APDCAT (Catalonia) - IAI 43/2022

APDCAT - IAI 43/2022
Authority:	APDCAT (Catalonia)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(a) GDPR Article 6(1)(c) GDPR Article 6(3) GDPR Article 15(1)(g) GDPR Article 86 GDPR Llei 19/2014, de 29 de desembre, de transparència, accés a la informació pública I bon govern
Type:	Advisory Opinion
Outcome:	n/a
Started:
Decided:
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	IAI 43/2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Catalan, Valencian
Original Source:	APDCAT (in CA)
Initial Contributor:	Michelle

The Catalonian DPA issued an opinion regarding a request for access to the investigation file of a bullying case in a school. The request was made by the parent of the minor who reported the bullying. The DPA held that the information should be disclosed to the extent that it balances the interests at stake.

English Summary

Facts

The data subject’s parent requested access to an anti-bullying investigation protocol. Specifically, the parent wanted to access the file containing the investigation conducted by the school (the controller) regarding a case of bullying against the data subject. This request was submitted following the controller's decision to close the case and conclude that there was no bullying (and no punishment) for the minors involved.

The controller denied the request because the requested information contained personal data of other minors and their parents, the school staff, and other documents containing sensitive data. Therefore, the disclosure of this information could affect the minor’s personality development in the future. The parent further complained to the Commission for the Guarantee of the Right to Access Public Information who requested the Catalonian DPA to formulate an opinion regarding this matter.

Holding

The Catalonian DPA started by analysing the legal basis for that processing according to Article 5(1)(a) of the GDPR. The supervisory authority stated that for Article 6(1)(c) GDPR to be applicable (processing needed for compliance with a legal obligation), the obligation must be established by law, as foreseen in Article 6(3) GDPR and its counterpart of the national law, Article 8 of Ley Orgánica 3/2018. On the other hand, Article 86 of the GDPR foresees the disclosure of personal data contained in public documents should be balanced with the right to data protection of others.

The DPA concluded that the information regarding the alleged bullying case was considered public (since the investigation and application of the anti-bullying protocol were performed by a public administration). Furthermore, the DPA stated that the parent had the right to access the information related to the minor as their legal representative.

In relation to the special categories of data within the documents requested, the regional law for transparency and public information access states that express consent from the data subject is needed otherwise the information cannot be disclosed. Therefore, in case the documents contain special categories of data of third parties, they could be disclosed to the parent of the data subject.

Concerning the information contained in the file about employees who participated in the investigation, the regional law for transparency and public information access allows disclosure only of their identification data (name, last name, role, grade, functions, and work contact details) unless there are circumstances that make it necessary a prevalence of the right to data protection which were not observed by the DPA in the present case. However, the authority highlighted the prohibition of disclosing other identification data such as ID number, and signature taking also into consideration the principle of data minimisation in relation to the purpose of the processing.

Subsequently, the DPA stated that other data (meaning data not related to the data subject, no special category of data, not related to public employees), but data from other school staff who are not public employees. The DPA considered that the function they perform is probably already known to the parent. Therefore, the affection for their privacy is low and the disclosure of their identification data is predominant.

In relation to data about other minors’ parents (alleged bullying students) and third parties, the DPA considered the motivation of the request for access which was “the option of complaining about the school's negligence in the investigation of the bullying case”. The DPA stated that accessing that information could be relevant since their testimonies could have influenced the school's decision about the existence or not of bullying, as well as giving the petitioner the possibility to challenge them according to Article 24 of the Constitution about the right to self-defence. Notwithstanding the above, the DPA decided that a preliminary hearing to determine if there were personal circumstances or reasons to justify the protection of their identity was necessary, as foreseen in the regional law. Otherwise their names, last names, and statements (no contact details) can be disclosed.

In conclusion, the DPA allowed access to the documents related to the data subject; the identification data of public employees involved in the investigation; the identification data of involved employees; and the names, last names, and statements by third parties unless the preliminary hearing shows a justification to limit their identification.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Catalan, Valencian original. Please refer to the Catalan, Valencian original for more details.

Ref.: IAI 43/2022











Report issued at the request of the Commission for the Guarantee of the Right of Access to the
Public Information in relation to the claim against the denial of access
in the file of the application of the protocol against school bullying in the

case of a minor.

The Commission for the Guarantee of the Right of Access to Public Information (GAIP) requests a
the Catalan Data Protection Authority (APDCAT) that issues a report on the
claim, presented in relation to the denial of access to the application file
of the protocol against school bullying in the case of a minor.


Analyzed the request, which is accompanied by a copy of the processed administrative file
before the GAIP, in accordance with the report of the Legal Counsel, I report the following:


Background


1. On September 13, 2022, a citizen sends a letter in which he requests the
following public information:

  "For all the above, exercising my right of access to public information I request that the
  charter school (...) provide me with the following documentation and information.
  • The integrity of the documentation that makes up the protocol application file

  against harassment and cyberbullying among peers in the case of my daughter(...).
  • Correspondence with the affected parties.
  • The minutes of the different interviews:
        o With harassed minors where it is explored what the harassment episodes consisted of
        with the corresponding collection of graphic evidence that supported his story.
        o With the harassing minors and their means of proof.

        or With the observers
        o With the families (persecutors and harassed) and provision of documentation/evidence.
  • The constitution of the assessment team, which lists its members
  considerations they arrived at.
  • Documentation and evidence on which the director of the center bases her assessments,
  listing the alleged cases of indirect harassment and because it does not mention the

  cyberbullying that my daughter was suffering (from which the management of the center was
  knowledgeable).
  • Because the protocol does not mention one of the minors reported as
  harasser, who is precisely the daughter of a center worker?
  • Because the protocol does not mention that a center worker and mother of one of
  the harassing girls (the one that the protocol does not include) approached my daughter in the street

  to try to persuade her to report the harassment situation.
  • Based on which information and arguments the school adds a child (PS) as a suspect
  stalker in the protocol. A child that neither the minor harassed nor the family had
  never mentioned



                                                                                              1/9 • If the defamatory letter signed by several fathers and mothers of the harassing families
  it was part of the protocol.
  • That we be informed, as stated in the valuation report, at what time and with whom

  means the evaluation of the protocol was communicated to the EAP. This statement is false, prove it
  of this is that Education has on several occasions reprimanded the school for not reporting to
  the EAP
  • That the management of the school clarify the statement "some specific moments are appreciated
  of harassment to EC and IV students, but not harassment as such".

2. On October 11, 2022, the requested Department issues a resolution by which it is

rejects the request for access to the requested public information. The rejection is
is based on "the fact that the requested documentation contains information on minors and
data considered particularly protected. In addition, the disclosure of this information may
affect the free development of personality in the future of these minors
of age. (Foundation of law 8).

3. On October 12, 2022, the applicant submits a claim to the GAIP
against the Department for the denial of access to the file relating to the harassment of the

his daughter In the claim, it states that you want access to:

  "Access to the documentation of the application file of the protocol against the
  harassment in the case of my daughter. (...)"

4. On October 25, 2022, the GAIP sends the claim to the Department requesting
the issuance of a report on which to base their positions, as well as the complete file
regarding the request for access to public information and the identification of third parties

people who are affected by the requested access. It is not included in the documentation
sent the corresponding report from the Department or the complete file related to the
request for access to information..

5. On October 25, 2022, the claimant sent an email to the GAIP where
declares, in relation to his claim, that it is not his intention to have access to data
personal and much less if it is the data of minors. In this sense requests that the
information is provided to you in an anonymized manner.


6. On November 3, 2022, the GAIP requests this Authority to issue the report
provided for in article 42.8 of Law 19/2014, of December 29, on transparency, access to the
public information and good governance, in relation to the claim presented.


Legal Foundations


                                                 I

                                               (...)

                                                II


The claim is filed against the denial by a Department of access to the
documentation of the application file of the protocol against harassment and cyberbullying
                                                                                               2/9 between equals, relating to the claimant's daughter. Point out that the object of the claim is
coinciding with that of a previous claim, which was the subject of IAI report 37/2022
of this Authority, dated September 30, 2022.


In the present claim, the file is not included among the documentation sent by the GAIP
complete application of the claimed protocol. It only states, provided by the claimant himself,
the protocol application assessment report signed by the director of the center. Although not
if the complete file is available, it can be expected that it will contain personal data
both of the claimant's daughter and of the other minors involved, as well as of their parents and
those responsible for processing the file, among others. To the extent that this

information contains personal data, the RGPD will apply.

Article 4.2) of the RGPD considers “treatment”: any operation or set of
operations carried out on personal data or sets of personal data, either by
automated procedures or not, such as collection, registration, organization, structuring,
conservation, adaptation or modification, extraction, consultation, use, communication by
transmission, diffusion or any other form of enabling access, comparison or interconnection,

limitation, suppression or destruction."

The RGPD provides that all processing of personal data must be lawful (Article 5.1.a)) and, in
this sense, establishes a system of legitimization of data processing that is based
in the need for one of the legal bases established in article 6.1 to apply.
Specifically, section c) provides that the treatment will be lawful if “it is necessary for the
fulfillment of a legal obligation applicable to the person in charge of the treatment”.


As can be seen from article 6.3 of the RGPD and expressly included in article 8 of the Law
organic 3/2018, of December 5, on protection of personal data and guarantee of rights
digitals (LOPDGDD), data processing can only be considered based on
this legal basis of article 6.1.c) of the RGPD when so established by a rule with
rank of law


For its part, article 86 of the RGPD provides that "the personal data of documents
officials in possession of some public authority or public body or entity
private for the performance of a mission in the public interest may be communicated by
said authority, organism or entity in accordance with the Law of the Union or of them
Member States that apply them in order to reconcile public access to documents
officials with the right to the protection of personal data by virtue of this
Regulations."


Law 19/2014, of December 29, on transparency, access to public information and good
government (LTC), aims to regulate and guarantee the transparency of public activity.

Article 18 of the LTC recognizes the right of people to “access public information, a
referred to in article 2.b, in an individual capacity or in the name and representation of any person
legally constituted legal entity" (section 1).


Article 2.b) of the LTC defines “public information” as “the information prepared by
the Administration and what it has in its power as a result of its activity or
of the exercise of its functions, including that supplied by the other obliged subjects
in accordance with the provisions of this law".

                                                                                               3/9 For its part, article 53.1 of Decree 8/2021, of February 9, on transparency and
right of access to public information (RLTC), specific that it is public information subject to the

right of access "all the information, any data or documents that the administrations
public have prepared, possess, or can legitimately demand from third parties as a
consequence of their activity or the exercise of their duties."

The information available to the Department related to the case of alleged harassment
school of the claimant's minor daughter object of claim is information
public for the purposes of article 2.b) of the LTC and, therefore, remains subject to the provided access regime

in this regulation, which establishes, as a general criterion, that the right of access to the
public information can only be denied or restricted for express reasons
established by law (article 20 et seq. LTC).

Specifically, and with regard to the right to the protection of personal data, it is necessary to take into account that
established in articles 23 and 24 of the LTC, as well as the principles of the regulations for the protection of
personal data.



                                                III

The resolution of the Department of Education that denies access to the information subject to the

claim is based on the fact that the information contains special categories of relative data
to minors

Regarding the special categories of data, article 23 of the LTC establishes the following:

  "Requests for access to public information must be denied if the information
  that you want to obtain contains specially protected personal data, such as relatives
  to ideology, union membership, religion, beliefs, racial origin, health and life

  sexual, and also those relating to the commission of criminal or administrative offenses that are not
  lead to a public reprimand to the offender, unless the affected party expressly consents
  by means of a writing that must accompany the request."

In the event that the claimed file contains special categories of data of the daughter of
claimant, insofar as she is a minor and the claimant is the holder of the power
parental, it must be taken into consideration that article 15 of the RGPD recognizes the right of access to the

own personal information in the following terms:

   "1. The interested party will have the right to obtain from the person in charge of the treatment
   confirmation of whether or not personal data concerning you are being processed and, in such
   case, right of access to personal data and the following information:
   a) the purposes of the treatment;
   b) the categories of personal data in question;

   c) the recipients or the categories of recipients to whom they will or will be communicated
   communicated personal data, in particular recipients in third parties u
   international organizations;
   d) if possible, the expected retention period for personal data or, if not
   if possible, the criteria used to determine this period;


                                                                                               4/9 e) the existence of the right to request from the person responsible the rectification or suppression of
   personal data or the limitation of the processing of personal data related to
   interested, or to oppose said treatment;

   f) the right to present a claim before a control authority;
   g) when the personal data has not been obtained from the interested party, any person
   available information about its origin;
   h) the existence of automated decisions, including the creation of profiles, to which
   referred to in article 22, sections 1 and 4, and, at least in such cases, information
   significant about applied logic, as well as the importance and consequences
   provisions of said treatment for the interested party.

   2. (…)
   3. The person responsible for the treatment will provide a copy of the personal data object of
   treatment The person in charge may receive any other copy requested by him
   interested a reasonable fee based on administrative costs. When the
   interested party submits the request by electronic means, and unless this request is made
   that is provided otherwise, the information will be provided in an electronic format
   common use

   4. The right to obtain a copy mentioned in section 3 will not be negatively affected
   to the rights and freedoms of others.”

As this Authority has done on previous occasions (among others, in the IAI reports
9/2021, IAI 21/2021, IAI 51/2021 or IAI 3/2022, which can be consulted on the Authority’s website),
based on article 15 of the RGPD, the person making the claim has the right to know the direct information
about your person who is being treated by the Department and who is part of a file or

that is included in the documentation or information you request. And this includes (article
15.1.g) RGPD) the identification of the source of the information.

In addition, article 12.6 of the LOPDGDD provides that "the holders of parental authority may
to exercise in number and representation of minors under fourteen the rights of
access, rectification, cancellation, opposition or any other that could
match them in the context of this organic law".


By application of the aforementioned regulations, the person making the claim, to the extent that he is the owner
of parental authority, has the right to know the information about his minor daughter
dealing with the Department and that it is recorded in the file on the application of the harassment protocol
peer school, which is part of said documentation.

In the event that the file claimed contained data on other minors other than the daughter of

claimant, or other people who require special protection in accordance with the article
23 LTC, access to this information should be denied.


                                                IV


It is to be expected that the requested file also contains information relating to the authorities
or public workers who have intervened due to the functions assigned to them,
in its processing. With respect to this information, the forecasts of
article 24.1 of the LTC, which provides the following:



                                                                                               5/9 “1. Access to public information must be given if it is information directly
   related to the organization, operation or public activity of the Administration
   that contains merely identifying personal data unless, exceptionally,

   in the specific case the protection of personal data or other rights must prevail
   constitutionally protected.”

This article of the LTC allows access to the merely identifying data of people
that intervene due to their functions in the different procedures or actions
public works carried out by the Administration, unless specific circumstances arise
that justify the prevalence of the right to data protection of the person or persons

affected or other constitutionally protected rights.

Article 70.2 of the RLTC specifies what is meant by merely identifying personal data
in the following terms:

   "For the purposes of what is provided for in article 24.1 of Law 19/2014, of December 29, are
   personal data merely identifying those consisting of the first and last name, the

   position or position held, body and scale, the functions performed and the telephone and the
   addresses, postal and electronic, of professional contact, referring to the staff at the service
   of the public administrations, high-ranking officials and management personnel of the public sector of
   public administrations.

   In cases where the publication or access to an administrative document
   requires the identification of the author, the data of must be deleted, in particular

   location, the number of the national identity document or equivalent document and the
   handwritten signature

   If the signature is electronic, the electronically signed document must be published from
   so that it is not possible to access the properties of the electronic certificate used for the
   signature.


   Location data should be deleted in case it is not the data
   merely identifiers of the author in his position of position or staff in the service
   of public administrations."

With regard to the transcribed articles, facilitate the access of the person making the claim to the data
merely identification of the people who, in attention to the responsibilities or functions
that have been assigned, have participated in the application of the school bullying protocol between

equals in their daughter's school and/or in their control, in the terms indicated, a
a priori would not be contrary to the right to the protection of personal data. That, unless
exceptionally, in a specific case the protection of personal data must prevail or
other constitutionally protected rights, which is not included in the present case.

As indicated in article 70.2 of the RLTC, it is not relevant in these cases to facilitate
other identification data of employees or public positions - such as the ID number or the

handwritten signature - which may appear in the documentation subject to access, given that
these data, from the point of view of the principle of minimization (article 5.1.c) RGPD),
are unnecessary for the intended purpose, that is so that the citizen can identify them
authorities and the staff at the service of the public administrations that attend to him in his


                                                                                               6/9 performance before the Public Administration and/or under whose responsibility the
procedures


Consequently, the DNI number and the handwritten signature should be removed
authorities and public employees that may appear in the requested documentation.






                                                 v

With regard to the rest of the information that may be contained in the file claiming that it does not have the
consideration of special categories of data in terms of article 23 LTC will be required

apply article 24.2 of LTC according to which:

   "2. If it is other information that contains personal data not included in article 23,
   access to the information can be given, with prior reasoned weighting of the interest
   public in the disclosure and the rights of the affected persons. To carry out this
   weighting must take into account, among others, the following circumstances:


   a) The elapsed time.
   b) The purpose of the access, especially if it has a historical, statistical purpose or
   scientific, and the guarantees offered.
   c) The fact that it is data relating to minors.
   d) The fact that it may affect the safety of people.
   (...).”


First of all, it is necessary to make a consideration regarding the data that may be included in
the file, relating to the teachers, tutors or the director of the institute, for having intervened in the
processing of the file. Given that the school that processed the claimed file is
a concerted center, its workers will not, in principle, have the status of civil servants or
public employees In this case, the weighting of article 24.2 LTC must have in
consideration, on the one hand that the functions performed by these workers are, in
principle, the same as those that would correspond to the public employees in respect of which

article 24.1, provides, as has been explained, that access to your data must be given
identifiers, as well as the privacy expectations that these workers may have
regarding the actions carried out in the exercise of their functions. On the other hand, it is
it is likely that this information is already known to the claimant and therefore prejudices him that
can occur in their privacy must be considered minor. In attention to these
considerations, the weighting must be favorable to the right of access to identifying data
of these people.


Regarding the rest of the information that contains personal data of the claimant or his
daughter, the first element to be taken into consideration in the weighting of article 24.2 LTC is the
right recognized in article 15 RGPD, which as explained in the foundation IV thereof
report gives the claimant the right to know the information about his minor daughter
is being treated by the Department following the application of the school bullying protocol between
the same and that forms part of the claimed file.


                                                                                                7/9 The existence of this right, recognized by data protection regulations, is decisive
necessarily the weighting referred to in article 24.2 of the LTC in favor of access to
the data itself contained in the claimed documentation, which would include the data of the

his daughter

The right of access to one's own information also includes, among other aspects, the right to
know the origin of this information (Article 15.g) RGPD). In the accompanying writings
the claim, the person making the claim refers to the fact that interviews were carried out with the
parents of the allegedly harassing minors. In the event that the file states
information related to interviews or statements made by third parties such as

they could be the statements of other minors of the claimant's daughter or theirs
parents, from the perspective of article 24.2 of the LTC, and in relation to article 15.4 of
RGPD, it is necessary to consider whether the person claiming would have the right to know both the identity
of these people such as the statements made.

To this end, although article 18.2 of the LTC provides that the exercise of the right of access to the
public information "is not conditioned on the concurrence of a personal interest, nothing else

subject to motivation and does not require the invocation of any rule", know the motivation of the
request may be a relevant element to consider.

In accordance with the statements made by the person claiming in their claim
the purpose of the intended access is "to be able to prosecute the malpractice of the school (...) and of the
Educational inspection in the application of the anti-harassment protocol in my case
daughter".


In this sense, to know the origin of the information that affects the person making the claim and
his daughter may be relevant to be able to refute certain facts or situations described by
these third parties, to the extent that they have been able to influence the center's decision
school about the existence or not of signs of school bullying of the minor.

It should be borne in mind that in accordance with the provisions of article 24 of the Spanish Constitution,

all people have the right to obtain effective protection from judges and courts in the exercise
of their rights, as well as, among others, they have the right to use the evidentiary elements that
are relevant to your defense.

In this context, for the purposes of guaranteeing the appropriate exercise of the right to judicial protection
effective (Article 24 EC), it cannot be ruled out that the person claiming must be able to access
to that information that is necessary for the defense of their rights and interests, or

those of his minor daughter, including personal information. In this case, know which ones
people attribute to the minor daughter of the claimant and also to herself
facts and/or actions that would harm your interests, could be relevant to yours
right of defense

In addition, it cannot be ruled out, given the context in which the reported events took place, that the
identity of these people (or some of them), may be known by the person

claiming

From the point of view of the affected persons, disclose identity information
of these third parties who have been able to provide information about the person claiming and the
their daughter, it may affect them to the extent that they are people with

                                                                                               8/9 who, both they and their children, shared the school environment. The revelation of whatever they are
able to say or not say about the person making the claim, the daughter and the facts reported could end
negatively affecting the relationships that these people can still maintain.


For this reason, this Authority has noted the special relevance it has in these cases
comply with the hearing procedure provided for in article 31 of the LTC, and find out if they exist
personal circumstances or reasons that would justify preserving their identity.

As this Authority has previously highlighted, for the purposes of limiting it
access, it is necessary to prove specific circumstances that allow us to appreciate a clear damage due to the fact

that the person making the claim can access their identity or other personal data
people Thus, for example, the mere manifestation of the
refusal of the affected person to access their data.

In attention to the concurrent circumstances in the present case in view of the information of
what is available, and without prejudice to what may result from the aforementioned hearing procedure, a
priori can be identified with the name and surname of the third parties who have facilitated

information about the claimant and his daughter, which may be included in the file, as well
as the information provided.

However, other identifying data of these people should be deleted (numbers
of ID, signature) and contact details, in accordance with the principle of data minimization
(article 5.1.c) RGPD), to be irrelevant for the intended purpose of the access.



conclusion

The data protection regulations would not prevent the claimant from accessing the
information contained in the application file of the anti-bullying protocol,
relating to his person and his minor daughter to the extent that he is the holder of the power

parental There would also be no problem in simply facilitating access to the data
identifiers of public employees or public officials in charge of the processing of
the harassment file, nor of the teachers, tutors or the headmistress of the center where they went
produce the facts, which may be contained therein. Likewise, access to the data could be facilitated
IDs of the people who have provided information about the claimant's daughter and the
information that they contributed to the file, unless following the hearing procedure
there is some reason that justifies its limitation.


In the event that the file contains special categories of data from other different people
of the claimant's daughter access to this information should be denied.



Barcelona, November 24, 2022








                                                                                                 9/9