AEPD (Spain) - EXP202205850

AEPD - EXP202205850
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	n/a
Parties:	De La Guardia Civil
National Case Number/Name:	EXP202205850
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish DPA found a violation of Article 5(1)(c) GDPR and issued a reprimand against the Civil Guard for sending a message to the shared corporate email communicating the need for the data subject to attend the psychology office for evaluation.

English Summary

Facts

The data subject is a civil guard who took medical leave due to work stress. During the leave, they were warned by a colleague about a message sent by the Civil Guard Command Post (the controller) to the shared corporate e-mail asking them to return their weapons. The message also stated that the data subject needed to attend the psychology office for evaluation. The data subject then filed a complaint with the Spanish DPA claiming to have had their privacy violated.

During the proceedings, the controller alleged that, within the body of the email, there was no reference to the data subject's diagnosis or any other health data. It argued that, since the data subject was absent, the medical leave was known by the other members of the Civil Guard regardless of formal communication. Furthermore, it stated that this information was necessary in order to ensure that the superior officer did not appoint services to the data subject until they were discharged from leave.

The controller also claimed that the psychological assessment is a common procedure and that it is necessary to verify whether the civil guard is in a position to resume their duties. In addition, the controller sought to rely on asigned Informed Consent Form (“ICF”) authorizing the processing of their medical data, but the data subject argued that it was inaccurate, not very transparent and did not comply with Article 13 GDPR. The AEPD also observed that the ICF alluded to the repealed Organic Law 15/1999 (pre GDPR).

Holding

The AEPD highlighted that, although it might be necessary to inform the data subject's superior officer about the leave, it is absolutely unnecessary to add specific medical data, such as the appointment at the psychology office. it would have been enough to inform that the data subject would not be available for service due to a medical leave, without explicitly mentioning the reason for that medical leave or the tests that the data subject must undergo.

For these reasons, the AEPD held that the disclosure of the information that the data subject "should report to the Psychology Office of the Command for the purpose of examination" was excessive for the intended purpose of processing as per Article 5(1)(c) GDPR and Recital 39 GDPR.

The AEPD issued a reprimand on the controller.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/9










     File No.: EXP202205850



               RESOLUTION OF SANCTIONING PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following


                                  BACKGROUND

FIRST: A.A.A. (hereinafter, the claiming party) dated May 12, 2022
filed a claim with the Spanish Data Protection Agency. The

claim is directed against D.G. OF THE CIVIL GUARD with NIF S2816003D (in
forward, DGGC). The reasons on which the claim is based are the following:

The claimant is a civil guard. By decision of a superior, an Information is opened
Reserved to clarify what happened in a performance carried out by him in the
exercise of their functions. On 10/26/2021, within the aforementioned procedure,

the claimant's statement is taken, he is informed of his right to listen to an audio
provided by the complainant (Criminal proceedings for an alleged crime of abuse of
authority, archived) and shows that recording to another component of the
*** POSITION 1, (...), in case you recognize the voice of the complaining party.
On 12/17/2021, it requests information on whether the aforementioned has been shown

recording to (...) as a voice expert. Noting that, if not,
understands that said treatment would not be legitimized and that said action is not
would have been carried out in accordance with arts. 5.1.f) and 32 of the GDPR, a request that is
denied through Resolution dated 12/24/2021, not having the condition of
interested in Reserved Information, not being able to provide data or information

about it. Presents an Appeal against said resolution and it is dismissed
again through Resolution dated 03/14/2022 for the same reason.

On the other hand, he alleges that, being on sick leave due to work stress, he receives a call
from a colleague of ***POINT.1, who has access to the corporate mail of the
position, and informs him that a file has been opened for anomalous conduct to

the withdrawal of weapons and is summoned for an act of delivery of weapons, as regulated
in the Weapons Regulation and Law 4/2015 for the protection of Citizen Security.
Provides Official Letter dated 03/11/20XX on the subject: "Report on Communication Withdrawn
of Armament of a civil guard".
It considers that this form of communication was already sanctioned by this Agency in the

procedure PS/00384/2020, not having established customization measures
of communications, revealing data related to your health to all staff of the
Since they have general access to said corporate mail.
It also states that the act of handing over the weapons took place in an office
open to the public for the processing of weapons licenses in general in the town

of ***LOCATION.1, exposing his personal image both to the three agents who
serve the public, such as the agents who go there and civilian personnel who carry out their
administrative procedures, which it considers to be in breach of legal precepts before
cited.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/9








On 01/31/2022, the firm was presented with an Informed Consent that
alludes to the repealed L.O. 15/1999, which, in the claimant's opinion, is inaccurate, little
transparent and does not comply with the provisions of art. 13 of the GDPR.

In addition, it alleges that on 02/09/2022, it requested access to data and information from
interest for your defense regarding the Confidential Information opened against your person
and to know if it complies with the data protection regulations and the National Scheme
of security.

Along with the notification is provided:

-Office of summons for appearance by instruction of a reserved information.
-Certificate of the events that occurred on ***DATE.1 at (...) hours
-Complaint filed by B.B.B., a retired civil guard, against the claimant, in
the one that says to provide a CD with a recording in relation to the events that occurred on the day
***DATE.1 at (...) hours, and a photograph showing the license plates of the

official vehicles. He states that he received by WhatsApp, sent by a relative, the
audio file.
-Writ of provisional dismissal of the Court (...) of ***LOCATION.2.
-Writ of refusal of information for not being an interested party in the information
reserved.
-Written informed consent to access and use clinical information

that is in the file of the complaining party for the processing of a
disability application.

SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in

forward LOPDGDD), said claim was transferred to the DGGC, so that
proceed to its analysis and inform this Agency within a month of the
actions carried out to adapt to the requirements established in the regulations of
Data Protection.


The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of
October 1, of the Common Administrative Procedure of the Administrations
Public (hereinafter, LPACAP), was collected on 06/14/2022 as stated in the
acknowledgment of receipt in the file.

On 06/27/2022, this Agency received a written response indicating:


"The General Directorate of the Civil Guard has protocolized as a measure, both for
citizens as well as for the civil guards themselves, who, when there is a
medical leave with a diagnosis of mental illness, the withdrawal of the
weapons, both official and private, that in his capacity as a member of the Armed Forces

and State Security Bodies of which they may be in possession.
With the foregoing, an attempt is made to prevent the state of mental alteration that he presents
causes both harmful actions against third parties and self-injurious behaviors of a nature
suicidal, which redounds to the benefit not only of society, but also of the
own member of the Body as a human being.


In order to put the foregoing into effect in the case at hand, an email was sent
email on October 13, 2021, from the Medical Service of the Command


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/9








from ***LOCATION.1 to ***COMPANY.1 and ***POINT.2, with the following
text:


       <<Today the assistance service has learned
       of this Unit, of the medical leave related to the Civil Guard D.A.A.A.
       (XX.XXX.XXX), bound for ***POINT.1.
       Likewise, it is agreed that said Civil Guard must appear at the
       Office of Psychology of the Command to the object of recognition on the day
       11/18/XX at 09:00.

       Proceed to the withdrawal of official and private weapons possessed by said
       Civil Guard>>

In the text of said email, as can be seen, no reference is made
any diagnosis or other health data. The fact that it is mentioned that he is of

low for the Service is nothing new, since the Hierarchical Superior who
receives already knows this, since the Civil Guard itself has to communicate it to
effects of not being named Service until registration occurs (regardless of the
type of sick leave) as in the case of any worker, an issue that will be
known by the rest of the classmates by the simple observation of his absence in the
I work without the need for you to communicate anything.


In this way, it cannot be accepted, as indicated by the claimant, that
there has been indiscriminate communication of their situation in the absence of adoption
of security measures. The only thing that has been communicated is the administrative fact
of your Temporary Work Incapacity, which is necessary for the name of the person to know

the daily service, not to count on it.

We understand that the necessary confidentiality measures have been kept in the
as possible, knowing only those who had a “need to know” and
insofar as they had it."


THIRD: On August 12, 2022, in accordance with article 65 of the
LOPDGDD, the claim presented by the claimant party was admitted for processing.

FOURTH: On October 25, 2022, the Director of the Spanish Agency for
Data Protection agreed to initiate disciplinary proceedings against the claimed party,

for the alleged infringement of Article 5.1.c) of the GDPR, typified in Article 83.4 of the
GDPR.

Once the Initiation Agreement was notified, the DGGC submitted a written statement of allegations, in which
synthesis stated:


-That the reason for the communication made by email, sent by the
Medical Service of the Command of ***LOCATION.1 and the ***COMPAÑÍA.1 and the
***POINT.2, it was not only to notify who appoints daily service the medical leave of
the complaining party, in order that no service be indicated, as indicated in the

response to the transfer of the claim that the AEPD made at the time, in the
which textually specify:



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/9








 "In the text of said email, as can be seen, no reference is made
any diagnosis or other health data. (...) The only thing that has been communicated is the
administrative fact of your Temporary Work Incapacity, which is necessary for

know who appoints the daily service, so as not to count on him”,

but also, the purpose of said email was to indicate that "the claimant
must go to the psychology office on the mentioned date to be submitted to the
mandatory recognition according to internal procedures", because they do not understand that
"There is no other way to let you know but to send a communication to your destination at

in order to be informed of it", given that "according to article 23 of the Organic Law
11/2007 of October 22, Regulating the Rights and Duties of the Members of
the Civil Guard, nominated for psychophysical examinations, the Civil Guards have the
obligation to submit to the necessary psychophysical examinations to
determine their fitness for service.


       In this regard, this Agency observes that the purpose
       initial communication of an absence due to IT, for the purpose of not appointing
       service to the person who is on leave, with the addition in the letter of
       allegations, also communicate in the same email that
       must notify the civil guard on discharge of their obligation to

       undergo an examination, "since according to article 23 of the Law
       Organic 11/2007 of October 22, Regulating the Rights and Duties of
       the Members of the Civil Guard, nominated for psychophysical examinations, the
       Civil Guards have the obligation to submit to examinations
       psychophysical tests necessary to determine his fitness for service.


       This Agency does not share the criteria that said
       communication to the ***COMPANY.1 and the ***POINT.2, given that, the Law
       29/2014, of November 28, of the Civil Guard Personnel Regime
       indicates in its article 103: (the underlining corresponds to the AEPD)

       1. In the Health of the Civil Guard are included the medical services and the

       health inspection and will have the support of psychological care.

       2. Corresponds to the Health of the Civil Guard, regardless of the
       health benefits to which Corps personnel are entitled for their
       belonging to the Special Regime of the Social Security of the Forces
       Armed:

       a) Determine the existence of the precise psychophysical conditions for the

       admission to educational training centers and for the loss of status
       student, in accordance with the provisions of article 35.2 and article 48.1
       b).

       b) Carry out the follow-up and control of the temporary absences of the personnel of the
       Civil Guard Corps, and advise and report on this matter to the Chiefs

       unit, center or organism.

       c) Assess and confirm, where appropriate, temporary leave that have been
       issued by physicians unrelated to Body Health whose recovery
       has not occurred before the tenth day after they were issued.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/9








       d) Arrange that those who are on temporary leave be
       subjected to the psychophysical examinations deemed appropriate.

       e) Issue opinions directly or through medical-expert bodies,
       detailing in them the diagnosis of the disease or pathological process and the

       degree of disability that corresponds to determine the aptitude for the
       stakeholder service.

       f) Issue the mandatory opinions determined by the class legislation
       liabilities of the State, for the purpose of determining, where appropriate, in accordance with the
       established in article 98, the limitation to occupy certain destinations or

       the retirement pass as a consequence of the fact that the affected person is disabled
       totally for the performance of the functions of the Civil Guard.

       For the development of its powers, the Health of the Civil Guard may
       establish contracts or collaboration agreements with certain
       medical professionals or public or private entities.

       3. The services referred to in the first section of this article are
       authorized to access the reports and diagnoses related to the

       situations of temporary leave of the members of the Corps, in order to exercise the
       functions entrusted to them, with the limits established by the
       Current regulations regarding the treatment and protection of personal data
       staff.

       In accordance with section 3 of article 103 of the aforementioned legal text, the

       reports and diagnoses related to situations of temporary leave does not have
       to be known neither by hierarchical superiors nor by people
       in charge of setting daily the services to be performed by the staff
       assigned to the corresponding unit.

       Therefore, this Agency confirms the criterion that the summons to the Cabinet of
       Psychology is a piece of information that is not pertinent, adequate or necessary in communication

       made of the situation of temporary leave of the complaining party.

       It is considered more appropriate to make such a summons to the affected person
       directly, and not across your entire target drive.

FIFTH: On November 14, 2022, a resolution proposal was formulated,
proposing that the Director of the Spanish Data Protection Agency
impose on D.G. OF THE CIVIL GUARD, with NIF S2816003D, for an infraction of the

Article 5.1.c) of the GDPR, typified in Article 83.4 of the GDPR a penalty of
warning.

Notified of the resolution proposal, no allegations have been presented to it.


In view of all the proceedings, by the Spanish Agency for Data Protection
In this proceeding, the following are considered proven facts:


                                PROVEN FACTS


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/9








FIRST AND ONLY: It is proven that an email was sent on the 13th
October 2021, from the Medical Service of the Command of
***LOCATION.1 to ***COMPANY.1 and ***POINT.2, with the following text:

       <<Today the assistance service has learned

       of this Unit, of the medical leave related to the Civil Guard D.A.A.A.
       (XX.XXX.XXX), bound for ***POINT.1.
       Likewise, it is agreed that said Civil Guard must appear at the
       Office of Psychology of the Command to the object of recognition on the day
       11/18/XX at 09:00.
       Proceed to the withdrawal of official and private weapons possessed by said

       Civil Guard>>


                          FUNDAMENTALS OF LAW


                                           Yo
In accordance with the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter GDPR), grants each
control authority and as established in articles 47, 48.1, 64.2 and 68.1 of the
Organic Law 3/2018, of December 5, Protection of Personal Data and
guarantee of digital rights (hereinafter, LOPDGDD), is competent to

initiate and resolve this procedure the Director of the Spanish Protection Agency
of data.

Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions

regulations dictated in its development and, insofar as they do not contradict them, with character
subsidiary, by the general rules on administrative procedures."

                                          II
Article 5, "Principles relating to processing" of the GDPR establishes:


"1. Personal data will be:
(…)
c) adequate, pertinent and limited to what is necessary in relation to the purposes for which
that are processed ("data minimization");"

It must be clarified that this article does not limit the excess of data, but the need. Is

In other words, the personal data will be "adequate, pertinent and limited to the need",
for which they were collected, in such a way that, if the objective pursued can
achieved without excessive data processing, this should be done at all
case.


Similarly, recital 39 of the GDPR indicates that: "Personal data only
should be processed if the purpose of the processing cannot reasonably be achieved by
other media." Therefore, only the data that is "adequate,
relevant and not excessive in relation to the purpose for which they are obtained or processed”. The
categories of data selected for processing must be those strictly

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/9








necessary to achieve the stated purpose and the controller must
strictly limit data collection to information that is directly
related to the specific goal that is intended to be achieved.


In this case, the email sent by the Medical Service of the
Command of ***LOCATION.1 to ***COMPANY.1 and ***POSITION.2, in which
it is specified that the complaining party "should appear in the Cabinet of
Psychology of the Command to the object of recognition" contains excessive data
for the intended purpose.


Although it may be considered necessary, as stated by the DGGC, to send the
information of the claiming party's medical leave to his hierarchical superior, including
the fact that it is necessary to communicate, likewise, that it should be
proceed to the withdrawal of weapons, it is totally unnecessary to add medical data

specific, such as the appointment in the Psychology cabinet, since, to know that
the complaining party is not available for the service due to being in a situation of
Work Incapacity, it is not essential to explicitly cite the reason given
place to said medical leave or the tests that must be submitted.

From the instruction carried out in this proceeding it is concluded that the

DGGC has violated the provisions of article 5.1.c) of the GDPR, by sending an email
email to the unit of destination of the complaining party, in which, in addition to
communicate that you are on leave, which must be taken into account to
not assign him service, it is indicated that he must report to the psychology office,
This last fact is unnecessary to add.


                                           II
Article 83.5 of the GDPR, under the heading "General conditions for the taxation
of administrative fines”, provides:


Violations of the following provisions will be sanctioned, in accordance with the
paragraph 2, with administrative fines of maximum EUR 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for
the highest amount:


a) the basic principles for the treatment, including the conditions for the
consent under articles 5, 6, 7 and 9; (…)”

In this regard, the LOPDGDD, in its article 71 "Infractions" establishes that:


"The acts and behaviors referred to in sections 4,
5 and 6 of article 83 of Regulation (EU) 2016/679, as well as those that result
contrary to this organic law”.

For the purposes of the limitation period, article 72 "Infractions considered very

serious” of the LOPDGDD indicates:

"1. Based on what is established in article 83.5 of Regulation (EU) 2016/679,
are considered very serious and will prescribe after three years the infractions that

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/9








a substantial violation of the articles mentioned therein and, in particular, the
following:


a) The processing of personal data in violation of the principles and guarantees
established in article 5 of Regulation (EU) 2016/679. (…)”

                                          IV.
Article 83 paragraph 7 of the GDPR provides the following:


Without prejudice to the corrective powers of the control authorities under
of Article 58(2), each Member State may lay down rules on whether
can, and to what extent, impose administrative fines on authorities and bodies
public establishments established in that Member State.”


Likewise, article 77 “Regime applicable to certain categories of
responsible or in charge of the treatment" of the LOPDGDD provides the following:

"1. The regime established in this article will be applicable to the treatment of
who are responsible or in charge:


(…)
c) The General State Administration, the Administrations of the communities
autonomous entities and the entities that make up the Local Administration.
(…)


2. When the managers or managers listed in section 1 commit
any of the offenses referred to in articles 72 to 74 of this law
organic, the data protection authority that is competent will dictate
resolution sanctioning them with a warning. The resolution will establish
likewise, the measures that should be adopted to cease the conduct or to correct it.

the effects of the offense committed.

3. Without prejudice to what is established in the previous section, the data protection authority
data will also propose the initiation of disciplinary actions when there are
enough evidence for it. In this case, the procedure and the sanctions to be applied
will be those established in the legislation on the disciplinary or sanctioning regime that

be applicable. Likewise, when the infringements are attributable to
authorities and executives, and the existence of technical reports or
recommendations for treatment that have not been adequately addressed, in
The resolution in which the sanction is imposed will include a reprimand with
name of the responsible position and the publication in the Official Gazette will be ordered

of the State or autonomous community that corresponds.

4. The data protection authority must be informed of the resolutions that
fall in relation to the measures and actions referred to in the sections
previous.


5. They will be communicated to the Ombudsman or, where appropriate, to similar institutions
of the autonomous communities the actions carried out and the resolutions issued
under this article.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/9











                                           V
Therefore, in accordance with the applicable legislation and assessed the criteria of
graduation of sanctions whose existence has been accredited,
the Director of the Spanish Data Protection Agency RESOLVES:


FIRST: IMPOSE D.G. OF THE CIVIL GUARD, with NIF S2816003D, for a
infringement of Article 5.1.c) of the GDPR, typified in Article 83.4 of the GDPR, a
warning sanction.

SECOND: NOTIFY this resolution to D.G. OF THE CIVIL GUARD.


THIRD: COMMUNICATE this resolution to the Ombudsman, in
in accordance with the provisions of article 77.5 of the LOPDGDD.

In accordance with the provisions of article 50 of the LOPDGDD, this

Resolution will be made public once the interested parties have been notified.

Against this resolution, which puts an end to the administrative process in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reversal before the

Director of the Spanish Agency for Data Protection within a period of one month from
count from the day following the notification of this resolution or directly
contentious-administrative appeal before the Contentious-administrative Chamber of the
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the

Contentious-administrative jurisdiction, within a period of two months from the
day following the notification of this act, as provided for in article 46.1 of the
referred Law.

Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP,

may provisionally suspend the firm resolution in administrative proceedings if the
The interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Data Protection Agency, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-

web/], or through any of the other registries provided for in art. 16.4 of the
aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the
documentation proving the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative proceedings within a period of two months from the day following the

Notification of this resolution would terminate the precautionary suspension.


                                                                               938-181022
Mar Spain Marti
Director of the Spanish Data Protection Agency




C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es