Complaints and claims for improper processing of personal data decrease after the COVID-19 pandemic

The Catalan Data Protection Authority received a total of 617 complaints and claims in 2022, a figure slightly lower than in 2021, when the COVID-19 pandemic and the increase in the use of the internet and new technologies in the workplace and health significantly increased the number of complaints and claims received (685). However, excluding this anomalous year, the upward trend continues compared to previous years, so that in 2022 the APDCAT has received 29% more complaints and complaints than in 2020, and 49% more than in 2019.

Regarding the matters within its competence, the APDCAT has investigated and instructed in 2022 a total of 316 requests related to violations of the regulations regarding the processing of personal data, which corresponds to 193 complaints and 123 claims for protection of rights. This represents a decrease compared to 2021, in which 423 cases were investigated, but is much higher than figures from the years preceding the pandemic (33.8% compared to 2020).

77 sanctioning resolutions

As for the investigation and sanction, in 2022 54% more disciplinary proceedings have been initiated, which have gone from 61 in 2021 to 94 in 2022.

Although in 2022 the entries of cases within the competence of the APDCAT have been lower than in 2021, the number of decisions issued in 2022 as a result of the procedures processed by the Inspection Area has been considerably higher than in previous years, with an increase of 14.6% compared to 2021 (360 issued in 2022, by 314 in the year 2021).

Specifically, in 2022, 124 resolutions have been issued to archive prior information (99 in 2021), 77 resolutions of sanctioning procedures (94 in 2021), 144 resolutions for the protection of rights (130 in 2021) and 15 resolutions that put an end to incidents of execution of protection of rights (1 in 2021 ). Of all the sanctioning procedures resolved in 2022 with a declaration of infringement (warning or financial sanction), most refer to the field of health (12) and education in all its cycles (10). It is also worth mentioning those linked to the exercise of administrative powers (9), the provision of services to citizens (9), internet / social networks (8), human resources (8) and social services (7).

The largest number of infringements found relates, as in previous years, to infringement of the principle of confidentiality (28), followed by infringement of the principle of lawfulness (13). Also noteworthy are infringements related to information security (12), as well as those related to the violation of the principle of minimisation (9) and the infringement of the right to information and the principle of transparency (7).