AEPD (Spain) - PS/00245/2019

AEPD - PS/00245/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(a) GDPR Article 9(1) GDPR Article 13 GDPR Article 83(5)(a) GDPR Article 83(5)(b) GDPR Article 77 LOPDDGG
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	29.10.2020
Published:
Fine:	None
Parties:	Departamento de Educación del Gobierno de Navarra
National Case Number/Name:	PS/00245/2019
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	AEDP (in ES)
Initial Contributor:	Francesc Julve Falcó

The Spanish DPA (AEPD) has imposed three different warning sanctions on the Department of Education of the Government of Navarra for infringing Articles 5(1)(a), 9(1), and 13 GDPR on the processing of data from surveys answered by schoolchildren.

English Summary

Facts

On 25 February 2019, an individual filed a complaint with the AEDP against the Department of Education of the Government of Navarra regarding a survey conducted by his son in class, asking him about intimate, family, and personal issues.

The respondent stated that the purpose of the surveys was to guide and inform schools and families about the level of education acquired by the schoolchildren. Together with these surveys, context questionnaires were provided to obtain information on the socio-economic and cultural conditions of the schools in order to contextualize the results obtained.

The respondent also explained in detail the respective organic laws that justified the collection of these personal data of the students, in order to know better the conditions of the students. At the same time, it also described the security and confidentiality measures that were being followed to protect this information.

The Department of Education of the Government of Navarra replied to the decision to initiate the procedure, agreeing with the allegations of infringement of Articles 5(1)(a) GDPR and 13 GDPR. On the other hand, they disagreed with the infringement of Article 5(1)(a) GDPR in relation to Article 9(1) GDPR with regard to the question of the gender identity of pupils.

Dispute

Should government surveys of underage students do comply with the principles of transparency, lawfulness, and fairness, respecting Articles 5 (1) (a), 9 (1), and 13 GDPR?

Holding

The Spanish DPA confirmed that the defendant collected specific personal data that was not necessary for the purpose in question. Therefore, if they could have achieved the same purpose without processing those data, there is no legal basis for processing them.

Consequently, the infringement of Article 5(1)(a) GDPR in relation to Article 9(1) GDPR is established. Article 13 GDPR is also considered to have been infringed as regards the information to be provided when personal data are obtained from the data subject.

The Spanish legal system has chosen not to penalize public bodies with a fine, as indicated in Article 77(1)(c) LOPDDGG, and paragraphs 2, 4, 5, and 6 of the same article.

In view of the above, the Director of the Spanish Data Protection Agency decided to impose three different warning sanctions: one for infringement of Article 5(1)(a) GDPR, another for infringement of the same Article 5(1)(a) GDPR in relation to Article 9(1) GDPR, and a third warning sanction for infringement of Article 13 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

Page 1
1/36
 Procedure Nº: PS / 00245/2019
938-300320
RESOLUTION OF SANCTIONING PROCEDURE
Of the procedure instructed by the Spanish Agency for Data Protection and in
based on the following
BACKGROUND
FIRST: AAA (hereinafter, the claimant) on 02/25/2019, filed a claim
before the Spanish Agency for Data Protection against the DEPARTMENT OF
EDUCATION OF THE GOVERNMENT OF NAVARRA (GENERAL DIRECTORATE OF EDUCATION)
(hereinafter, the claimed).
The claimant states that his son is studying in a school arranged for the 4th year of
primary school ( 4EP hereinafter) and has conducted a nominative survey where, among other
questions, he asks about “his gender (boy / girl / other options), the language he uses
outside of school, their feelings towards school, their relationships with their peers, or the
profession of their parents, making special reference to the military career, issues that
understands they fall within the field of privacy of the student and of their family life. "
“To fill out the survey, students must access the web platform of the
department
from
Education
of the government
from
Navarre
(https://www.educacion.navarra.es/web/dpto/evaluacion-y-calidad/evaluacion/evaluacion-ex-
terna / evaluation-of-navarra / education-infant-and-primary-course-2018-2019) ”.
SECOND: In view of the facts stated, the claim was transferred on 04/01/2019
to the claimed so that it will inform of the causes that have motivated the incidence, measures
adopted to prevent similar incidents from occurring, and a copy of the communications
tions of the adopted decision that has been sent to the claimant regarding the transfer of this
claim.
THIRD: The respondent states:
1) “ Since the implementation of Organic Law 2/2006, of 05/03, on Education (LOE), all
The educational administrations must carry out, during the Primary Education stage,
general diagnostic assessments of the basic competencies achieved by their
students ( ED hereinafter). Said legislation establishes the application of these evaluations with
census character [articles 21 which indicated until its modification by LO 2/2013 “At the end
start the second cycle of primary education ”-fourth grade- and 144 of the LOE]. These
evaluations are formative and guiding for the centers, and informative for the
families and for the educational community as a whole. "
" In the Autonomous Community of Navarra, from the 2009/2010 school year to the
school 2013/2014 has been doing this census ED of 4EP.
With the entry into force of Organic Law 8/2013, DE 9/12, to improve the quality of
educational institution (LOMCE), said individualized census evaluation was maintained, but
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 2
2/36
giving its application to 3rd and 6th of Primary Education. [See articles 20, 21 and 144 of the
LOMCE].
In the Autonomous Community of Navarra, a Census Diagnostic Evaluation was carried out in
3rd Primary Education during the 2014/2015 school year and 6th Primary Education during
during the 2015/2016 school year. During these two school years the evaluation was not carried out.
Diagnostic procedure in 4EP . "
Royal Decree-Law 5/2016, DE 9/12, on urgent measures for the expansion of the
calendar of implementation of the LOMCE in its article 3, suppressed the census nature of the
evaluation in Primary Education, transforming it into a sample evaluation
where the selection of students and centers must be sufficient to obtain representative data
tives at the level of each Educational Administration. So since the school year
2016/2017 to date, evaluations are carried out in the Autonomous Community of Navarra
sample diagnoses in 3rd and 6th grade of Primary Education. In order not to lose the individual character
dualized diagnostic evaluations, and by virtue of article 144.2 of the LOMCE, which
contemplates that "educational administrations may establish other evaluations with
diagnostic purposes ”, in Navarra the history of census diagnostic evaluations was retaken.
4th grade of Primary Education since the 2016/2017 academic year.
2)
Together with the ED , context questionnaires are practiced “simultaneously” (CC in
hereinafter) prepared under criteria determined by the Ministry of Education, Culture and
Sports, which allow obtaining information on socioeconomic and cultural conditions
rales of the centers for the contextualization of the results obtained. [See, by way of
For example, article 7.5. of ROYAL DECREE 1058/2015, OF 11/20, which regulates
the general characteristics of the final assessment tests in primary education are
established in the LOE]:
'' Simultaneously with the conclusion of the final stage evaluation,
context questionnaires, which will be prepared by the Ministry of Education, Culture and Sport.
These questionnaires will allow obtaining information on the socioeconomic conditions and
cultural centers for the contextualization of the results obtained. '
"Article 8 on results, indicates:
"1. The result of the final stage evaluation will be expressed in the following levels to
each of the competencies: Insufficient (IN), Sufficient (SU), Good (BI), Notable (NT) and
Outstanding (SB).
The competent educational administrations will state the level obtained by each
student in an individual report, which will be delivered to the parents or
legal guardians and transferred to the centers in which the students have to continue their
scholarship. The report will have an informative and guiding nature for the centers in which
have completed the sixth year of Primary Education and for those centers in which they
to attend the following school year, as well as for the teaching teams, parents, mothers
or legal guardians and the students . "
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 3
3/36
3) In the Autonomous Community of Navarra, during the seven school years included
between 2009/2010 and 2015/2016 (both inclusive), the CCs associated with the EDs to which
answers the students were carried out anonymously, allowing only to carry out
statistics and studies of factors of influence on the results of the attained performance
do, at the school level. As of the 2016/2017 school year, it was agreed upon prior authorization
tion of the General Directorate of Education, its completion online (with identification and
user). It states that once the questionnaire has been answered, no other user or teacher,
Neither student nor principal can know the identification data of each student. (except
two members of the technical unit that manages the evaluation procedure). " This
change represents an advantage and an improvement in reference to the statistical analysis carried out after
with the information obtained, since it allows linking the result of each study
given their socioeconomic and cultural conditions, which allows obtaining information
more detailed information at the level of students or groups of students within the same
center . "
This fact favors the detection of needs or strengths for the improvement of the system.
educational subject, since more individualized information can be obtained.
“ During the current 2018/2019 school year, in the Navarra Community, the
carrying out, among others, the census ED of 4EP in all public and concerted centers
two that have enrollment at that educational level. The online application phase of the CC
for students was carried out during the month of February 2019 and the competitive tests
tentials in all schools in the community during the week from 6 to
05/10/2019. The online questionnaire for the current school year can be accessed at the link
http://dpto.educacion.navarra.es/eed/ (you have to access the application with the name of
Irati test user and Irati test password).
The design, organization and implementation of the DEs provided for in the LOE is one of the
the functions associated with the Service of Evaluation, Quality, Training, Equality and Convi-
vence, within said Service, the technical unit in charge of managing them is the Section
Evaluation and Quality. [See FORAL DECREE 5/2017, of 01/11, which establishes
the organic structure of the department of education ]. "
" Access to the online application that allows the survey to be carried out, through a
user identification number and an associated password, and the data that is recorded
they do not contain any nominative references in the survey . "
“ The addresses of the schools know the users and passwords associated with
cited to the name of each student and share them with the faculty responsible for the
supervision of the application of the survey in the center (generally tutor teachers).
These data are not public and are only accessible to the director of each center.
school, prior identification with personal credentials in the management program es-
strain EDUCA. This information is also known by the technician of the Department of
Education that manages the assignment of users and passwords.
“ For the surveyed users, the online application only allows access to the
costs only once, so responses are recorded and the center cannot access
der to them. So the school does not know or have access to the recorded responses
by your students. Neither does the technician from the Department of Education who has managed
user and password mapping knows those answers .
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 4
4/36
“ The computer technician who designs and manages the data collection through the
costs, does not know the nominal identification data of the respondents, only knows the
users and passwords . "
" The Department of Education guarantees the confidentiality of the data provided
for each student in the online questionnaire. In this sense, only two technicians from the university
responsible for analyzing the recorded data know the assignment of the identifiable
numerical res (users) and responses. This connection is necessary to be able to link
the individual results obtained in the performance tests of the different components
petencies and associated context factors (collected through the questionnaire).
In addition, the databases are kept on the network drives of the De-
Department of Education, and therefore are only accessible from within the Department itself.
It is also necessary to access the computer equipment by user and
password that must be changed every 30 days . "
" For all that was stated in the previous point, it should be noted that although the survey did not
is anonymous, the personal data of it are pseudonymised, that is, they cannot
be attributed to a data subject without using additional information. Take into consideration that
Such additional information is provided separately and is subject to technical and organizational measures.
tives aimed at ensuring that personal data is not attributed to a natural person
identified or identifiable. In fact, the RGPD, explicitly introduces in its article 32,
regarding security in the processing of personal data, pseudonymisation as
an appropriate measure to guarantee a level of security appropriate to the risk . "
4) The questions in the questionnaire are not intended to attack convictions or privacy
of the respondent, the objective being to collect the minimum necessary information that allows, after
its subsequent analysis, contextualize the global results of the DE, providing information
information, not only on performance in the different competencies evaluated, but also
on the socio-economic and cultural conditions of the educational system. In this sense,
The usefulness of the survey is enormous, both for the schools themselves and for the
Education deparment.
5) The CC is mandatory for each 4EP student, although they can be left
unanswered questions, it can even be sent with all your unanswered questions, “ without
consequences for the student . "
“ The necessary collaboration of students and families responding to the survey,
contributes to the detection of needs and the design of improvement plans in the schools
colare. Thus, for example, some useful studies for the educational system as a whole,
that would not be possible without the collaboration of families and students, are:
o From the questions regarding the parents' educational level, their level of occupation,
employment and the presence in the home of different consumer goods (magazines, room
own, encyclopedias, books, mobile phone with Internet access, tablet,) can be obtained
the SOCIO-ECONOMIC AND CULTURAL INDEX (ISEC). Thanks to this indicator, at the level of
center, in the ED report, the centers have the center ISEC and the scores
estimated for each competence in relation to said index, with the signaling of the
sition of the center. The ISEC of schools is also used, internally by the
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 5
5/36
Department of Education, along with many other factors, when dividing the hours
attention to diversity assigned to schools.
o The questions regarding the use of language in the school and family environment are useful at the
of the Department of Education, since they allow studies on linguistic uses
tics who contribute to the improvement in the advice of schools when it comes to
define and develop its Linguistic Center Project (PLC ).
6) “ On the question of sex, with three answer options, the objective simply
is to make the survey completely inclusive. In this way there is also
compliance with article 19.a) of the recently approved Foral Law 17/2019, of 04/04, of
equality between men and women, which indicates that “in statistics and studies, the
Public Administrations of Navarra, to guarantee the efficiency in the incorporation of the
gender perspective in their ordinary activity, they should systematically include the variable
of sex, collecting the different categories, in all statistics, surveys and collecting
data that they carry out ”. Likewise, it should be emphasized that other educational organizations
schools, such as the Public University of Navarra (UPNA) or the University of the Basque Country
(UPV), already include this format in their access questionnaires. Also with that same
inclusive character, to encompass all the diversity of family typologies, the term is included
Minor "parent" in matters relating to "father" or "mother ". In no case
traditional response options prevail, nor is it intended to indoctrinate or convince any
According to the respondent, the information that the students and their
families share for the diagnosis and improvement of education in Navarra .
7) “Regarding the question regarding the“ level of work occupation ”of the parents, it includes
selected a series of blocks of possible professions, classifying them into five groups,
at a higher level according to the professional category they occupy. Therefore, the profession is not recorded.
proper, but a numerical value from 1 to 5 that represents the lowest or highest
level of work occupation of the mother and father.
Taking into account the above, it is impossible to deduce whether the respondent belongs to
specifically to the category “military of basic, medium or high scale”, as mentioned in
claim, or to another category in that group .
8) “From the Technical Unit responsible for the questionnaire, it is recognized that the respondent
sable of the treatment has not provided with sufficient transparency and clarity, at the
moment in which the personal data were obtained, the information regarding the purposes of the
treatment to which the personal data are used and the legal basis for such treatment,
as indicated in article 13.1.c) of the RGPD and articles 12 to 18 of the LOPDGDD. "
"He considers that at an informative level, they should modify the aspect of the purposes of the
treatment to which the data is intended, the legal basis of the treatment and the existence of the
right to request the data controller for access, rectification and deletion of the
data, and therefore:
1-An explicit reference will be added to the basic information on protection of
data in the protocol of actions sent to schools and published on the web
from the Department of Education.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 6
6/36
2- A short letter will be drawn up to serve as a model for schools and will be
It will designate a single, simple and clear informative document (diptych or triptych type) where
carve aspects about what a DE is, why it should be carried out, utility, etc.
Said letter and the information document must be sent to all families. The document
Informational memorandum will also be published on the website of the Department of Education
tion.
- At the time the data is requested, and during the previous preparation phase, in the
own online application, the information that article 13
of the RGPD indicates that it must be made available to those interested (student and family).
More specifically, when collecting the data, it will be presented within the field
vision of the interested party, the following text:
"In accordance with the provisions of the RGPD and Organic Law 3/2018 of Pro-
Protection of Personal Data and Guarantee of Digital Rights, character data
personnel will be treated by the Evaluation and Quality Section of the Department of Education
of the Government of Navarra in its character of "responsible" and incorporated into the
type of treatment "Census Diagnostic Evaluation of Primary Education" with the aim of
contextualize the global results of the diagnostic evaluation, providing information
information, not only on performance in the different competencies evaluated, but also
on the socio-economic and cultural conditions of the educational system or other factors
associated with it, such as linguistic uses, the school climate and coexistence or the
satisfaction with the school. Likewise, we inform you that you can exercise your rights
chos of access, rectification, deletion and portability of your data, limitation and opposition
treatment, when appropriate, before the Evaluation and Quality Section of the Department
of Education of the Government of Navarra at the email address ”.
“ Purpose of the treatment Obtain information on the socioeconomic conditions
cultural and cultural activities of the centers for the contextualization of the results obtained,
as well as other factors related to school performance such as language uses,
school climate and coexistence or satisfaction with the school.
Treatment legitimacy (legal obligation)
Standard that enables data processing:
- Organic Law 2/2006, of 3/05, on Education (LOE).
- Organic Law 8/2013, of 9/12, for the improvement of educational quality (LOMCE).
It is mandatory to provide the data. There are no consequences for not doing so, although
Collaboration required is essential to contribute together to improve the system
educational.
The online survey application allows you to leave questions unanswered.
The registered data will not be transferred to third parties .
Exceptionally, for possible internal use in the technical units of the Department
of Education, either the data already analyzed globally will be sent, where there is no identifi-
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 7
7/36
cation of the students or, if the data themselves were sent, they would be shared anonymity
zados, that is, without any reference to the identifier of each student.
There are no international transfers of data.
Data retention time:
A maximum of 3 school years after the school year in which the inspection was carried out.
catch them.
Automated decisions Automated decisions will not be made about the information provided
cilted. "
9)
The respondent provides a copy of:
A - " PROTOCOL OF ACTIONS " associated with the " DIAGNOSTIC EVALUATION CEN-
SAL 4º OF PRIMARY EDUCATION COURSE 2018-2019 ” , published in pdf on the website of the
Department of Education since 01/14/2019, at the link: https: //www.educacion.na-
varra.es/documents/27590/1381944/Protocolo_4EP_2018_2019_castellano.pdf/fe4a6b07-
50eb-12e9-88b6-ee2671d9156c, 16 folios, in the file. Joins the file with
the name "EVALUACIÓN 4 EP "
It is accessed, highlighting:
1)
The index refers to the protocol for the online application of the
socioeconomic and cultural questionnaire, who will carry out the tests, delivery and custody,
specific instructions for the English language proficiency test, introduction
data, obtaining reports -student and center-, custody of evidence.
2)
About the protocol for the online application of the “socioeconomic and
cultural ”that appears in point B of the index, page 3, is indicated as most prominent:
“ The Department of Education will guarantee the confidentiality of the data provided
two for each student on the online questionnaire . In the diagnostic evaluation report,
the centers will have the Socioeconomic and Cultural Index, the estimated scores
for each competence in relation to said index, and the graphs with the regression line
Performance-ISEC for each competition, with signaling of the center position .
For the best application of the questionnaire, the centers will follow the following instructions:
1. All students who are in 4th grade of Primary Education must complete the questionnaire,
taking into account the criteria established in section “(E) Adaptation of the tests”.
2. The questionnaire will be accessible at the following address:
http://dpto.educacion.navarra.es/eed/
3. Each student will access the web application using a username (six categories).
numeric characters) and a personal password (four characters: two numbers and two letters).
after).
WATCH OUT! This password can only be used once….
5. The directors of the schools will obtain the list of names
username and passwords (as many as enrolled students) through the application
formatic Educa
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 8
8/36
(Educa → Center evaluation → Diagnostic evaluation).
This list will also include the identifying data of each student (cur-
so, group and full name). Directors will be able to access it from the
01/28/2019.
At the time of application, the director of the center will provide the names
User names and passwords for each tutor of the 4th year of PE (as many as students),
for distribution among your students.
6. Preparation. Prior to the application, tutor teachers, students and families may
practice freely, accessing the application with the following username and counter-
test signal:
Test username: Irati
Test password: Irati
The center will be able to prepare the completion of the questionnaire in the way
sidere timely. In any case, it is considered convenient to carry out tutorial activities
preparation, so that students know the questionnaire, the instructions for completing the
ment, and at the time of application you can confidently answer the questions
tas.
7. Application session. This session will be planned by the tutor teaching staff, using the
computers in the center. The students will access the application, each tutor will distribute to
each student their username and password, to be entered in the application.
tion, and fill out the questionnaire.
Completion is simple, if it has been previously prepared, and the following should be highlighted.
following aspects:
… To finish the questionnaire and save the answers, click on the En- button.
road. This is a necessary requirement to save the answers.
If questions have been left unanswered, clicking the submit application button
tion warns of this fact, and you can continue completing the questionnaire, or
close it by clicking the submit button as is.
After clicking the submit button and completing the questionnaire, no new access will be possible.
with the username and password used.
8. Deadlines. The questionnaire will be completed between February 1 and 28. The questionnaires
entered after the deadline, they will not be taken into account for the calculation of the center's ISEC. I know
advises not to leave the application for the last days, in case you have to solve any
access problem.
9. Clarifications and doubts. Any doubts that arise may be consulted in the Evaluation Section
tion and Quality, either through email (sec.eka@navarra.es) or through the
telephone ….
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 9
9/36
Correct completion of the questionnaire will allow the centers to have data
more reliable and better understand important aspects for the education of their students.
In section N there is "Obtaining student and school reports", in
Student report is about the assessment of the competence of the
math, english and linguistics. A report is also made with the global results
of the school's students as a whole.
It is indicated that the EDUCA application through which the tests are implemented,
It also provides the reports, files with data and files with the responses of the
students, the questions left blank and the score obtained. It also focuses on
that “the corrected booklets will be kept and kept in the school until the
11/30/2019, date from which they may be destroyed, and that “The student report is a
valid instrument to be delivered to families in the context of the tutorial action, in the
month of June".
On the results, evaluations and data of the evaluation reports of
context, nothing is indicated.
B -DIAGNOSTIC EVALUATION SURVEY 2018-2019 heading with instructions
among which it is reported that you have to “ answer several questions about yourself and your
family ”headed by“ sex ” , options: a-boy, b-girl , c-other options , model
language in which you study, with references between the answers to options, in Spanish,
B, in Basque with Spanish as a subject and some other subject in Spanish,
language in which you watch television, or read books or use video games, social networks, speak with
teachers in the classroom and outside, which language they use preferably (distinguishing) with
friends on the street, in the schoolyard or at home with the family, in which continent have you
born you, your mother, your father? Parents' educational level, their employment situation, work
current of your parents, with trades and jobs as an example as " Vigilante " " worker
of the field "," medical "," architect "military of the upper scale ", or of the "average scale", if
have their own individual room, as is the relationship with classmates about
if you feel lonely, outcast
-Resolution 03/30/2016 of the Secretary of State for Education “ by which the
context questionnaires and common indicators of the center for the evaluation of
primary education ”, BOE 04/15/2016. It is indicated that the LOE provides in its article 21 the
conducting an individualized assessment of all students at the end of the sixth year
primary school, and that the evaluation criteria and general characteristics of this evaluation
for the entire Spanish educational system will be established by the Government.
- Royal Decree 1058/2015, of 11/20, which regulates the general characteristics
of the tests of the final evaluation of primary education established in the LOE. In his ar-
section 8.1, and in compliance with the provisions of article 147 of the aforementioned LOE, determine
mine that the results of the final stage evaluations will be made known
of the educational community, through common indicators for all educational centers
Spanish, and that these common indicators will be established by the Ministry of Education
cation, Culture and Sport. In the second section: " Context questionnaires":
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 10
10/36
1. The context questionnaires that will be applied in the final evaluation of Education
Primary there will be three: One aimed at students in the sixth year of Primary Education who
carry out the evaluation (hereinafter, a questionnaire for students), another addressed to their parents
mothers and legal guardians (hereinafter, questionnaire for families), and a third
sent to the management of the Primary Education teaching center (hereinafter, questionnaire for
the direction).
2. The questions and the answer options that must be included in the
included in each of the questionnaires defined in the previous section are those indicated
in ANNEX ONE of this resolution
In any extreme, it is indicated that the questionnaire must be nominative, or anonymous or
the destination or treatment that with said data is undertaken. ANNEX ONE, questionnaire, no
requests the inclusion of the student's name.
Articles 144 and 145 of the LOE state:
144
" 1. The evaluation criteria corresponding to individualized evaluations
indicated in articles 20.3, 21, 29 and 36 bis of this Organic Law will be common for the
state as a whole .
Specifically, the tests and evaluation procedures indicated in the
Articles 29 and 36 bis will be designed by the Ministry of Education, Culture and Sports, through
of the National Institute of Educational Evaluation. These tests will be standardized and
designed to allow for accurate assessments and comparisons
equitable, as well as the monitoring of the evolution of the results over time
obtained.
The material realization of the tests corresponds to the educational administrations
competent. The tests will be applied and scored by teachers of the System
Educational Spanish outside the center.
Regulations shall regulate the procedure for reviewing the results of the
evaluations.
2. The educational administrations may establish other evaluations for the purposes of
diagnosis."
145
" Evaluation of the centers ".
"1. The educational administrations may, within the framework of their competences, prepare and
carry out evaluation plans for educational centers, which will take into account the
socioeconomic and cultural situations of the families and students they host, the environment
the center itself and the resources available to it.
2. Likewise, the educational administrations will support and facilitate the self-evaluation of
educational centers . "
LOE, twenty-third additional provision. Students personal data
"1. The educational centers may collect the personal data of their students that are
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 11
11/36
necessary for the exercise of their educational function. Said data may refer
to the origin and family and social environment, to personal characteristics or conditions, to
development and results of their schooling, as well as those other circumstances whose
knowledge is necessary for the education and guidance of students.
2. Parents or guardians and students themselves must collaborate in obtaining the
information referenced in this article. The incorporation of a student to a
educational center will imply consent for the processing of your data and, where appropriate, the
transfer of data from the center in which they had been enrolled with
previously, in the terms established in the legislation on data protection. In
In any case, the information referred to in this section will be strictly necessary
for the teaching and guidance function, not being able to be treated for purposes other than
educational without express consent.
3. In the treatment of student data, technical standards and
organizational that guarantee their security and confidentiality. The teaching staff and the rest of the
personnel who, in the exercise of their functions, access personal and family data or who
affect the honor and privacy of minors or their families will be subject to the duty of secrecy.
4. The transfer of data, including those of a reserved nature, necessary for the system
educational, will be carried out preferably electronically and will be subject to the legislation in
matter of protection of personal data. In the case of the transfer of data between
Autonomous Communities or between them and the State, the minimum conditions will be
agreed by the Government with the Autonomous Communities, within the Conference
Sectorial of Education. "
THE LOMCE reformulated the wording of article 147 of the LOE, stating:
147:
“ 1. The Government, after consulting the Autonomous Communities, will present annually to the
Congress of Deputies a report on the main indicators of the system
educational Spanish, the results of the Spanish diagnostic evaluations or
international standards and the recommendations made based on them, as well as on the
Highlights of the report on the education system prepared by the Council
State's scolar.
2. The results of the evaluations carried out by the educational administrations will be
made known to the educational community through common indicators to
all Spanish educational centers, without identification of personal data and
after considering the socioeconomic and sociocultural factors of the context. "
1) They have contacted the claimant by post to inform him of what
that manifests itself to the AEPD.
FOURTH: The claim was admitted for processing by the director of the AEPD on 06/11/2019.
FIFTH: On 12/20/2019, it was agreed by the director of the AEPD:
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 12
12/36
“FIRST: INITIATE SANCTIONING PROCEDURE for APERCISE at the
DIRECTORATE GENERAL OF EDUCATION (DEPARTMENT OF EDUCATION, GOVERNMENT
DE NAVARRA), for the alleged infringement of article 5.1 a) of the RGPD, in accordance with
Article 83.5.a) of the RGPD.
SECOND: INITIATE SANCTIONING PROCEDURE for APPEAL at the
DIRECTORATE GENERAL OF EDUCATION (DEPARTMENT OF EDUCATION, GOVERNMENT
DE NAVARRA), for the alleged infringement of article 5.1 a) of the RGPD in relation to the article
Article 9.1 of the same RGPD, in accordance with article 83.5.a) of the aforementioned RGPD.
THIRD: INITIATE SANCTIONING PROCEDURE for APPEARANCE at the
GENERAL DIRECTORATE OF EDUCATION - DEPARTMENT OF EDUCATION, GOVERNMENT
DE NAVARRA), for the alleged infringement of article 13 of the RGPD in accordance with the
Article 83.5 b) of the RGPD .
SIXTH: Against the commencement agreement, the complainant on 01/14/2020 makes the
following allegations:
1)
It agrees with the imputation of the violation of article 5.1 a) of the RGPD and
establishes as a proactive measure the review, elimination and modification of any data
Identification of the CC carried out during the 4EP 2018/2019 course . In the event that it is decided to continue
To continue with the aforementioned evaluation, in this course and later it will be done anonymously,
so that the RGPD is not applicable.
2)
The infringement of article 13 RGPD is assumed since when performing the CC, no information is
conveniently on data processing and your rights to parents and guardians of
the students. Work is underway to establish a model clause. The Department of
Education has published on the website a whole section dedicated to Protection of Da-
cough in which the record of treatment activities, documentation of interest is reported
and models for schools and managers and frequently asked questions about treatment of
data in the educational field.
3)
They do not agree with the commission of the infraction of article 5.1 a) in relation to
with 9.1 of the RGPD on the occasion of the inclusion in the CC of the variant " other options "
in the question “ sex ”, although the service in charge of the evaluation did not determine more specific
specifically in the questionnaires to which he referred when he established the box “ other options” .
The fact of including this option within the sex variable refers or is referring only to
the gender identity of the students, and the Spanish Agency for Data Protection seems
confuse it with sexual orientation or life, data that are especially protected by
the European standard. Article 5 of Regional Law 8/2017 of 06/19 for social equality of the
LGBTBI + people in force at the time of the questionnaires is collected and
clearly differentiates " definitions for the purposes provided in this regional law are :
- LGBTBI + lesbian, gay, bisexual, transgender, transgender, intersex people
and other minorities due to sexual and / or gender identity, sexual orientation and / or expression
gender .
- sexual orientation orientation of the erotic sexual or affective desire that a person experiences
sound towards other sexual identity consciousness of belonging to one sex.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 13
13/36
- gender identity feeling of belonging to a human group defined around the
categories of man and woman, identifying with one of them (binary) both (not binary)
river) or none (to gender) ”.
It ends by stating that without prejudice to also anonymizing the CCs that are made,
from now on, this department understands that it did not violate article 9 of the regulation,
since I was only requesting gender identity of the students.
SEVENTH: On 03/04/2020 it is decided to start the practice period of tests
requesting:
1) To the Department of Education of the Government of Navarra (General Directorate of
education):
1.1.1 Provision or regulation of the Navarrese Government by which it was authorized or allowed
retake the 4EP diagnostic evaluations from the 2016/2017 academic year.
On 06/02/2020 he replied that it was the resolution of the General Director of
Education 273/2016 by which the instructions that will regulate the course are approved
16/17 the organization and operation of centers. In the fourth section, two, are established
the conditions under which the DE tests will be reapplied upon completion of the 4EP. It is in-
says that they will perform the diagnostic evaluation under the coordination of the evaluation section
tion and quality. It will have external tests that will evaluate skills and will be applied
and corrected in educational centers. “ This evaluation has a formative and guiding nature
dor for centers. The information obtained from this analysis will be relevant to adapt the
educational attention to the needs detected. The centers will decide when and how
how to get the reports to the families before the end of the school year while
It is advisable to do it in the context of the tutorial action ”.
1.1.2
What is the distinction between census-type and sample-type evaluations?
It states that the census refers to the participation of the entire population under study,
like that of 4EP, sample only of a certain set of the population object of
study.
1.1.3.You stated: “ As of the 2016/2017 school year, it was agreed to
via authorization from the General Directorate of Education, that the online application of the question
socioeconomic and cultural questionnaire of the diagnostic and individualized evaluations of the
Navarrese educational system will cease to be anonymous and will be accessed through a
sonal that will guarantee the confidentiality of the data provided by the students in the
answered answers "
In relation to this, you are asked to:
-It is understood that what is done online are both types of tests, the
competency diagnostic tests, and context questionnaire tests? In this sense,
requests that you Report on the need or obligation for both types of questioning
must identify the student, and the precept or rule from which said identity is
tifiability.
Indicates that ED is a tool to diagnose and identify the degree of acquisition
basic competencies of all students in order to include improvements at the individual level
dual and center. The need to generate reports for families in the field of ac-
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 14
14/36
tutorial with the level of acquisition of competencies evaluated of each student obliged
that the diagnostic evaluation tests are nominal and in Navarra the
Competency diagnostic tests have always been done manually on paper.
As for the CC, it had been done online since the 2011/2012 academic year and until the
2016/17 had always been answered anonymously
1.1.4. You are asked to report on the generation of the password keys and
user in the questionnaires, in the diagnostic and in the context, in addition, if the keys
Username and password are the same as the second, if they are related or can be
relate both questionnaires regarding their author.
Taking into account that only the context questionnaire was done online, it was answered
of what:
-The 2018-19 academic year, credentials were generated that allowed the identification of the
participating students.
- “ EDUCA personal information was used, the management information system
Education Department of Education. The centers distributed the identifiers to the
male and female students, each his own, and they completed the questionnaire. "
“ As the questionnaire did not allow access for the second time, the centers could not
They knew the answers entered . "" " In the Department, not all the people who
had access to the questionnaire responses were able to identify the people who
They had introduced, but some did, specifically the managers of the unit res-
responsible for the process, because they had the answers and also the list of identifiers
and people. "
In EDUCA, the users and passwords of the questionnaires for the 2018-19 academic year and before
The previous ones have been removed (this is done every time the ones for the current school year are loaded).
EDUCA only serves as a facilitation system for these credentials. Both the questionnaire
as the response records are outside of EDUCA .
1.1.5. In " Protocol of actions " associated with the " Census Diagnostic Evaluation
4th EP course 2018-2019 ”published on the website of the Department of Education refers to
Reference to the protocol for the online application of the socioeconomic and cultural questionnaire.
About it, which appears in point B of the index, page 3 is indicated as the most prominent
do
For the best application of the questionnaire, the centers will follow the following instructions
nes:
-It indicates that 3: Each student will access the web application using a name of
username (six numeric characters) and a personal password (four characters: two numbers)
mere and two letters) WARNING! This password can only be used once….
Regarding the key generation system, they are asked the mode of generation of
the user codes and password, for this CC data that must be filled in to obtain-
the, storage method, time the questionnaires are kept, and what units, and
people had access and why they could and had to access.
It is reported that measures have been taken since the 2019/2020 academic year, related to
the issues that are the subject of this test practice:
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 15
15/36
The Instruction of the Director General of Education, dated 01/23/2020, was issued, by which
It is provided that the online questionnaire will be anonymous this year 2019-2020 and through
a random key that will guarantee the confidentiality of the data provided by the students.
do in the answers. The copy thereof, signed on 01/23/2020 also contains: " Once
answered the questionnaire, no other user or teacher, or students, or director-ora, or
Education department staff will be able to know the identifying data of each school.
your student ”.” The directors of the centers will obtain through EDUCA the report
tion of usernames and passwords to be awarded among the students in a manner
random ra . "
All the records, files, and backups in which you could have
they will appear confidential data of students of previous courses.
It also provides a pdf guide that appears on the website of the claimed one on “ diagnostic evaluation
census nostica fourth primary year 2019-2020 , protocol of actions ”It is indicated that
All students who take 4EP should fill in the questionnaire and who to access di-
cha application will use a random password user but only once, although using
The password will be obtained through the EDUCA application and will be distributed randomly.
to the students. There are also instructions for assessing skills
which is made by hand on paper, in the form of booklets in which the answer is selected
ta. It is indicated that a student report is generated and with the generic definition of the levels
proficiency levels the level reached in each competency evaluated direct score obtained
taken in each test and space for observations that can be completed by your-
tor or tutor. Regarding the custody of the evidence, it is said that the booklets are kept
day and keep until 11/30/2020.
1)
To the Ministry of Education and Vocational Training - Institute of Evaluation and
Educational Administrations:
2.1 Regarding the DE questionnaires of basic competences and CC, please
to report:
2.1.1. On what courses are they compulsory?
On 03/12/2020, it indicates that Organic Law 8/2013 of 12/9 provides for three evaluations
external education, in primary education: third and sixth grade (end of primary), and in secondary
daria, in fourth year (articles 20.3, 21 and 29).
It states that CCs are carried out in cases of:
a) Individualized evaluation of the third year of primary education, carrying out
according to the educational administrations, being these competent to regulate if
CC or not apply and what type.
b) It is carried out in the final evaluation of primary education, sixth year, in accordance with
Article 7.5 of RD 1058/2015 of 11/20 which regulates the general characteristics of the
tests of the final evaluation of primary education, it is indicated: “ simultaneously to the
celebration of the final stage evaluation, context questionnaires will be applied to
borara the Ministry of Education, Culture and Sports. These questionnaires were described in
the resolution of 12/4/2017 of the Secretary of State for Education, professional training and
Universities These evaluations have been carried out at the end of the 2015-2016 academic years, until
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 16
16/36
2018-2019. The application of these evaluations is the responsibility of the Administrations
educational so it corresponds to them to comply with these regulations ”.
It refers to the appeal resolved by the Constitutional Court on various precepts of the
Royal Decree 310/2016 of 07/29, by judgment 114/2019 of 10/16 which estimates
partially a positive conflict of jurisdiction and declares the unconstitutionality and
nullity of the precepts of said Royal Decree related to the preparation of the CC, which already
It is not the competence of the Ministry of Education as it corresponds to
execution of the CCAA (STCO 109/2019 FJ 9) because “it does not constitute an
direct configuration of the requirements for obtaining a degree
academic . ”. Therefore, article 5.1 of said RD agrees that “ as of the ruling , the
information on the socio-economic and cultural context of the centers
teachers will be obtained through the application of different context questionnaires ”, has not
to be prepared by the National Institute of Educational Evaluation, of the Ministry of
Education, Culture and Sports. The same meaning of the content of this ruling is appreciated,
referred to RD 1058/2015 that regulate the general characteristics of the tests of the
final evaluation of Primary Education, is contained in the related sentence, of the Plenary
of the T Co, no. 109/2019 of 3/10.
CC are also performed in the final evaluation of Compulsory Secondary Education that
is regulated by the provisions of article 22 of Royal Decree Law 5/2016 of 9/12 of measures
urgent for the extension of the calendar of implantation of the Organic Law 8/2013. These
questionnaires have been established by annual ministerial order for the courses
2016, 2.017, 2018.
2.1.2. Indicate if both questionnaires are developed in the same act.
They state that the CC can be addressed to the students, their parents, mothers and guardians
legal and the one directed to the direction of the educational center of primary education.
He adds that during the scheduled times for the application of the tests, a
period for the students to complete the CC and for the families to fill in
the questionnaire at your home.
2.1.3. Please inform if both questionnaires are nominative and can and should be identified
car to the student who completes it. Legal basis from which said identifiability is deduced
He states that both the evaluation tests and the QC “ are carried out in an anonymous way.
nima ”. It is appreciated that this statement goes against what was also stated in evidence
by the defendant who stated that the “diagnostic evaluation is of a nominal nature
nal and in Navarra have always been done manually on paper ”although the question
could have understood the question about the different context questionnaires that exist
have. Regarding the legal basis:
3rd EP
“ It is the responsibility of the educational administrations. Within the scope of the Ministry of
Education and vocational training the instructions given each school year rec-
gene expressly anonymous treatment of evaluation data. "To guarantee the
anonymity of the responses to the family questionnaire will be distributed in envelopes that families
lias may close once the completed questionnaires have been entered "
EP, final evaluation
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 17
17/36
" Article 8.4 of Royal Decree 1058/2015 indicates that" the results of the evaluations
The final stages of the stage will be made known to the educational community through
common indicators for all Spanish educational centers without identifying data from
personal character and after consideration of the socioeconomic and cultural factors of
context.
It should be taken into account that since the entry into force of Royal Decree Law 5/2016 the
The evaluation is sample and has a diagnostic purpose, so the indicators are not common.
nes for all Spanish centers. According to article 3: “the provisions of the Royal Decree
1058/2015 of 11/20 will only apply what is not opposed to this provision.
The competence for the material performance of the tests rests with the educational administrations.
cativas. In the scope of the Ministry's competence, the annual instructions include in
the following section: ”confidentiality. All participants in the evaluation process
will maintain the utmost confidentiality at all times regarding the content of the
test your results until they are made public. In any case,
Personal data derived from the application of the tests must be treated in accordance with
the provisions of current regulations . "
ESO final evaluation
Royal Decree 310/2016, of 07/29, which regulates the final evaluations of
Secondary Education and Bachelor of Article 3.1 g) indicates that corresponding
of educational administrations the adoption of measures to guarantee the custody and
confidentiality of the tests as well as ensuring the anonymity of the data of the
students in the correction and qualification phase of the tests "
article 5.3 " the context questionnaires will in any case be anonymous ".
2.1.4 Indicate whether this Institute develops uniform criteria related to the identification
reliability of the questionnaires / student.
It states that the Institute coordinates the performance of the evaluation in the field of
petition of the Ministry. The identification of the students in these evaluations is carried out
using a unique numerical code that is assigned to the students prior to the completion of the
the evaluation. The Institute does not know the correspondence between codes and names so
cannot identify student body.
In 3rd year of PE, the only course in which the evaluation is individualized and a report is delivered
results for students, identification is carried out in the educational centers themselves and in
the Provincial Directorates of Education of Ceuta and Melilla or the Ministries of Education
tion of different countries. Since the 6th grade PE and 4th ESO assessments are not
individualized students are not identified at any time. The Institute shares with
the Autonomous Communities the method used to anonymize the evaluations
But it is up to them to implement this system or not.
2.1.5 On whether the Institute is aware of the context questionnaires carried out by the
different CCAA, and if it has to issue some type of report.
It states that it is not mandatory in relation to evaluations of its competence.
2.1.6. On whether you have implemented in said questionnaires or has the issue of
questions about gender identity?
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 18
18/36
It states that the CC prepared by the Institute and those defined in the BOE for 6th
EP and 4th of ESO that have been prescribed for all educational administrations until
The 2019/2020 academic year does not contain questions about gender identity, it was only asked
to the students if it is a boy or a girl and to the families the questionnaires refer to their child or their
daughter.
1)
The website of the claimed person is accessed at the address https: //www.educacio-
n.navarra.es/web/dpto/evaluacion-y-calidad/evaluacion/evaluacion-externa/evaluacion-de-
navarra / education-infant-and-primary-course-2018-2019, entitled " Protocol of actions
of CENSUS DIAGNOSTIC EVALUATION 4th Primary Education Academic year
2018-2019 ”, in the file it appears incorporated with the name“ webnavarra eva 4 instru ”and
It can be seen in the file that the publication of all the elements of the test is
ba even the answers. It is opened by way of checking, the math test, com-
petence, and it can be seen that the front of the booklet contains the spaces for the identification
cation of the student, center, classroom, date, location, referred to the ED as mentioned.
Therefore, it is accredited that the competence assessment questionnaire that is developed in
the diagnostic evaluation test must be nominative.
The guide for the use of the EDUCA computer application indicates that this
application you can perform tasks based on an assigned profile and as an example,
generate a report for families in relation to the diagnostic evaluation, Identify the students
exempt swim, indicate observations, record responses, access the report of the results
global data of the center, and there are three profiles: director, tutor and managers - management team and
administrative staff.
EIGHTH: On 09/08/2020 a resolution proposal is issued, from the literal:
" 1-That the Director of the Spanish Agency for Data Protection sanction
with warning to the claimed, by:
- an infringement of article 5.1.a) of the RGPD, in accordance with article 83.5 a)
of the RGPD.
- an infringement of article 5.1.a) of the RGPD, in relation to article 9.1 of the
RGPD and 9.1 of the LOPDGDD, in accordance with article 83.5 a) of the RGPD.
-A violation of article 13 of the RGPD, in accordance with article 83.5 b) of the
GDPR "
On 09/23/2020, allegations were received reiterating what was stated.
PROVEN FACTS
1)
The claimant states that his son attends in 2018/2019, 4th year of primary school (9-
10 years) in an Associated College of the Autonomous Community of NAVARRA and has had to complete
a nominative questionnaire that among other extremes contains questions such as sex:
(boy / girl / other options), about the language he uses outside of school, his feelings
towards school, their relationships with their peers, or the profession of their parents.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 19
19/36
2)
In the Spanish primary education system, there are two modalities of
individualized diagnostic evaluation (ED) for all students.
Third year evaluation: the degree of mastery of the skills will be checked,
abilities and skills in oral and written expression and comprehension, calculation and resolution
from problems. If this evaluation is unfavorable, the teaching team must adopt,
in collaboration with families, the most appropriate ordinary or extraordinary measures
setting and executing improvement plans for individual or collective results that allow
solve difficulties.
Final evaluation of Primary Education, in the sixth year, in which the
degree of acquisition of competences in linguistic communication and mathematics, and
of basic competences in science and technology, as well as the achievement of the objectives of the
stage. The result of the evaluation will be expressed in the levels: Insufficient (IN), Sufficient
(SU), Good (BI), Notable (NT) or Outstanding (SB). The level obtained by each student is
It will be recorded in a report that will be delivered to the parents or legal guardians. Said report
It will be informative and guiding for the centers in which the students have
completed sixth year of Primary Education and for those in which they will continue
their studies, as well as for teaching teams, parents or legal guardians and students
students.
3)
Simultaneously with the conclusion of the final stage evaluation,
context questionnaires (CC), complementary to the competence test, which
will be prepared (at the date of the claim) by the Ministry of Education, Culture and Sport.
These questionnaires allow obtaining information on socioeconomic conditions and
cultural centers for the contextualization of the results obtained.
Royal Decree 1058/2015 of 11/20 regulating the general characteristics of
the tests of the final evaluation of primary education established in the LOE in its article
8.1 and 8.2 referring to the evaluations aimed at the sixth grade of primary school, carried out by the
CC indicates that there would be three, one for the student, one for the families and one for the school.
cente, and that “the questions and response options that must be
included in each of the questionnaires defined in the previous section are those indicated
in ANNEX ONE of the resolution "
4)
Education regulations provide that the Autonomous Communities can carry out other evaluations
for diagnostic purposes, in accordance with article 144 section 2 of Organic Law 2/2006,
of 3/05, on Education, modified by Organic Law 8/2013, of 9/12, for the Improvement of the
Educational quality. In the CA of Navarra, this power is used and ED and CC are carried out
for fourth grade from the 2009/2010 academic year.
In the Autonomous Community of Navarra, the EDs are carried out in nominative forms for each
student, in paper format, (booklets in which the data is filled in for each student at the
perform them) including your personal data reflected in the test, considering that it has been
to relate the degree of acquisition of skills and improvement of the student.
5)
In the AC of Navarra, during the seven school years comprised between the
2009/2010 and 2015/2016 (both inclusive), the fourth grade CC forms
to which the students responded were made anonymously, without containing their data
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 20
20/36
personal. As of the 2016/2017 school year, "it was agreed " to carry out the CC through a
application, online, ceasing to be anonymous, accessing through the pair (user-
password) that was assigned to the students. In the 18-19 academic year, the CCs became
during the month of February 2019 and the ED tests during the week of 6 to
05/10/2019.
6)
The respondent had a PROTOCOL of action associated with the evaluation
Census diagnosis of fourth primary education for 2018/2019 published on its website
from 01/14/2019, in which he referred to both the ED and CC tests. At the point
To 5 of the INSTRUCTIONS for the application of the questionnaire, it was indicated (for the
context data that were carried out online - the ED was done on paper, by hand - that the Directors
The principals and the Directors of the schools will obtain a list of user names.
river and passwords, as many as enrolled students, through the computer application
EDUCATES. In this relationship, the identifying data of each student will also appear.
(course, group and full name). Directors will be able to access it from
from 01/28/2019. At the time of application, the director of the center facilitates
It will give the user names and passwords to each tutor of the 4th year of PE (as many as there are).
tudiantes), for distribution among their students.
The development of the test is carried out using the computers of the center, distributing
Each tutor gives each student their username-password so that they can enter them in the
application and fill out and submit the questionnaire. Before being sent, the application warns of the
possible unanswered questions, being able to ignore said option and terminate the same
mo sending it like this, or fill in what is missing.
7)
The personal data of the students collected in the forms of the CC
They were stored in databases of the claimed that were kept in the
network drives of the Department of Education server, accessible from inside
of the Department itself, and in the computer equipment by means of username and password.
8)
In the CC form associated with ED , for the 2018-2019 year of fourth grade,
It contains “ Questions and response options that must be included in the
days in each of the questionnaires "," QUESTIONNAIRE FOR STUDENTS "contains the
heading with instructions, informing that you have to “ answer several questions about
about yourself and your family ”. All questions are answered by checking boxes in the answers.
posts that are offered headed by " sex" , options: a-boy, b-girl, c-other " In pro-
medium How often have you missed this course without justification? How many
days a week do you do homework? options, linguistic model in which you study,
with references between the answers to options, in Spanish, B, in Basque with Spanish
plain as a subject and some other subject in Spanish, the language in which he watches television,
or read books or use video games, social networks, talk to teachers in the classroom and go
ra, which language he preferably uses (distinguishing) with his friends on the street, in the courtyard
from school or at home with the family, in which continent were you, your mother, your father born ?
Educational level of the parents, their employment situation, current job of your parents, with trades
and jobs by way of example such as " Vigilante " " farm worker ", " doctor ", " architect
"Military of the upper scale ", or of the "medium scale", if they have their own individual room,
as is the relationship with classmates on whether he feels lonely, marginalized.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 21
21/36
The context questionnaire must not contain the identifying data of the student who completed it.
This is derived by analogical application of the provisions for these CC in the RD that refers
the CC for the compulsory tests of sixth grade of primary
9)
Completing the CC form is mandatory for each fourth grade student.
primary, while questions can be left unanswered, it can even be submitted with
all your unanswered questions.
10)
As stated by the claimed, the legal authorization of data processing for the CC
is the fulfillment of a legal obligation derived from LO 2/2006, LOE, with the
modifications of LO 8/2012 LOMCE, although some regulations contain that the CC
It must contain identifying data of the student. The referred regulations for education
primary school is made up of Organic Law 2/2006, of 3/05, on Education, modified by Law
Organic 8/2013, of 9/12, for the Improvement of Educational Quality, which provides in its article
21 conducting an individualized evaluation of all students at the end of the sixth grade
Primary Education course. Royal Decree 1058/2015, of 11/20, regulates the
general characteristics of the tests of the final evaluation of Primary Education,
eleven)
Regarding the question in the CC of, gender of the student who fills out the questionnaire, with
three answer options, boy-girl, other options, was introduced unilaterally by
the one claimed in application of article 19.a) of the Foral Law 17/2019, of 04/04, of equality
between men and women, who points out that “in statistics and studies, the Administrations
of Navarra, to guarantee the effectiveness in incorporating the perspective of
gender in their ordinary activity, they should systematically include the variable of sex, recog-
Giving the different categories, in all statistics, surveys and data collection
that they carry out ”. As determined by the regulations applicable to the CC, the questions of
This questionnaire was prepared by the Ministry of Education, which did not introduce an al-
guno on the matter. If it was pointed out that educational administrations could introduce
new questions, but not broadening them.
12)
With the EDUCA application in which the data is stored, information can be prepared
month and access the questionnaires, view the answers, the questions left blank, and the
score. The “ corrected booklets ”, alluding to the ED, are kept in the
school until 11/30/2019. Families are given a “ student report in the
month of June "
13)
At least in the CC, there was no reference to the collection, conservation,
purposes of the treatment to which the personal data are intended, legal basis or exercise of rights
chos. It is unknown if the same happened in the diagnostic competence questionnaire (ED)
which has not been the object of the complaint, although the interdependence between the
bos.
14)
In the course of these proceedings, the respondent has stated that:
-You have added explicit references to the basic information on data protection in
the protocol of actions sent to schools and published on the De-
Department of Education.
-Implements the information on ED and CC that will be delivered to families, in addition
to be exposed on the website of the Ministry.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 22
22/36
-Information aspects of data collection and processing will be provided
when the data is requested in the online application itself.
-It provides a data retention period of three school years after the course
in which they are collected.
- The users and passwords of the questionnaires of the course have been eliminated in EDUCA.
so 2018-19 and earlier (this is done every time those of the current school year are loaded) and
in tests he claimed to have destroyed all records, files and backups
in which data of students from previous courses could appear.
-The Instruction of the Director General of Education, dated 01/23/2020, was issued, by which
It is provided that the online CC will be anonymous this year 2019-2020 and through a password
random.
-The protocol of actions for the questionnaires of the 2019-2010 academic year has been varied
fourth grade that are published on the web.
FOUNDATIONS OF LAW
I
By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in arts. 47 and 48.1 of the LOPDGDD, the Director of the
Spanish Agency for Data Protection is competent to resolve this procedure.
II
As a starting point, it should be noted that the twenty-third additional provision
of Organic Law 2/2006, of 3/05, on Education, establishes in a general way the principles
basic in relation to the treatment and communication of personal data within
of its scope of application, by providing the following:
"1. The educational centers may collect the personal data of their students who
are necessary for the exercise of their educational function. Said data may make
reference to the origin and family and social environment, characteristics or conditions
personal development and results of their schooling, as well as those other
circumstances whose knowledge is necessary for the education and orientation of
the students.
2. Parents or guardians and the students themselves must collaborate in obtaining the
the information referenced in this article. The incorporation of a student
to a teaching center will imply consent for the processing of your data and,
where appropriate, the transfer of data from the center where they had been
previously schooled, under the terms established in the legislation on
Data Protection. In any case, the information referred to in this section
will be strictly necessary for the teaching and guidance function, not being able to
be treated for purposes other than educational without express consent.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 23
23/36
3. In the treatment of student data, technical standards and
organizational that guarantee their security and confidentiality. The faculty and
rest of the personnel who, in the exercise of their functions, access personal data and
family members or that affect the honor and privacy of minors or their families will
subject to the duty of secrecy.
4. The transfer of data, including those of a reserved nature, necessary for the
educational system, it will be carried out preferably electronically and will be subject to
the legislation on the protection of personal data, and the
Minimum conditions will be agreed by the Government with the Communities
Autonomous within the Sectorial Education Conference. "
In this claim, the issue in question is the competence of the evaluation of
the quality of teaching through questionnaires, in this specific case, not in the
of the evaluation of acquired knowledge, but in that of socioeconomic factors and
cultural activities related to the homes, the environment and the media where the
student. Thus, for example, the Socioeconomic and Cultural Index (ISEC), which is also included
Among others, in the PISA tests, it is calculated from some of the responses of the
students and their families in the context questionnaires, which summarize various in-
training on the social and family context of students and is made from data
such as the level of studies of the father, mother, their professions, or level of resources do-
such as computer desk table for personal use, etc.
On whether for the 2018/2019 academic year the current regulations required the course to be
primary school room, some kind of context assessment, and if it was required, if this
It must be anonymous or identifying, it should be noted:
Even with the modification of the LOE by the LOMCE (2013), it is not appreciated that
there is a reference to the obligation to carry out any evaluation on 4EP students . An-
After this modification, article 21 of the LOE did not indicate the obligation or its
census character, stating: “ At the end of the second cycle of primary education, all
centers will carry out a diagnostic evaluation of the basic competencies achieved
by his students. This evaluation, competence of the educational administrations, will have
formative and guiding nature for the centers and informative for families and for the
together with the educational community. These evaluations will have as a frame of reference the
general diagnostic evaluations that are established in article 144.1 of this Law "
Article 20.3 of the LOMCE states:
“The educational centers will carry out an individualized evaluation of all students
students and students at the end of the third year of Primary Education, according to the
educational administrations, in which the degree of mastery of the skills will be verified,
abilities and skills in oral and written expression and comprehension, calculation and resolution of
problems in relation to the degree of acquisition of competence in communication
güistics and mathematical competence. If this evaluation turns out to be unfavorable, the
The teacher must adopt the most appropriate ordinary or extraordinary measures
Since 12/30/2013, the diagnostic evaluation is about the teaching of sixth grade.
primary school, deducing that it will not be anonymous since article 21.3 indicates that the result
tado will also be given to parents.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 24
24/36
The complainant indicates that with the entry into force of the LOMCE, the individual evaluation
census of 4EP was maintained for those in 3rd Primary and 6th Primary, and that voluntarily
by virtue of article 144.2 of the LOMCE in Navarra, the historical evaluation of the
4EP census diagnostic assessments from 2016-2017.
The result is that there is no obligation derived from law, which expressly establishes
the performance to 4EP of evaluation of any kind, nor specifically, of evaluation of
context, although article 144.2 of the LOE states: " The educational administrations
may establish other evaluations for diagnostic purposes. " to which the
claimed
Taking as an example of context evaluation, the one at the end of primary school, it is indicated
in Royal Decree 1058/2015, in its article 7.5, which simultaneously to the celebration
of the final stage evaluation, context questionnaires prepared by the
Ministry of Education, Culture and Sports. These questionnaires will allow obtaining
information on the socio-economic and cultural conditions of the centers for
contextualization of the results obtained. Also in its article 8.1, and " giving
compliance with article 147 of the LOE, the results of the final stage evaluations
will be made known to the educational community through common indicators
for all Spanish educational centers, and that these common indicators will be
established by the Ministry of Education, Culture and Sports . "
On whether the applicable regulations establish that the data from the context questionnaire
must be anonymous or establish their nominative character, the resolution of 03/30/2016, of the
Secretary of State for Education, Vocational Training and Universities, by which
define the context questionnaires and common center indicators for the
final evaluation of primary education determines in its article 7.5 that «in a way
Simultaneous to the celebration of the final stage evaluation, questionnaires will be applied
context, to be prepared by the Ministry of Education, Culture and Sports. These questionnaires
will allow obtaining information on the socio-economic and cultural conditions of the
centers for the contextualization of the results obtained. It is indicated as highlighted:
Second article: Context questionnaires.
"1. The context questionnaires that will be applied in the final evaluation of Educa-
Primary education will be three: One aimed at students in the sixth year of Primary Education
who carry out the evaluation (hereinafter, a questionnaire for students), another aimed at their
fathers, mothers and legal guardians (hereinafter, questionnaire for families), and a third party
addressed to the management of the Primary Education teaching center (hereinafter, questionnaire
for the address).
2. The questions and the answer options that must be compulsorily
included in each of the questionnaires defined in the previous section are those indicated
in ANNEX I of this resolution
3. The educational administrations may:
a) Apply questionnaires addressed to other groups, in addition to those indicated in the article
the second, section 1, of this resolution.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 25
25/36
b) Include other questions in each questionnaire in addition to those referenced in the article.
the second of this resolution. However, answer options cannot be added
other than the questions that appear in ANNEX ONE of this resolution.
c) Apply the different questionnaires in the format that is considered most appropriate (pa-
pel or digital).
d) Define the time and place of completion of the different questionnaires.
e) Lay out the questionnaires according to your needs and alter the order of the questions.
This includes the possibility of jointly designing the questionnaire for the
students and the questionnaire for families, provided that it is clearly indicated who
you must complete each part.
It is indicated in the third point, that “ The National Institute of Educational Evaluation facilitates
The educational administrations will issue a code book with the necessary instructions and
mandatory for the correct recording of data and subsequent processing
common indicators ”.
This resolution of the Secretary of State has been modified by another resolution of
12/4/2017, BOE of 12/27, which varies a question in this ANNEX ONE.
Regarding data protection, no aspect is included in the resolution or in which
modifies it.
The aforementioned ANNEX ONE includes the questions and response options that
They must be included in each of the questionnaires, indicating and differentiating
referencing that of students, which parents or guardians have to fill in. The question
The number of students begins with the question, are you a boy or a girl, with only two options
set, and contains questions about how often you use a computer or tablet
for school work at each of the following locations, how many days a week do you
you do homework. Contains a total block of 11 questions, ending in " In
general to what extent do you agree with these statements about your teachers and
teachers ? A) I know what they expect me to do ... It is not indicated in any section that the question
Context questionnaire must be nominative or the student must be or can be identified
cost, therefore, the identity of the students who complete the questionnaire does not appear
ce as necessary in any norm, nor is it justified in relation to the purpose of the
cough to which they are destined
The questionnaire for families begins with questions such as in which country were they born?
do you and your daughter or son, indicate how often the family home is used by
following resources ..., with four response options, number of people who
Come home, degree of satisfaction with the following aspects related to the School ... in
regarding the teaching staff, tutors, or the question of would you recommend this center, how many
days a week your daughter or son does homework including studying how often you
or someone else in the house talks about the following with their son daughter… he also wonders
the highest level of study completed by the mother or father, or the category that
better describes the work situation of the mother and father.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 26
26/36
In the context test made by the claimed 4 EP, the student contains
17 questions, some other than ANNEX ONE, in addition to the aforementioned boy / girl,
related to the use of the language, including those that in ANNEX ONE refers to
questionnaire for families, such as those referring to parents, employment status of parents,
their level of studies and the type of work they do.
The issue must be linked in addition to current regulations, with the character of
context assessments that are carried out in conjunction with assessments of
official diagnosis, and for the purpose of the data extracted from said evaluation of
context.
The result is that there is no obligation derived from law, which expressly establishes
the performance to 4EP of evaluation of any kind, nor specifically, of evaluation of
context, although article 144.2 of the LOE states: " The educational administrations
may establish other evaluations for diagnostic purposes . " to which the
claimed.
The conclusion is reached that the online context questionnaire for
4EP students contains personal data, it is not anonymous, it is not justified because
It must not be anonymous, having been anonymous in the past, and it does not have an information clause
data Collect.
While the DE competences questionnaire is nominative, it contains the data
personal data, and it is deduced from the regulatory regulations that said identification must contain
However, such character of the CC is not inferred, which is also completed in
different times. Nor does it follow from its purpose that it must be nominative
when, they were anonymous, those carried out before the one carried out in the 2018 academic year-
2019.
However, that of the 2018-19 academic year that is the subject of a claim, the CC was nominati-
vo, assigning the access and user codes by the implanted system itself. It is not indicated
ca in no section of the current regulations that the CC must be nominative or have
o The surveyed student must be identified, thus, the identity of the students who meet
The questionnaire does not appear as necessary in any regulation, nor is it justified in
relationship with the purpose for which the data is intended, being possible to obtain the same purpose
purpose without processing the personal data of the students, that is, without completing the
Name and surname the questionnaire.
III
The defendant collected information associated with some data and saved it in her
systems for the realization of indicators, which according to the foregoing do not
san from the questionnaire author identification. Having collected and processed said data
It involves carrying out treatments with specific personal data that are not necessary.
years in terms of the constancy of identifying personal data, and therefore ex-
tramuros of legality in terms of data protection, which does have the proof of ED.
As an example, it should be noted that the statistical analyzes of the group at the center or at the national level
nal must not be correlated with the identified or identifiable author of the questionnaire.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 27
27/36
Regarding the manifestation of and the claimed that “ although the survey is not
anonymous, the personal data of the same are pseudonymised, that is, they cannot
be attributed to an interested party without using additional information ”, the aforementioned Regulation extends
their protection, as established in article 1.2, of the rights and freedoms
fundamental rights of natural persons and, in particular, their right to the protection of
personal data, defined in its article 4.1 as “ all information about a person
identified or identifiable physical ("the data subject"); identifiable natural person
any person whose identity can be determined, directly or indirectly, in particular
by an identifier, such as a name, an identification number, data
location, an online identifier or one or more elements of the identity
physical, physiological, genetic, psychic, economic, cultural or social of said person . "
Therefore, the respondent is charged, in general, especially the questionnaire
context of the 2018-2019 academic year carried out with personal data of 4EP students, the
commission of the infringement of article 5.1.a) of the RGPD, which indicates:
"The personal data will be:
a) treated in a lawful, loyal and transparent manner in relation to the interested party ("lawfulness,
loyalty and transparency ");"
The infringement connects with the assumptions in which the various bases are determined
legitimate are contained in article 6 of the RGPD which is entitled “ Legality of the treatment ”, and that
indicates:
1. The treatment will only be lawful if at least one of the following conditions is met.
nes : ”, mentioning those that serve this purpose.
In this case, there is no need for such questionnaires to be associated
to the student who completes them, which must be nominative, and the norm does not indicate that it affects
the student or has to contain their data. This applies to the entire questionnaire in general,
proving that there is no legitimate basis for the treatment carried out.
As an applicable general rule, data should only be collected for specific purposes.
cos, and legitimate and explicit purposes. This prerequisite involves analyzing whether the personal data
intended are in fact necessary and have a reason to be for the treatment
pursued, in this case the preparation and assessment of the CC The specification of the purpose
data processing analyzed current regulations and purposes of the treatment of CC
does not result in the use of personal data to fulfill the purpose for which
it appears designated in the LOE and concordant norms.
If the purposes of the questionnaire treatments can be achieved without treatment
tar personal data, the treatment carried out with said data in addition to being demonstrated not
If necessary, it follows that it does not have a concrete legitimate basis, considering that the
processing of personal data has an impact on the fundamental rights of the student,
in terms of personal data and privacy. So if the same purpose can be
achieved without processing the data, if it is not derived from the current regulations to be processed,
there is a legal basis to process them.
IV
For treating in the same questionnaire, the data of "s exo" : with the options " boy" ,
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 28
28/36
" Girl" , and " other options" the violation of article 5.1.a) of the RGPD is imputed,
Considering data of a special category to be related to the " data relating to
sexual life or sexual orientation of a natural person ”, which has no basis
to be treated as it has been in the CC questionnaire, by introducing in the
question: sex: boy, girl, a third with the selection of “other options”.
The claimed does not detail what this option refers to, which is intended for
socioeconomic questionnaires accompanying the evaluation test of
diagnosis where knowledge and skills are valued. The ED tests are
nominative, those of the CC of the year 2018-2019 that are denounced were also denounced, without
inform the parents of the data processing and the questionnaires do not contain
informative clauses that must contain the aspects and purposes of the data for the purposes
informative and exercise of rights.
These articles point out:
5 “ 1. The personal data will be:
a) treated in a lawful, loyal and transparent manner in relation to the interested party ("lawfulness,
loyalty and transparency ");"
9. 1. The processing of personal data that reveals ethnic origin is prohibited
or racial, political opinions, religious or philosophical convictions, or affiliation
union, and the treatment of genetic data, biometric data aimed at identifying
uniquely to a natural person, data related to health or data related to life
sexual or sexual orientation of a natural person.
9.2. Section 1 will not apply when one of the circumstances occurs
following:
a) the interested party gave their explicit consent for the processing of said data
personal with one or more of the specified purposes, except when the Law of the
Union or the Member States establish that the prohibition mentioned in the
paragraph 1 cannot be lifted by the interested party; "
Adding article 9.1 of the LOPDGDD “For the purposes of article 9.2.a) of the
Regulation (EU) 2016/679, in order to avoid discriminatory situations, the only
consent of the affected party will not be enough to lift the prohibition of data processing
whose main purpose is to identify their ideology, union affiliation, religion, orientation
sexuality, beliefs or racial or ethnic origin. "
It is recalled that the option present in the context questionnaire was " sex" , in addition
from the boy-girl, " other options ." This is a question included in ANNEX ONE of the
Royal Decree 1058/2015 and in the resolution of 03/30/2016, recalling that the
possibility for the Autonomous Communities to “ Include other questions in each questionnaire in addition to the
referred to in the second article of this resolution. However, you cannot add options
responses other than the questions that appear in ANNEX ONE of the
Se resolution. Existing the possibility of introducing new ones. This regulation provides for
ANNEX ONE: “Questions and answer options that must be included in the
given in each of the questionnaires “ :” The questions and the response options required
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 29
29/36
must be included in each of the questionnaires defined in the section
previous faith are those indicated in ANNEX I of this resolution "
In the first place, the model questionnaire created by the respondent is out of the
established by regulation by the model of ANNEX ONE of the resolution of
03/30/2016 that does not include said term.
It is observed that within sex the option given of “ other options” is not related.
nes ”, since it does not correspond to the sex of the student determined biologically, but
that would be incardinated in the question of gender identity that is introduced without explanation
in the questionnaire.
Gender refers to the social and cultural construction that defines the different characteristics
emotional, affective, intellectual characteristics, as well as the behaviors that each individual
society assigns as its own and natural to men or women, but there may be
women who do not identify with these characteristics of men and women and thus, apart from the
male and female there would be other genders: trans, intersex, non-binary gender, pangéne-
ro, etc. In this way, there are as many genders as identities, and therefore as many identities.
gender des as people.
Regarding the specific term " gender identity ", the RGPD does not make any allusion.
On the other hand, " sexual orientation" is the affective, romantic, sexual and psychological attraction.
that the person feels in a sustained way over time (Wikipedia) and it is how
describes different to gender identity.
The Universal Declaration of Human Rights, the International Covenant on Rights
Civil and Political Rights and the International Covenant on Economic, Social and Cultural Rights
include in their guarantees on non-discrimination, lists of prohibited grounds of
discrimination. Those lists do not explicitly mention sexual orientation or identity
gender, but conclude with the expressions " any other condition" or " any other
social condition ”. The use of these expressions shows that the intention was that these lists
were open and illustrative; In other words, the grounds of discrimination are not
closed.
It is clear and corroborated that sexual orientation and gender identity are two aspects
different aspects. In its jurisprudence, general observations and final observations, the
United Nations treaty bodies have consistently held
that sexual orientation and gender identity are prohibited grounds of discrimination
nation under international law. Furthermore, the procedures
Special members of the Human Rights Council have recognized the discrimination that exists
due to sexual orientation and gender identity.
In the same sense, various mechanisms for the protection of Human Rights
At the international level, like the Committees, they have affirmed that States have an obligation
to protect people from discrimination because of their sexual orientation. This position
tion is reflected in decisions of the Human Rights Committee - (Toonen v.
Australia 1994) and in general comments of the Committee on Economic Rights, So-
of the Committee on the Rights of the Child, the Committee against Torture, the
mite for the elimination of discrimination against women. For example in your observation
In general, the Committee on Economic, Social and Cultural Rights points out that States part
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 30
30/36
you must be satisfied that a person's sexual preferences are not a
obstacle to realizing the rights recognized by the covenant. Gender identity
it is also recognized as a prohibited ground of discrimination. The Rights Committee
of the Child has interpreted that the right to non-discrimination in Article 2 of the Convention
Information on the Rights of the Child includes sexual orientation and gender identity.
The CC that was made in February 2019, according to the claimed, is about complying with the
mandate contained in legal precepts to guarantee the effective integration of
the gender perspective in the ordinary activity of public powers “ including
systematically the gender variable in statistics, surveys and data collection that
carry out ”, action that, is indicated in article 19 of Law 17/2019 of 4/04 of equal-
between men and women that indicates:
The Public Administrations of Navarra, to guarantee the efficiency in the incorporation
tion of the gender perspective in their ordinary activity, they must:
a) Systematically include the gender variable, collecting the different categories, in
all the statistics, surveys and data collection they carry out.
b) Establish new gender indicators that allow a greater knowledge of
differences in values, roles, situations, conditions, aspirations, and
the needs of women and men, and their manifestation and interaction in the reality that
should be analyzed, and included in statistical operations.
c) Carry out samples large enough so that the various variables
included can be analyzed according to the sex variable, and treat the available data from
so that the different situations and needs of women and
men in the various fields of action . "
As can be seen, the aforementioned reference regulation that is based on the ANNEX
ONE, it refers exclusively to the variable " sex " exclusively differentiating between
boy-girl.
The introduction of said gender identity identifying its owner, would have to
be carried out in any case, when there is a relationship between what is asked, for some purpose
you want to obtain for which the data should be processed, without trying to collect data by
have them, without specific purpose, and in this case, the survey was of a socioeconomic and
family, without any aspect of the valuations referring to the gender issue, nor
studies or analyzes this aspect, so it makes no sense to establish a single question of
that scope, without connection to the rest of the issues. In that sense, it is not appreciated
need in the treatment of that option when carrying out the questionnaire.
Likewise, for statistical purposes, Spanish regulations maintain, as does the
most European countries, the binary model of sex: male and female, which appears
normative level in article 170 of the Decree of 11/14/1958 approving the
Regulation of the Civil Registry Law. In this case, in addition, the possibility of introducing
in the questionnaires the variable " other options " in " sex " does not correspond to this
notion and lacks in our legal system the necessary legal foundation.
In the opinion of the Agency, the exception provided for in letter j), as the treatment
necessary for statistical purposes, it is not applicable, since it requires that it be
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 31
31/36
provided for in the law of the Union or of the Member States, which must be proportional to the
objective pursued, respect essentially the right to data protection and establish
adequate and specific measures to protect the interests and fundamental rights of the
interested party, and the aforementioned regulations only contemplate the variable “ sex ”.
In any case, here a questionnaire is presented in which the student, although not
citing their sexual orientation, it can be deduced that they do not feel like a boy or a girl, if they check other
options, an issue that can be considered related to sexual orientation, which is
usually develops in the norms in a unitary way, and in the background, to an issue that
It could be related to expressing their beliefs as gender identity is an issue.
internal function of each, as derived from the definition made by the Inter-American Committee
rich in Human Rights in compliance with resolution AG / RES. 2653 (XLI-O / 11):
Human Rights, Sexual Orientation and Gender Identity, 04/23/2012 that defines it
as:
“ Gender identity is the internal and individual experience of gender as each
person experiences it deeply, which may or may not correspond to the assigned sex.
the moment of birth, including the personal experience of the body (which could
overturn the modification of appearance or bodily function through medical techniques,
surgical or other types, provided that it is freely chosen) and other express-
gender influences, including dress, speech, and manners. "
That is, he is questioning himself about his felt sex, with which he identifies, if he co-
affects the assigned at birth: woman or man, or "others", when their felt sex, with the
that is identified, does not coincide with the one assigned at birth, that is out of character and purpose
of the educational context questionnaire as it is not oriented in that sense and it should not be
force minors or any other person to express or testify about their beliefs
personal and intimate relationships. Said prohibition finds its foundation, just as
points out the transcribed precept, in avoiding discriminatory situations, such as those that could
occur when there is a public record in which the sexual orientation of the
people or collection of the gender identity of various groups without a purpose
determined or without legitimate basis, or beliefs.
In accordance with the aforementioned precept, the general rule is the prohibition of treatment
of said data, unless any of the exceptions established in its
section 2.
The provision of information from the questionnaire was mandatory, not being able to answer
to all questions. In any case, it should be clearly informed about it
thus being indicated in the data collection systems.
The violation of article 5.1.a) of the RGPD in relation to
9.1 of the RGPD and 9.1 of the LOPDGDD.
V
Regarding the questionnaire, it does not contain any informative clause of protection of
data.
No information has been contained or given to students, parents / parents
on the completion of said questionnaire.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 32
32/36
Considering the prior declaration of infringement of article 5.1. a) of the GDPR based-
given in the absence of a legitimate basis for the treatment of CC of 4EP students , since
effects of analyzing the behavior of the defendant that, in this case, data were collected
coughs of a personal nature for all students in the course.
As soon as personal data is collected, it means that it was not contained in
the same information on the purpose, legitimate basis and exercise of rights of the students
us, as it was not included in the questionnaire, and it is not verified that the information was given
a, parents / guardians on the completion of said questionnaire.
In this case, it was possible to know who each of the questionnaires corresponds to by
have associated user and password data, identifiable since they were assigned
by the directors of the centers.
The information of the collection and the transparency in said collection and treatment is
a principle established by the RGD in articles 12 and 13. These elements, by themselves
They are not sufficient to legitimize the processing of personal data, but they are a specific condition
encial to guarantee the legality of the treatment.
To be valid, the treatment must meet both extremes, be lawful, loyal and transparent.
rent supported by a legitimate basis and also be informed at the time it is reported
They take the data from the extremes indicated in articles 12 and 13 of the RGPD. Also the
Violations of these principles are independent.
The complained party breaches the provisions of article 13 of the RGPD that indicates the Information
information that must be provided when the personal data is obtained from the interested party:
“ 1. When personal data relating to him are obtained from an interested party, the
responsible for the treatment, at the time these are obtained, will provide you with all the
information listed below:
a) the identity and contact details of the person in charge and, where appropriate, of their representative;
b) the contact details of the data protection officer, if applicable;
c) the purposes of the treatment to which the personal data are destined and the legal basis of the
treatment;
d) when the treatment is based on article 6, paragraph 1, letter f), legitimate interests
of the person in charge or of a third party;
e) the recipients or categories of recipients of the personal data, if applicable;
f) where appropriate, the intention of the person responsible to transfer personal data to a third country or
international organization and the existence or absence of a decision on the adequacy of the
Commission, or, in the case of transfers indicated in articles 46 or 47 or article
49, paragraph 1, second paragraph, reference to adequate or appropriate guarantees and to
means to obtain a copy of these or to the fact that they have been loaned.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 33
33/36
2. In addition to the information mentioned in section 1, the data controller
will provide the interested party, at the time the personal data is obtained, the following
information necessary to guarantee fair and transparent data processing:
a) the period during which the personal data will be kept or , when this is not possible,
the criteria used to determine this period;
b) the existence of the right to request the data controller for access to the data
personal data relating to the interested party, and their rectification or deletion, or the limitation of their
treatment, or to oppose treatment, as well as the right to data portability;
c) when the treatment is based on article 6, paragraph 1, letter a), or article 9,
section 2, letter a), the existence of the right to withdraw consent in any
moment, without affecting the legality of the treatment based on the prior consent
upon withdrawal;
d) the right to file a claim with a supervisory authority;
e) if the communication of personal data is a legal or contractual requirement, or a requirement
necessary to sign a contract, and if the interested party is obliged to provide the data
personal and is informed of the possible consequences of not providing such data;
f) the existence of automated decisions, including profiling, to be
referred to in article 22, paragraphs 1 and 4, and, at least in such cases, significant information
on the applied logic, as well as the importance and expected consequences of said
treatment for the interested party.
3. When the person responsible for the treatment plans the subsequent treatment of data
personal data for a purpose other than that for which they were collected, will provide the
interested party, prior to said further processing, information on that other purpose and
any additional pertinent information pursuant to section 2.
4. The provisions of paragraphs 1, 2 and 3 shall not apply when and to the extent that
that the interested party already has the information. "
In the context of the information provided to children or their legal representatives
Welsh, special emphasis should be placed on the use of short notices in plain language
cillo, concise and didactic of easy understanding. A short notice will contain the information
basic training that will be communicated when collecting personal data directly from the
resado or third parties (articles 10 and 11). This notice will be accompanied by a further notice
taut, perhaps a hypertext link, which will contain all the pertinent details. The informs-
tion will (always) be communicated to legal representatives and children who have the
required city
SAW
Article 83.5 a and b of the RGPD, considers that the infringement of "the principles
basic to the treatment, including the conditions for consent under the
Articles 5, 6, 7 and 9 "and of " the rights of the interested parties according to Articles 12 to 22;
is punishable, in accordance with section 5 of the aforementioned article 83 of the aforementioned
Regulation , with administrative fines of € 20,000,000 maximum or, in the case of
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 34
34/36
a company, of an amount equivalent to a maximum of 4% of the turnover
Global annual total for the previous financial year, opting for the highest amount . "
In addition, article 83.7 of the RGPD indicates:
“ Without prejudice to the corrective powers of the control authorities under the
Article 58 (2), each Member State may lay down rules on whether it can, and
To what extent, impose administrative fines on state authorities and public bodies?
established in said Member State "
The Spanish legal system has chosen not to sanction with a fine the
public entities, as indicated in article 77.1. c) and 2. 4. 5. and 6. of the LOPDDGG:
" 1. The regime established in this article shall apply to the treatments of which
are responsible or in charge:
c) The General Administration of the State, the Administrations of the communities
autonomous and the entities that make up the Local Administration.
2. When the managers or managers listed in section 1 commit
any of the infractions referred to in articles 72 to 74 of this organic law, the
competent data protection authority will issue a resolution sanctioning
the same with warning. The resolution will also establish the measures that
It is appropriate to adopt so that the conduct ceases or the effects of the infraction that are
would have committed.
The resolution will be notified to the person in charge of the treatment, the body of which
hierarchically depends, where appropriate, and those affected who had the status of
interested, where appropriate.
4. The resolutions that
fall in relation to the measures and actions referred to in the sections
previous.
5. They will be communicated to the Ombudsman or, where appropriate, to similar institutions of
the autonomous communities the actions carried out and the resolutions dictated to the
under this article.
6. When the competent authority is the Spanish Agency for Data Protection, this
will publish on its website with due separation the resolutions referring to the
entities of section 1 of this article, expressly indicating the identity of the
responsible or in charge of the treatment that had committed the infringement . "
Article 58.2 of the RGPD indicates: ” Each control authority will have all the
following corrective powers listed below:
b) sanction any person responsible or in charge of the treatment with warning
when the processing operations have infringed the provisions of this Regulation-
ment;
d) order the person in charge of the treatment that the operations of
processing are in accordance with the provisions of this Regulation, where appropriate,
in a certain way and within a specified period ”.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 35
35/36
Therefore, in accordance with the applicable legislation and the criteria of
graduation of sanctions whose existence has been proven,
the Director of the Spanish Agency for Data Protection RESOLVES:
FIRST: IMPOSE THE DEPARTMENT OF EDUCATION OF THE GOVERNMENT OF
NAVARRA , with NIF S3100007H :
-
A warning sanction for an infraction of article 5.1.a) of the RGPD, of
in accordance with article 83.5 a) of the RGPD.
-
A warning sanction for an infraction of article 5.1.a) of the RGPD, in
in relation to article 9.1 of the RGPD and 9.1 of the LOPDGDD, in accordance with article
83.5 a) of the RGPD.
-
A warning sanction for an infraction of article 13 of the RGPD,
in accordance with article 83.5 b) of the RGPD.
SECOND: NOTIFY this resolution to the DEPARTMENT OF EDUCATION OF THE
GOVERNMENT OF NAVARRA .
THIRD: COMMUNICATE this resolution to the OMBUDSMAN , of
in accordance with the provisions of article 77.5 of the LOPDGDD.
FOURTH: In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the Director of
the Spanish Agency for Data Protection within one month from the day
following notification of this resolution or directly contentious appeal
administrative law before the Contentious-Administrative Chamber of the National Court, with
in accordance with the provisions of article 25 and paragraph 5 of the fourth additional provision
of Law 29/1998, of 07/13, regulating the Contentious-Administrative Jurisdiction, in the
period of two months from the day following notification of this act, as
provided for in article 46.1 of the aforementioned Law.
Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the final resolution through administrative channels if the interested party
expresses its intention to file a contentious-administrative appeal. If this is the
In this case, the interested party must formally communicate this fact by writing to the
Spanish Agency for Data Protection, presenting it through the Electronic Registry
of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through any of the
remaining records provided for in art. 16.4 of the aforementioned LPACAP. You will also need to transfer to
the Agency the documentation that proves the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following notification
of this resolution, would terminate the precautionary suspension.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 36
36/36
Mar Spain Martí
Director of the Spanish Agency for Data Protection
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es