There is a 40% increase in complaints and claims for breaches of data protection in Catalonia

The Catalan Data Protection Authority (APDCAT) received 843 complaints and complaints in 2023, which represents an increase of almost 37% compared to the previous year. This increase is attributed to the fact that citizens are more aware of aspects related to the protection of their data and, also, because they are better aware of their rights in this matter.

Specifically, the matters investigated and investigated by the APDCAT during 2023 were 443 (293 complaints for non-compliance with the rule and 150 claims for violation of rights), a figure 40% higher than in 2022.

With regard to sanctioning procedures, the APDCAT has initiated a total of 293 preliminary investigation actions in 2023. Of these, 87 have ended with a resolution, including reprimands, financial sanctions and suspensions.

Of all the sanctioning procedures resolved in 2023 that declare the commission of an infringement, the majority refer to the field of health (15), provision of services to citizens (12), human resources (11) and relating to the exercise of administrative powers (11).

In cases where an infringement has been found, in addition to the penalty of warning or declaration of infringement, measures have been required to correct the effects of the infringement and follow-up has been carried out to verify that have executed correctly.

More than 2,000 queries answered

Throughout the year 2023, the public assistance service has attended to 2,115 inquiries related to data protection and privacy, almost 300 more than the previous year. The majority, from the general public (81%), followed by responsible entities that process personal data from public files (7%), responsible for private files (10%) and consultants (2%). Regarding the subject, the most numerous have been those related to the implementation of the obligations established by the General Data Protection Regulation (RGPD) and the organic law (LOPDGDD) for those rcontrollers, as well as the relative to the access or transfer of information containing personal data.

With regard to the consultancy aimed at entities within the scope of the APDCAT that want to adapt their actions to the data protection regulations, 182 inquiries have been attended to, mainly referring to the obligations that the data protection regulations imposes on the controllers. Therefore, queries on video surveillance, the designation and communication of the data protection officer, the preparation and management of the record of processing activities that must be kept by those controllers, the review of informative clauses and the duty of information, the legality of the processing (legal bases, such as consent) and the treatment and publication of images, among others. Inquiries about waste collection services, the door-to-door service and the use of the rubbish bin have also been attended to.