of information on the ends provided for in art.

The corporate email address of a city council, since it allows the identification of the account holder, is a personal data protected by data protection regulations. The processing of personal data resulting from the sending of email messages by a public worker, in particular the inclusion of third-party corporate mail addresses and the submission to an external recipient, may be legal if a legal basis (art. 6.1 GDPR) occurs and compliance with the principle of purpose (art. 5.1.b) GDPR is met. According to the system of liability provided for in the GDPR, the responsibility for infringements of data protection regulations rests with the controllers, without prejudice to the consequences of disciplinary proceedings.

For the information available, in the specific case examined, from the point of view of data protection regulations, there is no problem in giving the councillor access to the dossier of the stabilisation process for municipal workers, provided that it is information strictly necessary to achieve its functions. However, with regard to personal data of special protection (Article 9 of the GDPR) that may be included, it will be necessary to limit access, so that no more data is communicated than is strictly necessary to achieve the legitimate purpose that justifies access, that is, the development of the functions corresponding to councillors. In any case, once the councillor has access to municipal information on the basis of the functions legally mandated, this must be governed by the duty of reservation imposed by the regulations of local regulations, the principle of purpose limitation (Article 5.1.b) GDPR) and the duty of integrity and confidentiality (Article 5.1.f) GDPR.

The claimant asks for the rectification of the health data contained in a medical report, but does not provide any evidence to prove the error, the report's optional (and superior) report confirms that the report is correct, accurate and adequate, and the Authority considers that the information entered in the report is not lacking in any logic or meaning, nor inconsistent in view of the other information entered. Disappointment.

The complaint is partially estimated as the Health Department did not respond in time to the request submitted by the complaining party, which was aimed at access to traceability and HC3 for a specific period of time. However, it is not necessary to require the Department to carry out any action since the latter responded extemporaneously to the request and provided the party requesting all documentation held by it.