AEPD (Spain) - PS/00071/2020

AEPD - PS/00071/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(a) GDPR Article 83(5)(a) GDPR Article 83(7) GDPR Artículo 77.1.c LOPDDGG Artículo 77.1.c Ley Organica 3/2018
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	PS/00071/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish DPA (AEPD) held that the use of an individual’s personal data to call him to appear at the city's municipal offices for a non-existent purpose violated Article 5(1)(a) GDPR.

English Summary

Facts

An individual (the claimant) was called to his city’s municipal offices; the notice stated that the authority called the claimant to discuss the claimant's registration. When the claimant arrived, he was arrested on the basis of a “resolution for expulsion”. The calling was made on the request of the Police, who were seeking to extradite the data subject. The issue was originally referred to the Ombudsman (Defensor del Pueblo), who referred the case to the AEPD to analyse the data protection elements of the municipality’s actions.

Dispute

Did the use of the claimant’s personal data for the registration calling infringed any articles of the GDPR?

Holding

The AEPD held that the Municipality had violated Article 5(1)(a) GDPR, as the subject’s data had not been processed in a lawful, fair or transparent manner. The subject’s personal data was used for a purpose that did not exist (ie the “discussion of registration”), with no establishment of legal grounds for an arrest or extradition order.

The AEPD issued a reprimand on the city council. It stated that due to a Spanish national law enacted pursuant to Article 83(7) GDPR, it could not impose fines on certain public authorities.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                   1/14








         Procedure Nº: PS / 00071/2020

                    RESOLUTION OF SANCTIONING PROCEDURE


    Of the procedure instructed by the Spanish Data Protection Agency and based on the
following

                                     BACKGROUND



FIRST: On 10/28/2019 a letter is received from the OMBUDSMAN (DP)
informing that proceedings have been initiated for a complaint filed by MÉDICOS DEL MUNDO
DE NAVARRA, DENONTZAT PAPERS AND RIGHTS PLATFORM, and SOS RACISMO
NAVARRE. In it, they express their “dissatisfaction with the arrest” of A.A.A., (A.A.A. in

hereinafter) to proceed with his expulsion from the national territory when he went to dependencies
municipalities after being summoned by the RIBAFORADA CITY COUNCIL (the one claimed) with the
object of carrying out registration procedures.

       The DP in "considerations" indicates that in actions, the "city council has reported

that agents of the local Immigration Brigade of the Tudela Police Station verbally requested
to the consistory collaboration to investigate and clarify the crimes in which he was possibly
the interested party involved. " The city council understands that it acted in good faith, in order to comply
with the duty of cooperation between public administrations in the general interest.


       “In view of the information submitted: The City Council of
RIBAFORADA and the General Commissariat for Immigration and Borders (CGEF) of the irregularity of
the action taken in this case, in which the interested party was summoned in dependencies
municipalities with the fictitious pretext of carrying out procedures for their registration, despite the fact that the
The intended purpose was his detention for expulsion, given the irregular situation, not having
residence authorization. " “It has also been communicated to said governing bodies that the

Organic Law 4/2000 of 01/11 regulating the rights and freedoms of foreigners in
Spain and its social integration in the 5th additional provision, referring to "access to information
collaboration between public administrations and computerized management of procedures ”, section
one, establishes that "public administrations within their scope of competence will collaborate
in the transfer of data related to people who are considered interested in the

procedures regulated in this Organic Law and its implementing regulations, adding the
section two, that for the purpose of completing the actions that the organs of the
General State Administration competent in the procedures regulated in this Law
Organic and its implementing regulations are entrusted to the State Administration Agency
Tax, the General Treasury of Social Security and the National Institute of Statistics, this

last relative to the Municipal Register of inhabitants, will provide those with direct access to the
files in which data that must be included in said files and without being
the consent of the interested parties is required. "

       A new letter is received from the DP, dated 01/10/2020, which responds to the request of the AEPD
to send the communications with the claimed and the CGEF, as well as a copy of the summons

made to the claimant by the city council “to address an issue of his registration, as well
as the reports sent by the aforementioned administrations on the present case "



    C / Jorge Juan, 6 www.aepd.es
    28001 - Madrid sedeagpd.gob.es 2/14








       -Provide a copy of the document submitted by the complained party to the actions of the DP, the
08/20/2019 in which it informs that "on the indicated date" without stating what it is, "it was requested
verbally to the mayor's office by the State Security Forces and Bodies, collaboration and

cooperation for investigation and clarification of the crimes in which he was possibly
involved the indicated person "" and the city council by the principle of cooperation and loyalty
Institution considered that it should fulfill this duty. "

       -Copy of letter from the defendant dated 05/03/2019, with destination data from A.A.A. and your address
(*** ADDRESS.1), without specifying the location, without signature, with the seal of the municipality, in which "

He summons you to a meeting at the town hall offices on Monday 06/05 at 11 a.m. to discuss an issue
of his registration ”.

       -Copy of the brief presented by the DIRECTORATE GENERAL OF THE POLICE before the DP
in their actions, dated 08/27/2019, which indicates that “the Local Brigade of

Immigration of the National Police Station of Tudela learned that there was a
resolution of expulsion from the Subdelegation of the Government of Cádiz on behalf of the interested
Date 08/05/2015, which was notified to the interested party on 08/15. Against that expulsion, the
interested party filed a contentious administrative appeal, being dismissed by the
Administrative Litigation 4 of Cádiz on *** DATE.1. " Likewise, “it was recorded that the
interested party applied for the initial temporary residence card due to exceptional circumstances.

on 05/19/2017 at the Navarra Immigration Office, being denied on
01/25/2018, against which he filed an appeal for reconsideration which dismissed the request of the
plaintiff on 03/12/2019. Faced with such facts. and however the interested party
there was a police record, a device was made to locate and arrest him
by officials attached to the Local Immigration Brigade of the Tudela Police Station

proceeding to his arrest on 05/06/2019, when he was on the public highway of the municipality of
Ribaforada specifically, in front of the town hall, watching over your rights at all times
giving the appropriate compliance to them, making known the facts of both their
person as well as your Lawyer ”.


SECOND: On 01/22/2020, the entities promoting the complaint to the DP indicate that
In May 2019, they filed a complaint with the Ombudsman in which they
been informed of the discrepancy with the action of the claimed city council and the Brigade
Immigration Office, considering that data may have been transferred irregularly by
of the townhall .


THIRD: On 03/19/2020, and agreed by the director of the AEPD:

       “FIRST: INITIATE SANCTIONING PROCEDURE for APPEAL to
RIBAFORADA CITY COUNCIL, with NIF P3120800B, for the alleged violation of article
5.1.b) in relation to article 6.4 of the RGPD, in accordance with article 83.5.a) of the RGPD.


       SECOND: INITIATE SANCTIONING PROCEDURE for APPEARANCE to
RIBAFORADA CITY COUNCIL, for the alleged infringement of article 5.1.a), of
in accordance with article 83.5.a) of the RGPD. "


FOURTH: On 06/29/2020, the defendant makes allegations and states that on “Friday
05/03/2019, two policemen showed up at the town hall offices and showed their badge
to identify themselves and they requested collaboration “to meet at the town hall offices at
affected, indicating that a procedure had been followed against him ”. "The City Council saw

    C / Jorge Juan, 6 www.aepd.es
    28001 - Madrid sedeagpd.gob.es 3/14








obliged to collaborate with the request, being informed by the agents that the affected person had
antecedents and that an express extradition order should be enforced for what they already had
airplane ticket". “By collaborating with the police, it was not believed that the law was being violated.

data protection regulations, as it was done under the principles of cooperation and loyalty
institutional."

“It was the agents themselves who provided the personal data of the affected person without
It was necessary to make any consultation or treatment of data from the register since the Forces and
Security Corps had all the information.


        So the summons that was sent to the affected party was made following the instructions of the
agents on how to do it, understanding the City Council that acted in compliance with the duty
of collaboration and with total good faith. "


        It indicates that article 4.1 of Organic Law 2/1986 of 03/13, on the Forces and Corps of
Security, “everyone has the duty to provide the security forces and bodies with assistance
necessary the investigation and prosecution of crimes in the terms provided by law. "
It ends by stating that the City Council did not provide them with any information, or make any consultation,
nor did he process the registry since the State Security Forces and Bodies
they had all the information.


FIFTH: According to the provisions of article 77 of Law 39/2015, of 1/10, of the Procedure
Common Administrative Office of Public Administrations (LPCAP), a period of
evidence to prove the relevant facts, and when, among others, the very nature of the
process requires it-


   For this purpose, it is agreed on 09/14/2019:


  1. To consider reproduced for evidentiary purposes, the claim and its documentation, the

  documents obtained and generated by the Inspection Services.

  2. Likewise, the allegations to the initiation agreement are considered reproduced.


         In addition, it is decided to extend the test and request:


  3. To the Ribaforada City Council:

  a) Reasons for which he did not demand in the request for collaboration, that it be made in writing of
  motivated, the visit was made on 05/03, the summons was on 05/06.


         On 11/20/2020, his reply brief was entered stating that
  they thought they were breaking any rule by collaborating with the Police, which acted
  good faith.


         The summons was made on the same day 05/03 and it was for 05/06.




     C / Jorge Juan, 6 www.aepd.es
     28001 - Madrid sedeagpd.gob.es 4/14








  a) Copy of the address certificate that the affected person appears in the Municipal Register or in other
  databases to which the city council has access, as of May 2019, or failing that, certified
  tion that at that period no data on the affected party was recorded.

         Provides a certificate from the Municipal Register of inhabitants of the municipality in which it is
  that A.A.A., which it identifies with its foreigner identification number, is registered in the

  Register of the town, from *** DATE.2 to 05/07/2019 at "*** ADDRESS.1"

  b) About the citation for a registration process:


   - Date and manner in which it was cited, date of writing, signature of receipt of the letter by
  the affected person, and how it was delivered.

  He states that the letter only contained the seal without any signature, there is no record
  exit and was delivered by a municipal worker stating the signature of receipt with date
  cha 05/03/2019 by B.B.B., with a passport number that does not match the ID number
  foreigner identity that appears in the list of inhabitants, referred to in the preceding paragraph b.

   - If it was true that the affected party had instituted any procedure, that of registration or relationship
  swam, or if he urged any in the City Council, or some service was rendered to him so that they had

  your data.

            He responds that he instigated the registration process in 2014, according to the certificate
  registration number.

4. To the General Commissioner for Immigration and Borders:

In relation to the facts for which he informed the Ombudsman (matter of the Ombudsman report
of the People XXXXXXXX, reference General Secretariat Legal Service, of 08/22/2019, subject
detention A.A.A.). In the testing period in which you are requested to report or contribute the following:


a) Reason why they did not report to the Ribaforada City Council the collaboration in the detention
of the affected party through a reasoned letter (visit to the City Hall on 05/03, arrest on 6), and if
It is contemplated in regulations.


It states in its response that it is a task proper to the Security Forces and Bodies, and
"The interested party was identified and located, no collaboration was required or the
City Council or any other police force to proceed to his arrest. "

a) If they obtained some type of data from the City Council to practice the arrest, and if they asked the

City Council to send a letter summoning him to its headquarters for a management (The city council has
declared that it was the Police who provided the address of the affected person and who suggested the idea of
the summons for an action in order to arrest him).

It states in its response that “they had located the address of the interested party and the
surveillance to locate the person in the surroundings of the house. Given the unsuccessful result
After the operational procedures, it was suggested to the town council to collaborate in the
verification of whether or not the foreign citizen actually continues to reside in the municipality,

continuing, however, the police officers with the surveillance devices referred to above
two for the purpose of its location "



     C / Jorge Juan, 6 www.aepd.es
     28001 - Madrid sedeagpd.gob.es 5/14








b) Unit that practices the management of visits to the town hall to suggest the summons and powers
to proceed to management. If they acted on behalf of the judicial or fiscal authority or on behalf of the
hierarchical police force.

They state the answer from point a, “acting in compliance with their obligations by complying with
compliance with the expulsion order in force confirmed by the court ”.

SIXTH: It should be mentioned that in the management report of the Ombudsman for the year 2019,

published on its website, there is a reference to this claim stating: ”4.7.3 Release
tad due to the impossibility of executing the expulsion or return decisions ”, which reads:

“Difficulties for the registration of people in an irregular situation is a reason for recu-
rrente of actions by the Ombudsman. It is the case of a foreign citizen,
that he was arrested when he attended a meeting at the Ribaforada City Council (Navarra), where

de had been summoned to discuss issues related to his registration.
After the start of the proceedings, the aforementioned consistory justified its action, stating that it acted in
good faith, cooperating with the State Security Forces and Bodies, in order to comply
with the duty of cooperation between public administrations, in the general interest. For his
On the other hand, the General Commissariat for Foreigners and Borders reported that the Local Brigade for Foreigners

The Tudela Police Station learned that the interested party had been deported
issued by the Government Subdelegation in Cádiz, after having denied his application for residence
temporary residence due to exceptional circumstances. They were arrested when
contraba in the public highway in front of the consistory of the mentioned locality.


        The Ombudsman considers that the action described is not in accordance with the Law,
since the interested party was summoned in municipal offices with the fictitious pretext of carrying out
steps for his registration, despite the fact that the intended purpose was his arrest by agents
police for their expulsion. The fifth additional provision of Organic Law 4/2000, of
January, regulating the rights and freedoms of foreigners in Spain and their integration into
cial, establishes that the police authorities have access to the data of the Municipal Register

for the fulfillment of its functions through the National Institute of Statistics. Therefore no
It is considered to regulate the procedure used, in which the police officers involved
They accessed the data of the interested party's register, in a way not foreseen by the norm.

Proceedings remain open pending the Spanish Agency for the Protection of Data

To send information about the adequacy of this action to the legislation for the protection of
data (XXXXXXXX).


SEVENTH: It is decided on 11/26/2020 to clarify the circumstances, from the answers given
in tests, and in this sense, it is requested:

        A) To the Ombudsman:

        In the proceeding against the Ribaforada City Council, as
consequence of your outbound shipment 10/28/2019, YYYYYYYY, your collaboration is requested and facilitates
the information within ten days, within the testing period, in relation to:


      In the report published on the 2019 website, of the Ombudsman, it is stated on
in this case, in point “4.7.3 Release due to impossibility of executing the decisions
of expulsion or return "


     C / Jorge Juan, 6 www.aepd.es
     28001 - Madrid sedeagpd.gob.es 6/14








        They are asked to detail how they come to the conclusion that such access the data from the register
of the interested party took place, sending a copy if you have the documents from which it is deduced
the access, the subject who gave the aforementioned access, if any, and when they refer to said access

as a "mode not provided for in the standard", to which they refer.
        No response was obtained to the requested information.

        B) The claimed person is asked to:

1-Detail the process or common protocol of use when citizens send writings to their

address (regarding the use of data that is recorded in shipments, the address of the destinations
origin, origin or attachment of these address data of the person they use, be it for
general questions or those related to the registry), specifically if the sending formats
the address is imported as it is literally registered, and at the foot of the letter of the aforementioned registry
(You want to know if these data are collected or transferred from the register to the shipments that are sent to
the citizens).

Answer on 12/1/2020 “if we have to address the neighbors, consult the address that appears

in the register, because it is the one with the most up-to-date information. Other times the database of
general maintenance. "

2-Indicate the support (paper with the Police logo, simple sheet, post it etc.) that contained the data
of the claimants who manifested, the police gave them to send the summons, (if they keep it)
ra, send a copy), and if the City Council before said annotation or note, made a verification of the
direction looking at the standard.

He replied that "the police did not deliver anything in writing, everything was verbal."

3-On the other hand, the Police have indicated in evidence that although they had located the person, as
he could not find it “it was suggested to the town council to collaborate in verifying whether
the foreign citizen whether or not he really continued to reside in the municipality ”.

Collaboration was reached by making a query in its database or Municipal Register, contributing
do copy of it.

            He answers that they did not suggest but urged the action of the City Council, seeing
forced to collaborate.

4-Send a copy of the registration sheet with the format as it appears in the register, which may be
a photo, jpg or pdf image of the claimant's address records, and details as to the
cancellation in the register of 05/07/2019, the legal reason for this cancellation entry.

        It states that copies of the Municipal Register sheet are attached in photo and
copy of the line communication to proceed with the removal from the register.

        The first image is a screen print with the data of the claimant of the application.

Information technology “management of the Municipal Register of inhabitants”. The data of the claimant, his
foreigner identification number associated with the residence card and the date of registration
in the register. The address and its capitalization format, as well as the floor and door match
the one that appears in the certificate sent by the claimed person on 11/20/2020, point b).

        The second image is a statement of "data list of an INE movement", from
07/16/2019, referring to the claimant's data, “communication to the municipality”, “variation date
05/07/2019 ”,“ Withdrawal due to change of residence due to expulsion of foreigner executed ”.



     C / Jorge Juan, 6 www.aepd.es
     28001 - Madrid sedeagpd.gob.es 7/14








5-Finally, you are asked, if the population register records the inquiries produced, if it were
possible, provide a copy of those made on the person of A.A.A. in 2019.

       He answered that “the accesses of the consultations are not recorded, nor is there a Historical Archive of ac-
ceases. "

EIGHTH: The instructor issued on 12/22/2020 a resolution proposal with the literal:

            "That the Director of the Spanish Agency for Data Protection be sanctioned with
warning to RIBAFORADA CITY COUNCIL, for an infraction of article 5.1.a) of the

RGPD, in accordance with article 83.5.a) of the RGPD. "


            There are no claims of claimed.



                                    PROVEN FACTS


 1) This procedure originates from the transfer of actions of the Ombudsman
for the AEPD to analyze whether personal data has been used and processed for the detention
tion of the claimant by the Police on public roads, near the claimed City Hall, the ma-

Tomorrow of 05/06/2019.

            As documentation sent by the DP, the notice of summons to the claimant appears,
carried out with a computer by the complainant, and sent to the complainant, dated 05/03/2019. At
literal figure: "You are hereby summoned to a meeting at the town hall offices on Monday 6

May at 11:00 in the morning to discuss a matter of his registration. ”, with the seal of the
City Council, without having, according to the statement of the claimed, because it was not given,
exit number,

 2) According to the defendant's statement, the summons was delivered by a
municipal worker at the address of the letter, on the same day 05/03/2019, signed by another person,

not the claimant. There is no evidence that the claimant had a request related to
any question of registration.

 3) As stated by the defendant in his allegations to the initiation agreement, the personal data
of the affected person were provided by the Police officers who attended the

City Council on 05/03/2019 requesting that the summons be made, since the claimant had a
extradition order. The City Council does not deny the collaboration stating that “without it being
You need to make any consultation on your part ”,“ nor treatment of data from the register ”, since“ the
Police, "had all the information." The police in evidence stated that the claimant "
was identified and located "," his address "," being watched "," with results

unsuccessful ", and the Police" suggests the City Council to collaborate in verifying whether the
foreign citizen actually continues to reside or not in the municipality, continuing not
However, police officers with the surveillance devices referred to above for the purpose of
its location ”.



 4) There is no evidence that the request for collaboration from the Police to the complainant is documented by
written, stating the claimed that it was verbally by the agents who visited the
Town hall.
    C / Jorge Juan, 6 www.aepd.es
    28001 - Madrid sedeagpd.gob.es 8/14










  5) According to the test carried out, the claimed City Council contained the data of the

claimant, as certified "in the Municipal Register of inhabitants", and its computer application,
with registration date, *** DATE.2, with address “*** ADDRESS.1” (literal order and capital letters as well
ready). The letter that is sent to the complainant to go through the process of
registration, has the same address, although in a different order and format, "*** ADDRESS.1", and
as stated by the defendant, these are data that were provided by the Police when requesting their
collaboration. The City Council to these data received, associates a procedure for you to go to

complete it and quote the claimant by sending the letter, exercising its decision on
how to use that received data.

  6) In evidence, the defendant stated that “if we have to go to the neighbors, the
address that appears in the register, because it is the one that is most up-to-date. Other times

uses the general maintenance database. " Apart from that of the census, it is not proven that
give the claimant another address at the headquarters of the claimant.


  7) According to the Police, the claimant was investigated before his arrest on 05/06/2019,
by an administrative resolution of expulsion of 08/05/2015, confirmed by the Court on
*** DATE.1, and having a police record, an attempt was made to locate and detain him.



                                  FOUNDATIONS OF LAW

                                                   I


     By virtue of the powers that article 58.2 of the RGPD recognizes to each control authority,
and as established in arts. 47 and 48.1 of the LOPDGDD, the Director of the Spanish Agency
Data Protection is competent to resolve this procedure.


                                                   II


   The content of the fundamental right to data protection consists of a power of disposition
sition and control over personal data that empowers the person to decide which of those
data to provide to a third party, be it the State or an individual, or which third parties may collect,
and that also allows the individual to know who owns that personal data and for what, being able

object to that possession or use. These powers of disposal and control over personal data-
which constitute part of the content of the fundamental right to data protection is
legally create the power to consent to the collection, obtaining and access to data
personal data, their subsequent storage and treatment, as well as their use or possible uses, by a
third, be it the State or an individual.


   The purpose for which the City Council has the data of the interested party in the Municipal Register

it is generally the one provided for in the regulations. Additionally, it obtained data that
provided by the police, even if they were the same, they are used to write a letter,
deciding to use the same data for a purpose, the summons of the claimant, which really
it did not exist, in order to facilitate the arrest of the claimant.


     C / Jorge Juan, 6 www.aepd.es
     28001 - Madrid sedeagpd.gob.es 9/14








   The following articles are mentioned from the RGDP:

   Article 1.2 “This Regulation protects the fundamental rights and freedoms of the
natural persons and, in particular, their right to the protection of personal data. "


   Article 2. Material scope

   "This Regulation applies to fully or partially automated data processing

personal data, as well as the non-automated processing of personal data contained or
intended to be included in a file. "

        article 4. Definitions


For the purposes of these Regulations, the following shall be understood as:

1) "personal data": any information about an identified or identifiable natural person ("the
interested"); an identifiable natural person shall be considered any person whose identity can
be determined, directly or indirectly, in particular by an identifier, such as
a name, an identification number, location data, an online identifier or one or

various elements of the physical, physiological, genetic, psychic, economic, cultural identity
or social of said person;

2) "treatment": any operation or set of operations carried out on data
personal or personal data sets, whether by automated procedures or not,

such as the collection, registration, organization, structuring, conservation, adaptation or modification,
extraction, consultation, use, communication by transmission, diffusion or any other form of
enabling access, collation or interconnection, limitation, deletion or destruction;

6) "file": any structured set of personal data, accessible according to criteria
determined, whether centralized, decentralized or distributed in a functional or geographical way;


7) "controller" or "controller": the natural or legal person, public authority,
service or other body that, alone or together with others, determines the purposes and means of the treatment;
if the law of the Union or the Member States determines the purposes and means of the treatment,
the data controller or the specific criteria for their appointment may
established by the law of the Union or of the Member States; "


   In the present case, the participation by the claimed party in sending the
letter of summons made to the claimant, nor that the possible
detention of the claimant, but if personal data has been used for said summons
ownership of the claimed.


   In the first place, according to the version of the claimed, that the data is provided by the
police, the defendant send a letter to the claimant, facilitating the summons of the claimant. For
It uses the same data, apparently they are not those of the Municipal Register, since they are the
same, but in another format, but the address is the same, and for practical purposes, it is intended that
With these data, he decides to send a subpoena letter, exercising his powers.


   This is done without writing that motivates the aforementioned collaboration, then without a legal reason that
support the legality of the collaboration, by way of fact.

     C / Jorge Juan, 6 www.aepd.es
     28001 - Madrid sedeagpd.gob.es 10/14








   On the other hand, this assertion that the data was given to them by the police is not discredited by the
action by the police, who stated that they had been following the claimant for some time
watching, to no avail. In fact, in the letter of summons, it is not delivered to the address

claimant, but to another person who was there. On the other hand, of the eventual consultations,
use or access to the Municipal Register of inhabitants there are no reviews or indications.

   It would therefore be advisable to delimit where the data for sending comes from, or conclude
rationally where said data does not come or come from.

   It is clearly appreciated in terms of the shipping address associated with the name and surname of the
claimant, that the formats and literals of the Municipal Register and the letter of summons are different
reds. The registry managed by the complained party, the data of the summons letter with an address
(personal data of the claimant, although in format, very different from those that appear in the register).
One refers to a completely uppercase format, in the entire street name, and the data

As a general rule, the data used by the defendant to send letters to
the citizens. In this case, the exact data of the register are not those contained in the chart.
subpoena, but the address and floor and door are the same, although the defendant uses the
kill given by the police, not the one from the register. Furthermore, the claimant was not aware of another address at
City Hall.

   Without prejudice to the fact that it is indicated that the complainant has collaborated in the agreement to facilitate

To quote the appointment, a matter that is not the competence of this AEPD, the truth is that at the evidentiary level,
burden of proof, which corresponds to the administration that accuses proving the facts, is not confirmed
light because it was undoubtedly not proven that the database of the registry of the
claimed, for the sending of the aforementioned letter. However, if it is proven that other data is used,
same address, different format, which according to the claimed, are used, deciding, to
through the powers conferred by the city council, use these data, to study

a summons, therefore this treatment consisting of sending this letter with these data is the
treatment of the data carried out by the claimed person.


   In this case, the personal data has been processed for a purpose that did not exist.
more legitimation than verbal, without proving the legal motivation that served for the
legitimate treatment of that data and that summons.

   This constitutes an infringement of article 5.1.a) of the RGD.


  1. The personal data will be:

  a) treated in a lawful, loyal and transparent manner in relation to the interested party ("lawfulness, loyalty and

transparency");

   For the processing of personal data to be legal, you must identify specific reasons
for processing. This is called a "legal basis" for treatment, and there are six options
(Article 6.1) that depend on its purpose and its relationship with the individual. Can't figure out

this case that there was a legal obligation to cooperate when there is no document that motivates
or induce such cooperation. If the exercise of powers were exercised because it is thought
to do or feel pressured, there would be no real reason for the action. The
Disloyalty in the treatment has to be seen as an aspect of the data treatment, in this
case, collaborate on a summons for which there was no ongoing procedure, proving the

exercise in the processing of data for a purpose that is not the one that provides for the treatment of
data in accordance with the powers established for the city council. The previous LOPD is
     C / Jorge Juan, 6 www.aepd.es
     28001 - Madrid sedeagpd.gob.es 11/14








referred to this type of treatment in its article 4.2 which indicated: "Personal data
object of treatment may not be used for purposes incompatible with those for which
the data would have been collected ”. The RGPD identifies it in its article 5.1.b) “The data

personal will be: collected for specific, explicit and legitimate purposes, and will not be processed
subsequently in a manner incompatible with said purposes "

   The purpose of the treatment must be specific, legitimate and express, in this case defined
by law in matters of management of the register, and not stating that there was a procedure to
to be completed by the complainant in said area, it is estimated that the summons with their data

personal data, even if they were provided by the agents, it is a data processing not
lawful in which there is also a lack of loyalty. Loyalty means you only have to handle the
personal data so that people can expect its reasonable use, some
common expectations, and not use them in a deviant or deviant manner, or have adverse effects
unjustified about them. The manager should stop and think not only about how he can use
personal data, but also on whether to do so. It is proven that the aforementioned is violated

article 5.1.a) of the RGPD

   Regarding the manifestations of the eventual transfer of data from the Municipal Register to the police,
that propitiates the detention, such transfer or its need for the detention of the
claimant.



       As for the exercise of powers by the claimed, it is not going to enter the
merits of the allegations regarding collaboration and loyal cooperation with the Security Forces and Bodies

of the State, since they do not fall within the competencies of this AEPD, pointing to what the
Denial refers to the exercise of the same.


       This AEPD cannot enter into assessing the exercise of powers of the claimed in the sense

citation of the municipal agency when it is not proven that there was any matter
related to the Municipal Register by the City Council, indicating that it collaborated
with the police, and that summons could be an instrument or means to achieve an end, although
It is true that there has been no document that motivated such collaboration
between administrations. Thus, you cannot qualify that exercise of competence that is attributed
the claimant, who without any documentation decides to collaborate in the arrest of a person.

Evaluate the regulated elements for the exercise of said power, such as the documented motivation
mental of the requested collaboration, it is a contentious matter that cannot assess this AEPD, if
It may well be that without going into the merits of the matter, consider that it has acted in fact by not
prove that the data processing has the principles of legality and loyalty


       What there is no doubt is that for the exercise of that ordinary management competence of
the issues the law attributes to the complainant the treatment of the complainant's data, provided that
prove that these data have been used for that purpose, logically. If the data were used
pledged in the deployment of a deception to the affected person, they are destined for another purpose, which is not the
data processing, article 5. 1.a) of the RGPD is being violated



    Establishes article 5.1.b) of the RGPD

         "1. The personal data will be:

    C / Jorge Juan, 6 www.aepd.es
    28001 - Madrid sedeagpd.gob.es 12/14








  b) collected for specific, explicit and legitimate purposes, and will not be further processed as
manner incompatible with said purposes; in accordance with article 89 (1), the treatment
further use of personal data for archival purposes in the public interest, research purposes

Scientific and historical or statistical purposes shall not be considered incompatible with the initial purposes
("Purpose limitation");

  The infringement of this article imputed in the initiation agreement decreases, as it is considered more
adjusted the facts to the violation of article 5.1.a) of the RGPD



                                                   III

        Article 83.5 a) of the RGPD, considers that the violation of “the basic principles for the

treatment, including the conditions for consent pursuant to articles 5, 6, 7 and 9 "is
punishable, in accordance with section 5 of the aforementioned article 83 of the aforementioned Regulation, with
administrative fines of a maximum of € 20,000,000 or, in the case of a company, a
an amount equivalent to a maximum of 4% of the total global annual turnover for the financial year
previous financial statement, opting for the highest amount. "



        Article 83.7 of the RGPD indicates:
        “Without prejudice to the corrective powers of the control authorities under article

58 (2), each Member State may lay down rules on whether and to what extent it is possible to
da, impose administrative fines on authorities and public bodies established in said State
all member "


      Article 58.2 of the RGPD indicates: "Each control authority will have all the
following corrective powers listed below:
        b) punish any person responsible or in charge of the treatment with warning when

the processing operations have infringed the provisions of this Regulation;

        d) order the person in charge of the treatment that the treatment operations

comply with the provisions of this Regulation, where appropriate, of a certain
manner and within a specified period ”.

        The Spanish legal system has chosen not to penalize entities with a fine
public, as indicated in article 77.1. c) and 2. 4. 5. and 6. of the LOPDDGG: “1. The regime
established in this article will apply to the treatments for which they are responsible or

managers:

  c) The General State Administration, the Administrations of the autonomous communities and
the entities that make up the Local Administration.

  2. When the managers or managers listed in section 1 commit any of the

offenses referred to in articles 72 to 74 of this organic law, the authority of
data protection that is competent will issue a resolution sanctioning them with
awareness. The resolution will also establish the measures to be adopted so that
the conduct ceases or the effects of the offense that had been committed are corrected.


     C / Jorge Juan, 6 www.aepd.es
     28001 - Madrid sedeagpd.gob.es 13/14








  The resolution will be notified to the person in charge of the treatment, the body of which
hierarchically depends, where appropriate, and those affected who have the status of interested party,
in your case.


  4. The decisions that fall on the data protection authority must be communicated to
relation with the measures and actions referred to in the previous sections.

  5. They will be communicated to the Ombudsman or, where appropriate, to the analogous institutions of the
Autonomous Communities the actions carried out and the resolutions issued under this

Article.

  6. When the competent authority is the Spanish Data Protection Agency, this
publish on its website with due separation the resolutions referring to the entities
of section 1 of this article, expressly indicating the identity of the person responsible or
in charge of the treatment who had committed the offense. "


    Therefore, in accordance with the applicable legislation,

    the Director of the Spanish Agency for Data Protection RESOLVES:


    FIRST: IMPOSE RIBAFORADA CITY COUNCIL, with NIF P3120800B, for
    an infringement of article 5.1.a) of the RGPD, in accordance with article 83.5 a) of the
    RGPD, a warning sanction.


    SECOND: NOTIFY this resolution to RIBAFORADA CITY COUNCIL.

    THIRD: COMMUNICATE this resolution to the OMBUDSMAN, of
    in accordance with the provisions of article 77.5 of the LOPDGDD.


    FOURTH: In accordance with the provisions of article 50 of the LOPDGDD, the
    This Resolution will be made public once it has been notified to the interested parties.

    Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the
    LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
    Interested parties may file, optionally, an appeal for reconsideration before the Director

    of the Spanish Agency for Data Protection within a month from the
    day after notification of this resolution or directly contentious appeal
    administrative before the Contentious-Administrative Chamber of the National Court,
    in accordance with the provisions of article 25 and paragraph 5 of the additional provision
    fourth of Law 29/1998, of July 13, regulating the Contentious Jurisdiction-

    administrative, within a period of two months from the day following notification
    of this act, as provided in article 46.1 of the aforementioned Law.

    Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
    may provisionally suspend the final resolution through administrative channels if the interested party

    expresses its intention to file a contentious-administrative appeal. If this is the
    In this case, the interested party must formally communicate this fact by writing to
    to the Spanish Agency for Data Protection, presenting it through the Registry
    Agency Electronic [https://sedeagpd.gob.es/sede-electronica-web/], or through
    any of the remaining records provided for in art. 16.4 of the aforementioned Law 39/2015, of 1

    C / Jorge Juan, 6 www.aepd.es
    28001 - Madrid sedeagpd.gob.es 14/14










October. You must also send the Agency the documentation that proves the
effective filing of the contentious-administrative appeal. If the Agency did not have
knowledge of the filing of the contentious-administrative appeal within the period of

two months from the day following the notification of this resolution, it would
end of the precautionary suspension.



                                                                                             938-131120
Mar Spain Martí
Director of the Spanish Agency for Data Protection
























































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es