CTPDA (Spain) - RPS-2023/007

CTPDA - RPS-2023/007
Authority:	CTPDA (Andalusia)
Jurisdiction:	Spain
Relevant Law:	Article 6(1)(c) GDPR Article 6(1)(f) GDPR Article 13 GDPR Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público
Type:	Complaint
Outcome:	Upheld
Started:	03.12.2020
Decided:	18.05.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	RPS-2023/007
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	CTPD (in ES)
Initial Contributor:	lm

The Andalusian DPA found that an education department lacked a legal basis for recording audio of its meetings. It considered that a national law’s requirement that minutes be documented and that they “may be recorded” did not constitute a legal obligation under Article 6 GDPR.

English Summary

Facts

On 23 December 2020, a data subject filed a complaint with the Andalusian DPA (CTPD) against a Department of Education and Educational Development (the controller). The data subject claimed that since the 2020/2021 school year, all meetings of the educational department were audio recorded.

The controller relied on Article 18 of Law 40/2015, which calls for minutes to be drawn up for each meeting of the education department, as a legal basis for the audio recordings. It stated that the processing of data was aimed at this law’s instructions, with the purpose of convening the sessions and consulting the matters in the agenda. The controller also claimed that since the beginning of the 2020/2021 school year, a decision by the Head of the Department that was endorsed by all members except the data subject had subjected each meeting to audio recording. Notably, this was done without modifying the Rules of Organization and Operation of the Center Plan until 2 February 2021.

The CTPD’s investigation revealed that up until the date of this modification in February 2021, there was no regulation of the recordings of the sessions. The controller affirmed that it had informed those attending the telematics session that the same and subsequent meetings would be recorded, the identity and contact information of the controller and the purpose of the processing. However, the controller did not verify that it had informed the members of the Department that the sessions would be recorded or of other Article 13 GDPR requirements.

Holding

On 19 July 2022, the CTPD initiated sanctioning proceedings against the controller for violations of Articles 6 and 13 GDPR.

The CTPD noted that though Article 18 of Law 40/2015 establishes the obligation to draw up minutes of each session held by a collegiate body, it does not require the recording of such sessions by simply stating that “they may be recorded.” This does not create an obligation to record. Further, the ‘right’ of members to have information discussed at the meetings at their disposal can be guaranteed with minutes sent by electronic means. As a result, the CTPD found that this is not a case where processing is necessary to fulfil a legal obligation or a public purpose pursuant to Articles 6(1)(c) or (e) GDPR.

The CTPD also found a violation of Article 13 GDPR. It noted that some meetings were held where there was no evidence of a notice that the meeting would be recorded. In addition, even in the initial meeting where some of the affected data subjects were informed that the same and future meetings would be audio recorded, the disclosure still fell short of Article 13 GDPR. In particular, the controller failed to inform data subjects in an express, clear and precise manner of the purposes of recording, their rights and how to exercise them, the identity of the data protection officer or the period of retention.

In determining the sanction, the CTPD considered that the violation should be considered mild and not serious pursuant to Article 74(a) LOPDGDD. The CTPD ultimately issued a warning with no fine and ordered the controller to correct its infringing actions within a month.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

Resolution RPS-2023/007


                                                        [Proc. PS-2022/015-File RCO-2020/088]




                    RESOLUTION OF SANCTIONING PROCEDURE



Subject: Resolution of resolution of sanctioning procedure against the [educational center]

(Department of Education and Sports) for an alleged violation of protection regulations

of personal data.




                                        BACKGROUND




First. On December 23, 2020, [XXXXX] (hereinafter, the claimant), filed

claim before the Transparency and Data Protection Council of Andalusia (hereinafter,

the Council) against the [educational center] (hereinafter, the claimed body), for an alleged

violation of personal data protection regulations.


The aforementioned claim stated:


   "[…] FIRST.


   From the beginning of the current 2020/2021 school year and by decision of the Head of the

   Department [name of department], endorsed by all members of the referred

   department, with the exception of the complaining person, the

   sessions corresponding to the meetings of the aforementioned body (specifically and until the

   moment those developed on days [dd/mm/yy]; all this without having been addressed with character

   prior to any modification of the Regulations for the Organization and Operation of the Plan of

   Center, in order to provide said actions with the necessary guarantees, established in the

   Regulation (EU) 2016/679, as well as in the aforementioned Organic Law 3/2018, of 5

   December, Protection of Personal Data and guarantee of digital rights.


   Similarly, the head of the Directorate of the [educational center] has been recording audio

   all the sessions of the Faculty Senate that have taken place in this course




Resolution (File RCO-2020/088)

Page 1 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.es without undertaking any regulatory modification in this regard, in application of the standards

   mentioned above.


   SECOND.

   Dated [dd/mm/yy] the claimant, whose arguments expressed in a manner

   verbal opposition to the aforementioned recordings were completely ignored by the Headquarters

   of the department and the director of the [educational center] himself, addressed separate letters to the


   Territorial Delegation in Granada of the Ministry of Education and Sports and the Director of the

   [educational center], respectively, in which it warned of its irregular nature, contrary to the

   European and Spanish regulations on the matter, given their complete non-observance of the

   fundamental right to the protection of personal data, requesting the cessation of

   said actions and the reestablishment of the grossly violated legality. To the effects

   appropriate evidence, copies of the aforementioned writings are attached as documents No. 1 and

   nº2 respectively (paragraphs relating to other matters have been deleted, including

   in them).


   In effect, the claimant alleged in his writings that he had not been informed in

   in any way of the security measures adopted, of a technical and organizational nature, to

   guarantee the security of the personal data collected, that is, its integrity and

   confidentiality and protection against unauthorized or illicit processing and against its

   accidental loss, destruction or damage. Likewise, he had not been informed of the

   measures taken to guarantee that all those who have access to the

   personal data could only process said data in the exercise of the functions they have


   assigned; since not even a deadline had been set for its conservation, ignoring the

   mandate inherent in the aforementioned norms that orders to preserve them for the time

   strictly necessary for the purposes for which they were collected and to address

   the responsibilities that may arise from their treatment, so that when

   cease to be necessary or relevant for said purpose, their

   destruction.


   [...]

   And as one might expect, the mandatory delegate of education does not exist in the [educational center] either.

   data protection, a legal figure of outstanding importance in Regulation (EU) 2016/679,





Resolution (File RCO-2020/088)
Page 2 of 34 Document suitable for publication on the Portal del Cwww.ctpdandalucia.es subsequently incorporated into Spanish legislation (art. 34.1.b) of Organic Law 3/2018,

   of December 5, Protection of Personal Data and guarantee of digital rights).

   ROOM.


   To date, none of the aforementioned writings have received any response, not even from the

   address of the [educational center] nor of the Territorial Delegation of Education and Sports,

   It is understood that the actions denounced have the implicit protection of

   both instances, with everything that this entails.


   And all this despite the fact that the aforementioned legislation requires that the administrations

   public authorities expressly, clearly and precisely inform the purpose of the recordings, the

   rights of the interested parties and how to exercise them and of the person responsible for the treatment of the

   data obtained, as well as the identity of the data protection officer (figure

   contemplated in the merited Organic Law 3/2018 for educational centers) and the term of

   conservation of said data or the criteria to determine it; none of which, as has

   exposed, has been duly satisfied by the management of the [educational center] (with

   the acquiescence of the Territorial Delegation of Education and Sports), aware of these

   facts and who was responsible, in any case, for having promoted with all diligence the

   modification of the Organization and Functioning Regulations of the center in order to grant

   due guarantees to the recordings made by the Head of the Department of [name of

   department] and by the director of the center himself, among them, the non-use of the data


   personal data for purposes other than those for which they were theoretically obtained, the

   security measures to be implemented to prevent its subsequent alteration and destruction in the

   Right moment. […]”.

Along with the claim, a copy of the document presented by the claimant was provided,


on [dd/mm/yy], before the Territorial Delegation in Granada of the Ministry of Education and

Sports and before the [educational center].



Second. Pursuant to articles 37 and 65 of Organic Law 3/2018, of December 5, of

Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD),

On January 11, 2021, the claim was transferred to the Protection Delegate of

Data from the Ministry of Education and Sports (hereinafter, DPD) so that, within the period

maximum of one month, will communicate the response given to the claim and, where appropriate, the



Resolution (File RCO-2020/088)

Page 3 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.esactuations carried out in relation to it.


In response to the previous request, on February 11, 2021, he joined the Council

DPD report where, among other issues, it reported:


      “[…] This means that there is no registration activity in the Department's RAT.

      treatment that consists of recording and/or video recording of meetings held

      electronically, although this DPD will propose to the bodies

      responsible for the Ministry's implementation."


Likewise, the DPD attached a letter sent to the complainant, dated February 10

of 2021, as well as a report from the Director of the [educational center] where, among other issues,

indicated that:


      "[…] First. –On “if the recording of the sessions of the collegiate bodies of the center

      "It appears specifically provided for in its organization and operating regulations."


      In the organization and operation regulations (ROF) of the [educational center] it appears

      the recording of the sessions of the collegiate bodies of the center from day 2 of

      February 2021, approved by the School Council after being informed by the Senate. With

      Previously, this modification had not been contemplated, since the modifications of the

      ROF must be carried out prior to November 15 as a result of the

      proposals that arise from the self-evaluation report of the 2019-2020 academic year.


      [...]

      Thus, according to article 18 of Law 40/2015, of October 1, on the Legal Regime of the

      Public Sector (Official State Gazette of 02-10-2015) in point 1. From each session

      held by the collegiate body, minutes will be drawn up by the Secretary, who will specify


      necessarily the attendees, the agenda of the meeting, the circumstances of the

      place and time in which it was held, the main points of the deliberations, as well as

      as the content of the agreements adopted.

      The sessions held by the collegiate body may be recorded. The file resulting from

      the recording, together with the certification issued by the Secretary of authenticity and

      integrity of the same, and how many documents in electronic format were used as






Resolution (File RCO-2020/088)

Page 4 of 34 Document suitable for publication on the Cowww.ctpdandalucia.es Portal. Session documents may accompany the minutes of the sessions, without the need for

      record in it the main points of the deliberations.


      From the center's management it was understood from the beginning of the course that, under the protection of said

      law, the sessions of the collegiate bodies could be recorded and by analogy of

      functioning of the teaching coordination bodies, with the sole intention of being able to

      reflect in a reliable and authenticated manner what was discussed at said meeting.

      The recordings of these sessions have no other purpose than the situation


      extraordinary and innovative in educational centers where, as advised by

      Instructions of July 6, 2020, from the Vice-Ministry of Education and Sports, regarding the

      organization of teaching centers for the 2020/2021 school year, motivated by the crisis

      health of covid19, where it says “the part of the non-school schedule and mandatory permanence

      in the civil servant teaching center will be carried out, in general, in a

      telematics, prioritizing work meetings through videoconference”, being able

      transfer to the minutes of the different bodies the content of said session by the

      secretary with the greatest possible reliability, since the operation is far from being the same

      than in a face-to-face session.


      The unexpected circumstances caused by COVID-19 force us to carry out the

      telematic meetings. Therefore, with the advice of the inspector of

      reference of the center, on February 2, 2021, it was unanimously approved in the

      school board of the [educational center], the modification of the ROF that adapts to the

      current situation giving coverage to the recording that was already being produced of these

      meetings, as the teaching staff had previously been informed from the

      beginning of course.


      The recordings of the sessions of the collegiate and teaching coordination bodies are

      carried out through the official digital platform that the Ministry of Education and Science

      of Andalusia has put at our disposal with all the security guarantees

      necessary: Moodle Centers.


      Second. – Regarding “if, prior to recording the sessions, people are informed

      interested parties from all the extremes required by article 13 of the General Regulation of

      Data Protection".





Resolution (File RCO-2020/088)
Page 5 of 34 Document suitable for publication on the Con Portalwww.ctpdandalucia.es Prior to the recordings, the faculty and the coordinating body are informed

      teacher that said session is going to be recorded. From the first faculty session of the

      This course it has been notified that said session is going to be recorded.


      The content of the Cloister and Teaching Department sessions is of a

      Totally professional, none of them contain personal data.


      […]

      Likewise, I inform you that in the recordings made that the person alludes to

      complainant [XXXXX], appears with his image turned off and identified through a nickname

      “[XXXXX]”, without appearing their name and surname or image.


      […]”.


Third. The claim began its processing in accordance with the procedure established in the

Title VIII of LOPDGDD, and by virtue of article 67.1 thereof, dated March 16,

2021, the director of the Council ordered the start of prior investigation actions to the


purposes of achieving a better determination of the facts and circumstances that justified the

processing of a possible sanctioning procedure.


Room. Within the framework of these actions and with the aim of completing the information


related to the reported events, on May 10, 2021, the Council requested

to the DPD to send information and documentation on the causes that had motivated

the incident and the actions carried out in relation to the claim. Specifically, it

had to send:


  - Copy of supporting documentation related to the evaluations that were made on the

    different options to implement as a control system, including, where appropriate, the

    corresponding risk analysis.

  - Copy of the record of treatment activities related to the aforementioned activity, with the


    data required by article 30 GDPR and its legal basis. In particular the legitimizing basis

    for the processing of the data object of the claim by the Department of

    [name of the department], since this is not constituted as a collegiate body.





Resolution (File RCO-2020/088)

Page 6 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.es - Copy of the informative document for interested parties on the processing of their data

    personal data [articles 13 and 14 GDPR].

  - Information on the technique used to control access to recordings by

    of staff on the Moodle Centros digital platform.


  - If applicable, copy of the instructions given by the person responsible for the treatment in

    relation to the access and processing of the data object of the recording, with indication of

    the way in which said instructions have been disclosed.

  - Where applicable, information on the existence of security measures, standards,

    procedures, rules that may exist in the aforementioned Center or established by the


    controller on how data protection is ensured

    of the people affected by the recordings.

  - Any other information or documentation that you consider relevant.


In response to the previous request, on June 4, 2021, the DPD sent this Council

report from the Director of the [educational center] which stated, among other issues, that:


      “[…] 3.-Copy of the informative document for interested parties on the treatment of

      your personal data (articles 13 and 14 GDPR)

      The processing of personal data of all center staff is collected

      in our Center Plan, specifically in the Management Project.


      According to the LEA (Art. 126), the Center Plan is a document that is made up of: the

      educational project, the organization and operating regulations and the

      management. The Center Plan is a public and multi-year document, it obliges and relates to

      the entire Educational Community, and at all times its knowledge is facilitated,

      in the center itself and on our website [educational center website].


      Thus, within the Center Management Project, (can be consulted in our

      website [educational center website]), in section 9, page 79, everyone is informed

      center staff regarding the processing of your personal data:

      […]








Resolution (File RCO-2020/088)

Page 7 of 34 Document suitable for publication on the Cowww.ctpdandalucia.es Portal 5.- If applicable, copy of the instructions given by the person responsible for the treatment

      of the data subject to the recording, with an indication of the way in which it has been disclosed

      these instructions.


      The unexpected circumstances caused by COVID-19 force us to carry out the

      telematic meetings. For this reason, the modification of the ROF was approved in

      CHAPTER I, Section 2 on Faculty Participation, by the faculty of

      teachers with only 1 vote against and unanimously in the school council of the

      [school]. The following paragraph was added:


      THE functioning of the teaching coordination bodies of the [center website

      educational] (Departments, Educational Teams, ETCP...), by analogy it will be equal to the

      functioning of a collegiate body. The legal regime of the collegiate bodies

      will comply with the rules contained in Law 40/2015, of October 1, of Regime

      Legal of the Public Sector.


      Based on article 18 of the aforementioned law:

      [...]


      The ROF of the [educational center] can be consulted on our website [school website

      educational]


      The recordings of the sessions of the collegiate and teaching coordination bodies are

      carried out through the official digital platform that the Ministry of Education and Science

      of Andalusia has put at our disposal with all the security guarantees

      necessary: Moodle Centers.


      [...]

      7.-Any other information or documentation that you consider relevant.              [center


      educational]

      Finally, I would like to state, as I did in the previous report that was sent to me

      requested that the management of the [educational center] has always acted in good


      faith, trying to be faithful to reality, and keeping in mind the regulations in force.

      Likewise, I want to state that there is no type of complaint from the community

      educational about data processing at the center, with the exception of this teacher.




Resolution (File RCO-2020/088)
Page 8 of 34 Document suitable for publication on the Portal del Conswww.ctpdandalucia.es We understand that this complex situation that we are experiencing due to the crisis

      health, especially in educational centers, may reveal some

      irregularity in the procedure of the operation of the collegiate bodies or of

      teaching coordination, since it is not the usual one that had been carried out until March

      2020.”


Fifth. After completing the report corresponding to the previous investigation actions,


On July 19, 2022, the director of the Council issued the Agreement to Start the procedure

sanctioning against the [educational center] (Department of Education and Sports), with NIF S4111001F,

for the alleged violations of articles 6 and 13 RGPD, typified in articles 83.5.a) and

83.5.b) RGPD, and punishable with a warning in accordance with article 77.2 LOPDGDD.



Sixth. Once the initiation agreement was notified to the claimed body, it, on August 8, 2022, presented

brief of allegations in which, in summary, he stated the following:


      “[…] FIRST.- A distinction is made in the agreement to initiate the sanctioning procedure

      between the governing bodies and the teaching coordination bodies to conclude that

      The latter are not collegiate bodies and, consequently, the

      established in article 18 of the LRJSP regarding the recording of its sessions.


      In this regard, it is worth mentioning that Organic Law 2/2006, of May 3, on Education,

      under the provisions of the same CHAPTER III of Title V, establishes which bodies are

      members of government and teaching coordination of public centers, pointing out

      those that follow: School Council (Section 1), Faculty of Teachers (Section 2) and Others

      teaching coordination bodies (Section 3), among which are the

      didactic departments.


      We must highlight that the School Council, Faculty of Teachers and Other governing bodies

      Teaching coordination is regulated in the same chapter of Organic Law 2/2006,

      mentioned above, therefore, subjecting it to a hermeneutical criterion of interpretation,

      It could be deduced that they have a common characteristic, which is the one referred to in the title of the

      cited chapter, that is, that they are collegiate bodies. This interpretation remains

      reinforced if we analyze what the aforementioned legal body dedicates the following chapter to, which, in






Resolution (File RCO-2020/088)

Page 9 of 34 Document suitable for publication on the Cowww.ctpdandalucia.es Portal, in contrast to collegiate bodies, is dedicated to single-person bodies:

      director, head of studies and secretary.


      Likewise, if we go to a grammatical analysis, when the third section refers to “Others

      teaching coordination bodies” it can be deduced that the “others” cannot exist,

      without the “ones”, which are nothing more than those referred to in the first and second sections.

      Therefore, it is considered that the fact that Decree 327/2010, of July 13, by the

      that the Organic Regulations of Secondary Education Institutes are approved, in


      its article 48.1, as expressly cited by that Council in its initial agreement, in the

      fifth legal consideration, in fine, states that “The School Council and the Faculty

      Faculty are the collegiate governing bodies of educational institutes

      secondary”, which is true, it cannot be inferred that the rest of the organs should not

      be considered as collegiate bodies, since what, in the opinion of the undersigned, is

      inferred from said normative premise is that the “Other teaching coordination bodies”

      They are not governing bodies, but rather teaching coordination bodies, but it cannot be deduced

      that are not collegiate bodies, especially if analyzed in light of what is included in

      the previous paragraphs on the analysis of the organic law, from which this

      Decree, as a regulatory development.


      For this reason, it is considered that they are collegiate bodies of teaching coordination, but not of

      government. Excluding these bodies from the consideration of collegiate bodies means,

      judgment of the undersigned, and in the terms cited above, go against the principles of

      interpretation of the rules established in article 3 of the Civil Code.


      For completeness, it should be noted that, apart from the didactic departments,

      educational teams or boards of directors also meet in a collegial manner.

      evaluation that make their decisions using the majority system, which is what

      relevant for the purposes of considering the operation in a collegiate manner.


      SECOND.- It is therefore appropriate to analyze whether, in the case of the departments

      of didactic coordination, the requirements established in article 20 of the

      Law 40/2015, of October 1, on the Legal Regime of the Public Sector (hereinafter

      LRJSP), regarding the constitution of collegiate bodies. And it is included, with special

      emphasis, the public powers that are exercised by the teaching staff and by the





Resolution (File RCO-2020/088)
Page 10 of 34 Document suitable for publication on the Cowww.ctpdandalucia.es Portal of the departments, as justification of the legality in the processing of data

      personal character.


      In this regard, it is worth pointing out the following:

      - The teaching departments have been formally created: article 130.2 of the Law

      Organic 2/2006; article 82.1 g) and article 92 of Decree 327/2010, of July 13, by

      which approves the Organic Regulations of Secondary Education Institutes.


      - They are made up of three or more people. Specifically, in the case of

      Department of [name of department], has been integrated into the course

      2021/2022 by [nn] people.


      - Has assigned administrative functions of decision, proposal, advice,

      monitoring or control:


      • Article 130.2 of Organic Law 2/2006, of May 3, on Education.

      • Article 92.2 of Decree 327/2010, of July 13, which approves the

      Organic Regulation of Secondary Education Institutes [...].


      • Order of January 15, 2021, by which the curriculum corresponding to

      the stage of Compulsory Secondary Education in the Autonomous Community of Andalusia

      […].


      • Article 19.1 of the Order of August 20, 2010, which regulates the

      organization and operation of secondary education institutes, as well as the

      hours of the centers, of the students and of the teachers (proposal for the distribution

      between the teaching staff of the subjects, modules, areas, courses, groups and, where appropriate,

      shifts assigned to them).


      - Decree 327/2010, cited above, establishes its integration into the structure of the center

      and its dependence on the governing bodies of the center and the departments

      (Teaching faculty, department head, head of studies and management,

      fundamentally).


      - Has established the criteria for the designation of the person to whom it corresponds

      the exercise of leadership of the department (article 95.1 of Decree 327/2010).






Resolution (File RCO-2020/088)
Page 11 of 34 Document suitable for publication on the Con Portalwww.ctpdandalucia.es - Part of its operating regime is normatively established, as it is

      attributes to the person who heads the department the competence to

      “Convene and chair department meetings and take minutes thereof”

      (article 94 b) of Decree 327/2010), which must be put in relation to articles 17

      to 19 of the LRJSP.


      - The material and economic allocations that correspond to you for your

      operation (article 94 d) and e) of Decree 327/2010).


      - All the regulations, previously mentioned, are published in the Official Gazette of the

      Junta de Andalucía and serve as a basis for the exercise of decision-making powers

      (such as, to highlight an example, the review of the final grade

      obtained by the students or on the decision of promotion and qualification).

      THIRD.- Regarding the DUTY OF INFORMATION to the person who owns the data about


      the object of the treatment, the REGULATIONS OF ORGANIZATION AND OPERATION of the

      [educational center], includes in its chapter I, section 2, referring to “The participation of

      Teaching Staff” that “Based on article 18 of the aforementioned law: The sessions that

      celebrate the collegiate body. The file resulting from the recording, along with the certification

      issued by the Secretary of the authenticity and integrity of the same, and how many documents

      in electronic format were used as session documents, they may accompany the

      minutes of the sessions, without the need to record in it the main points of the

      deliberations.”


      In this sense, article 68 i) of Decree 327/2010, establishes among the functions of the

      Faculty Senate, of which the person filing the claim is a member,

      the competence to “Inform the regulations of organization and operation of the

      institute”, prior to its approval by the School Council.


      The aforementioned regulation, on a mandatory basis, must contemplate “The criteria and

      procedures that guarantee rigor and transparency in decision-making by the

      different governing and teaching coordination bodies, especially in the processes

      related to the schooling and evaluation of students” (article 26.2 b of the

      Decree 327/2010). Likewise, in the third section of the aforementioned article it is stated that

      "In the preparation of the organization and operating regulations, they may carry out

      suggestions and contributions to it from the teaching staff, administration staff and



Resolution (File RCO-2020/088)
Page 12 of 34 Document suitable for publication on the Portal of the Conwww.ctpdandalucia.es services and complementary educational attention, the boards of delegates of the

      student body and the associations of the students and parents of the students.”


      Likewise, article 22.3 of the aforementioned Decree establishes that “The Teaching Staff

      will make proposals to the management team for the preparation of the Center Plan, will establish

      criteria regarding the orientation and tutoring of students, will inform the regulations of

      organization and operation and will approve and evaluate the educational aspects of the Plan of

      Center referred to in letters b), c), d), e), f), g), k), m), ñ), o), p) and q) of article 23.3”.


      From this we deduce the necessary knowledge of the Center Plan, of which the

      regulation of organization and operation is an integral part, it must have all the

      faculty of the center, configuring, not only as a right, participation in the

      preparation and approval of the same (through the coordination departments

      didactics and the teaching staff), but is constituted as a duty of

      mandatory compliance, in application of what is established in article 22.4 of the Decree:


      "4. The Center Plan, which will have a multi-year nature, will obligate all the institute's staff

      and will link its educational community. It may be updated or modified, as appropriate.

      case, after the self-evaluation processes referred to in article 28 or at the proposal of the

      director depending on his or her management project.”


      Regardless of whether or not there was an express provision in the organization and

      operation, and being a legal provision, if it is planned that the meeting

      corresponding is recorded, the members of the body must be informed and

      approved its implementation in the manner determined by the aforementioned regulations or, in its

      default, by majority vote.


      The information that, as a member of the collegiate body, you must have at your disposal,

      is guaranteed, since its members have the right to have a copy sent to them

      of the Act (article 18.2 of Law 40/2015).

      Therefore, it is not considered that there has been a lack of information to the people


      members of the department about the fact that the recording of

      a certain session.

      Nor has it been justified in a concrete way, with all due respect, and in

      strict terms of defense, the factual assumptions that determine the special




Resolution (File RCO-2020/088)
Page 13 of 34 Document suitable for publication on the Portal del Conwww.ctpdandalucia.es seriousness that is considered due to the lack of imputed information and that, in the opinion of that

      Council, are deserving of the most serious classification of the infraction [ art. 72.1 hours of the

      LOPDGDD ] instead of the general breach of the right to information of the

      affected by not providing all the information required by articles 13 and 14 of the

      Regulation (EU) 2016/679, which establishes article 74 a) of the aforementioned Organic Law, and

      which is considered a minor infraction, so it is warned of a possible

      incorrect qualification and grading of the proposed offenses and sanctions.


      Likewise, if this were considered by the Transparency and Transparency Council

      Data Protection of Andalusia, and with a subsidiary nature to the above, it is requested, to the

      protection of the provisions of article 77.2 of Law 39/2015, that the

      opening of a trial period in which people's statements are collected

      that make up the Department of [name of department], so that the

      knowledge of the aspects derived from the recording of the session, the context of the

      list of services as officials in which it is carried out and its purpose,


      evidence that is requested to be considered requested at the proposal of the person formulating the

      present allegations.

      FOURTH.- Regarding the LICITUDE OF THE TREATMENT, express reference has already been made

      to the different foundations in which, apart from its technical consideration as


      collegiate bodies or not, the exercise of administrative powers by the

      of the didactic coordination departments that undoubtedly affect the

      sphere of rights of users of the public educational service, with special

      reference to the process of evaluating student learning (which greatly affects

      intensity to the personal, vital and professional development of people) and that is found

      inserted, both in the very configuration of the didactic programs and the criteria

      and evaluation instruments, which are a procedural guarantee for students

      in said process; as in the review procedures for claims

      against final grade obtained. Both are powers attributed to the

      didactic coordination departments.


      Consequently, it is considered that the teaching center and the educational Administration

      are entitled to collect and process personal data, in accordance with the provisions

      in article 6.1, letters c) and e) of the European Data Protection Regulation 2016/679




Resolution (File RCO-2020/088)
Page 14 of 34 Document suitable for publication on the Cowww.ctpdandalucia.es Personal Portal and articles 15 to 18 of Law 40/2015, of October 1, Regime

      Public Sector Legal.


      Likewise, it should be noted that the aforementioned actions take place within a framework

      characterized by the pandemic situation in which the sessions of the different

      organs of the center were carried out electronically and the recording of the sessions

      represented an additional guarantee of the rights of users, especially

      of the students, which the teachers and the different departments of the center

      education still had the obligation to respect and the governing bodies in

      ensure that they are fulfilled.


      In this sense, being a power included in the regulations, the sessions may

      be convened in person or remotely as long as it is ensured by means

      electronic devices, telephone and audiovisual devices also being considered as such, the identity

      of the members (Article 17.1), the recording is considered an appropriate element

      to achieve this objective.


      In this sense, for the 2020/2021 academic year, the INSTRUCTIONS OF JULY 6, 2020,

      OF THE VICE-MINISTRY OF EDUCATION AND SPORTS, RELATING TO THE ORGANIZATION OF

      THE TEACHING CENTERS FOR THE 2020/2021 SCHOOL YEAR, MOTIVATED BY THE

      COVID-19 HEALTH CRISIS, included in their tenth instruction, section 6, what

      go on:


      6. Without prejudice to the in-person attention of the on-call service in those centers in which

      that this is contemplated, the part of the non-school schedule and mandatory stay at the center

      of civil servant teaching will be carried out, in general, electronically,

      prioritizing work meetings via videoconference. However, it

      will attend in person by appointment, during the hours authorized for this purpose, at

      families who have difficulties accessing electronic tutoring.


      And for the 2021/2022 academic year, the INSTRUCTIONS OF JULY 13, 2021, OF THE

      VICE-MINISTRY OF EDUCATION AND SPORTS, RELATING TO THE ORGANIZATION OF THE

      SCHOOL CENTERS AND CURRICULAR FLEXIBILIZATION FOR THE SCHOOL YEAR

      2021/22, in its ninth instruction, section 6, stated the following:







Resolution (File RCO-2020/088)
Page 15 of 34 Document suitable for publication on the Cowww.ctpdandalucia.es Portal 6. Without prejudice to the in-person attention of the on-call service in those centers where

      that this is contemplated, the part of the non-school schedule and mandatory stay at the center

      of the civil servant teaching staff may be carried out, in general, in a

      telematics. However, it will be attended in person by appointment, during the hours

      enabled for this, to families who have difficulties accessing tutoring

      electronics.


      In default, which is considered, as expressly provided for in the Regulations of Organization and

      Operation, the agreement for the recording of the sessions of the collegiate bodies

      of the educational center must be considered adopted by majority vote (Article 17.5)


      On the other hand, the arguments already included in the preceding allegations, with special

      reference to the second allegation, in the opinion of the undersigned, determine that “the

      processing is necessary for compliance with a legal obligation applicable to the

      responsible for the treatment” and that “the treatment is necessary for the fulfillment of a

      mission carried out in the public interest or in the exercise of public powers conferred on the

      responsible for the treatment", considering that, in the present case, the

      conditions of legality of article 6.1, sections c) and e) of European Regulation 2016/679,

      of April 27, 2016, on Protection of Personal Data.


      The processing of the data is for the calling of the sessions and in the case of the

      recording of these, for exclusive consultation of the matters incorporated in the order

      on the day of the meetings.


      The personal data incorporated in the minutes will be kept indefinitely with

      archival purposes, without being able to be treated for other purposes, except scientific or statistical.


      In this regard, the request formulated in the third allegation, in fine, is reiterated.

      regarding the proof of the aforementioned extremes regarding the adequate knowledge by

      part of the rest of the members of the Teaching Coordination Department of [name

      from the Department]


      FIFTH.- For all these reasons, it is not considered that the processing of personal data has been

      done without any of the conditions of legality established in article 6.

      of the European Regulation, cited above.






Resolution (File RCO-2020/088)
Page 16 of 34 Document suitable for publication on the Portal del Conwww.ctpdandalucia.es Consequently, with the above, it is not considered that any

      very serious violation, of those contemplated in article 72 of Organic Law 3/2018,

      of December 5, Protection of Personal Data and guarantee of rights

      digital.


      For this reason and there being, at least, reasonable doubts of legal interpretation,

      as well as especially burdensome conditions for the operation of the center

      educational in a pandemic situation that has seriously conditioned the

      functioning of educational centers, and, consequently, the conditions in

      that public employees perform their public function, or their

      responsibility, in the case of governing bodies, it is not considered that the

      reported conduct is reprehensible, since, in an unprecedented situation of

      provision of public service by telematic means, the only thing that has existed is the

      maximum zeal to guarantee compliance with legal obligations and powers

      that make up the public educational service.


      And this is because, since the procedure initiated has a sanctioning nature, it should not

      absolutely disregard the assessment of the voluntariness or negligence of the subject

      obliged.


      Said public service, apart from a duty for the educational Administration and for the

      educational centers, is configured as a fundamental right whose exercise

      corresponds to a multiplicity of people, which must be put in relation to the

      right that is reported to have been infringed and whose ownership affects a single person.


      Ultimately, from everything previously stated, it is inferred the absence of the conduct

      typical attributed by that Council to this educational center, being able to extract the

      following conclusions:


      As has been based on the preceding allegations, with special reference to the

      second section of this writing, the treatment has been carried out with the conditions of

      legality established in article 6.1 c) and e) of European Regulation 2016/679.


      Likewise, with respect to the information on the processing of the data of which it is

      owner, the person who files the claim is accredited, not only the

      knowledge of all the points contemplated in article 13 of the Regulation




Resolution (File RCO-2020/088)
Page 17 of 34 Document suitable for publication on the Portal of the European Cowww.ctpdandalucia.es 2016/679, but the legal obligation to know them, in your capacity as a teacher,

      public official, member of the department and the Faculty,

      The members of the Department of Information have also been informed.

      didactic coordination of [name of department] on the occasion of the celebration of

      each of the sessions of the department, without prejudice to what is determined, in its

      case, in the testing phase.


      For all these reasons, in use of the powers conferred,

      SOLICITOUS:


      FIRST.- Please consider this document presented, please admit it, and in merit of what

      exposed, considers ALLEGATIONS formulated against the agreement to start

      sanctioning procedure, identified at the beginning, by which the

      sanctioning file initiated for the imposition of two very serious offenses, typified

      in articles 72.1, sections b) and h), respectively.


      SECOND.- Considering, based on said allegations, that the

      factual assumptions necessary for the consideration of the existence of any of

      the infractions included in title IX of the LOPDGDD, or, at least, that said facts

      clearly constitute an administrative infraction, and, after processing the

      procedure, proceed to annul the agreement to initiate the procedure

      sanctioning, considering it contrary to law.


      THIRD.- Subsidiarily to the above, and in the event that it is decided

      continue with the processing of the procedure, it is agreed, under the provisions established

      in article 77.2 the opening of a trial period, which enables, after

      notification to this party, the proposal of those that are appropriate to its right, among which

      Those included in the third section, in fine, of the allegations are found

      contained in this writing.”



Seventh. On September 16, 2022, the Council notified a letter to the

claimed body, by virtue of which he was informed that, in accordance with the principle of

“proactive responsibility”, it is up to the data controller to demonstrate the

conformity of the treatment activities carried out, in the terms established in the

article 5.2 and recital 74 GDPR, so what was requested in his written notice was not appropriate.



Resolution (File RCO-2020/088)

Page 18 of 34 Document suitable for publication on the Cowww.ctpdandalucia.esalegaciones Portal, dated August 8, 2022, in which it requested this organization to collect the

declaration of the people who make up the Department of [name of department].


Likewise, the requested body was required to, in order to complete the

documentation that would allow the ongoing procedure to be resolved, to send to this Council the

documentation that it deems appropriate to support and prove that the proceeding was

appropriately to fulfill the duty to inform interested parties about the treatment


of the personal data in the processing object of the claim, with express indication of the

detailed information that was provided to all affected people.


In response to the previous request, dated October 7, 2022, it was entered into this

Tip the following documentation:


  - Writing from the Director of the Center certifying who the members of the Center had been.

    Department of [name of department] during the 2020-2021 academic year, as well as

    All members of the aforementioned Department attended the telematic session of the

    [dd/mm/yy].

  - Copy of various writings from members of the Department of [name of department]

    where they certified that in the [dd/mm/yy] session they were informed that it was going to be

    recorded, as well as the identity and address of the person responsible for the treatment and the

    purpose of the processing of personal data: “I declare that in the telematic session of the


    Department dated [dd/mm/yy], by D. [...] the members of the

    Department of [name of department] that the aforementioned meeting and the subsequent ones, held

    by videoconference, they were going to be recorded.”



Eighth. Once the instruction of the procedure was completed, the corresponding


proposed resolution, which was notified to the alleged infringer on April 11, 2023,

establishing a period of ten days for the formulation of allegations, in accordance with the

article 89.2 LPACAP and in relation to article 73.1 of the same standard.


After the aforementioned period and until the date of this Resolution, there has been no

entry no allegation by the instituted body.




Resolution (File RCO-2020/088)

Page 19 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.es PROVEN FACTS


From the documents in the file and the actions carried out, they can

be considered as proven facts:



First. According to the statements of the DPD, it currently does not exist in the Registry of

Treatment Activities of the Department of Educational Development and Vocational Training, 1

no treatment activity consisting of recording session videoconferences


of collegiate bodies, of administrative units of the Ministry, nor of its centers and

educational services, nor of any other nature.



Second. Since [dd/mm/yy], at the [educational center], the meetings of the

Department [name of department].



Third. Until February 2, 2021, the date on which the Regulations of

organization and operation [educational center], the recordings of the

sessions of the coordinating bodies of the Institute, being the sessions of the Department of

[department name], recorded, between [dd/mm/yy] and [dd/mm/yy] .



Room. The claimed body has proven that it informed those attending the telematic session

held, on [dd/mm/yy], that the same and subsequent meetings were going to be recorded,

providing the identity and address of the person responsible for the treatment, as well as the purpose for the

that the personal data would be processed, but it has not been proven that the Institute

inform you of all the details required by article 13 GDPR.



Fifth. It has not been proven that the Institute informed the members of the

Department attending the sessions held in [dd/mm/yy] and [dd/mm/yy] that these

were going to be recorded and it has not been proven that they were informed of the extremes


required by article 13 GDPR.





1
    Name of the Ministry after Presidential Decree 10/2022, of July 25.


Resolution (File RCO-2020/088)

Page 20 of 34 Document suitable for publication on the Cwww.ctpdandalucia.es Portal FUNDAMENTALS OF LAW




First. The competence to resolve the sanctioning procedure due to possible

breach of personal data protection regulations, in relation to the facts

described, corresponds to the director of the Council by virtue of the provisions of articles 43.1 and

48.1 i) of Law 1/2014, of June 24, on Public Transparency of Andalusia (hereinafter,

LTPA), in articles 10.3.b) and 10.3.i) of the Statutes of the Transparency Council and

Data Protection of Andalusia (approved by Decree 434/2015, of September 29) and in

articles 57 and 64.2 LOPDGDD.


The Council, as the autonomous authority for the protection of personal data, and within its

jurisdiction, exercises the functions and powers established in articles 57 and 58

GDPR.



Second. Article 1.1 GDPR establishes that “[t]his Regulation establishes the rules

relating to the protection of natural persons with regard to data processing

personal data and the rules relating to the free circulation of such data. According to article 4.1

GDPR means “personal data”, “[a]ll information about an identified natural person or

identifiable ("the interested party"); An identifiable natural person will be considered any person whose


identity can be determined, directly or indirectly, in particular by means of an identifier,

such as a name, an identification number, location data, an identifier

online or one or more elements of the physical, physiological, genetic, psychological,

economic, cultural or social of said person.”


For its part, article 2.1 GDPR provides regarding its scope of application that “[t]he

This Regulation applies to the fully or partially automated processing of data

personal data, as well as the non-automated processing of personal data contained or intended

to be included in a file”, defining the concept of “treatment” in article 4.2 RGPD

as “any operation or set of operations carried out on personal data or

sets of personal data, whether by automated procedures or not, such as the collection,

registration, organization, structuring, conservation, adaptation or modification, extraction,





Resolution (File RCO-2020/088)

Page 21 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.esconsulta, use, communication by transmission, dissemination or any other form of authorization

of access, collation or interconnection, limitation, suppression or destruction.”


According to the previous definitions, and in relation to the case at hand, the voice of a


person, must be considered personal data since it is information about a

identified or identifiable natural person to whom treatment is performed. Therefore,

both the personal data collected and the subsequent processing carried out on the

They must comply with the provisions of the data protection regulations.

personal.


The processing operations observed in relation to the personal data (voice) of

The teachers are the ones who carry out the requested body to audio record the sessions.

corresponding to the meetings of the Department of [name of department].



Third. One of the principles established in article 5 GDPR in relation to the

processing of personal data is that of “legality, loyalty and transparency”, included in the

section 1 a) of the aforementioned article: personal data will be “treated in a lawful, fair manner

and transparent in relation to the interested party.”


For its part, article 6.1 GDPR states regarding the “legality of the processing” that:


   "1. The treatment will only be legal if at least one of the following conditions is met:


   a) the interested party gave his or her consent to the processing of his or her personal data for one or

   several specific purposes;

   b) the processing is necessary for the execution of a contract in which the interested party is a party or

   for the application at his request of pre-contractual measures;


   c) the processing is necessary for compliance with a legal obligation applicable to the

   responsible for the treatment;


   d) the processing is necessary to protect vital interests of the interested party or of another person

   physical;

   e) the processing is necessary for the fulfillment of a mission carried out in the public interest or in

   the exercise of public powers conferred on the data controller;




Resolution (File RCO-2020/088)

Page 22 of 34 Document suitable for publication on the Portal del Conswww.ctpdandalucia.es f) the processing is necessary for the satisfaction of legitimate interests pursued by the

   responsible for the treatment or by a third party, provided that said interests do not prevail

   the interests or fundamental rights and freedoms of the interested party that require protection

   of personal data, particularly when the interested party is a child.


   The provisions of letter f) of the first paragraph will not apply to the treatment carried out by

   public authorities in the exercise of their functions.


On the other hand, article 13 GDPR refers to the "Information that must be provided when the

personal data are obtained from the interested party", and establishes that:


       "1. When personal data relating to him or her is obtained from an interested party, the person responsible for the

       treatment, at the time these are obtained, it will provide you with all the information

       indicated below:


       a) the identity and contact details of the person responsible and, where applicable, their representative;

       b) the contact details of the data protection officer, if applicable;


       c) the purposes of the processing for which the personal data are intended and the legal basis of the

       treatment;


       d) where the processing is based on Article 6(1)(f), legitimate interests

       the person responsible or a third party;

       e) the recipients or categories of recipients of the personal data, where applicable;


       f) where applicable, the intention of the controller to transfer personal data to a third country or

       international organization and the existence or absence of a decision on the adequacy of the

       Commission, or, in the case of transfers indicated in articles 46 or 47 or article

       49, paragraph 1, second subparagraph, reference to adequate or appropriate guarantees and the

       means to obtain a copy of these or to the place where they have been made available.


       2. In addition to the information mentioned in section 1, the data controller

       will provide the interested party, at the time the personal data is obtained, the following

       information necessary to guarantee fair and transparent data processing:


       a) the period during which the personal data will be kept or, when this is not possible, the

       criteria used to determine this term;





Resolution (File RCO-2020/088)
Page 23 of 34 Document suitable for publication on the Council Portalwww.ctpdandalucia.es b) the existence of the right to request access to the data from the person responsible for the treatment

       personal data relating to the interested party, and its rectification or deletion, or the limitation of its

       processing, or to oppose processing, as well as the right to data portability;


       c) when the processing is based on Article 6(1)(a) or Article 9,

       section 2, letter a), the existence of the right to withdraw consent at any time

       moment, without affecting the legality of the treatment based on prior consent

       upon his withdrawal;


       d) the right to file a claim with a supervisory authority;

       e) whether the communication of personal data is a legal or contractual requirement, or a requirement

       necessary to sign a contract, and if the interested party is obliged to provide the data

       personal and is informed of the possible consequences of not providing such data;


       f) the existence of automated decisions, including profiling, to which

       referred to in article 22, sections 1 and 4, and, at least in such cases, significant information

       about the logic applied, as well as the importance and intended consequences of said

       treatment for the interested party.


       3. When the data controller plans the subsequent processing of data

       personal data for a purpose other than that for which they were collected, will provide the

       interested party, prior to said further processing, information about that other purpose and

       any additional information relevant under paragraph 2.


       4. The provisions of paragraphs 1, 2 and 3 shall not apply when and to the extent

       "that the interested party already has the information."


And article 11 LOPDGDD provides regarding “Transparency and information to the affected person” that:


       "1. When personal data is obtained from the affected person, the person responsible for the treatment

       may comply with the duty of information established in article 13 of the

       Regulation (EU) 2016/679 providing the affected person with the basic information referred to in the

       following section and indicating an electronic address or other means that allows

       easily and immediately access the rest of the information.


       2. The basic information referred to in the previous section must contain, at least:

       a) The identity of the person responsible for the treatment and his representative, if applicable.




Resolution (File RCO-2020/088)
Page 24 of 34 Document suitable for publication on the Council Portal www.ctpdandalucia.es b) The purpose of the treatment.


       c) The possibility of exercising the rights established in articles 15 to 22 of the Regulations

       (EU) 2016/679.


       If the data obtained from the affected person were to be processed for the preparation of profiles, the

       basic information will also include this circumstance. In this case, the affected

       You must be informed of your right to object to the adoption of individual decisions

       automated actions that produce legal effects on him or significantly affect him

       Similarly, when this right occurs in accordance with the provisions of article 22 of the

       Regulation (EU) 2016/679.


       3. When the personal data had not been obtained from the affected person, the person responsible

       may comply with the duty of information established in article 14 of the

       Regulation (EU) 2016/679, providing the basic information indicated in the section

       above, indicating an electronic address or other means that allows access


       simple and immediate to the rest of the information.

       In these cases, the basic information will also include:


       a) The categories of data subject to processing.


       b) The sources from which the data came.”



Room. The Agreement to Start the sanctioning procedure has been notified to the claimed body, as

As indicated in the Background, he presented allegations on August 8, 2022.


Focusing on their content, we can first see a claim to

conclude that the teaching coordination bodies of public centers, although they are not

governing bodies, they are collegiate bodies, and that, specifically, the departments of

                                                                                       2
didactic coordination meets the requirements established in article 20 of Law 40/2015,


2
 Article 20 LRJSP establishes with respect to the “Requirements to establish collegiate bodies” that:
   1. Collegiate bodies are those that are formally created and are made up of three or more people,

   those that are assigned administrative functions of decision, proposal, advice, monitoring or control, and

   that act as part of the General Administration of the State or one of its public organizations.


   2. The constitution of a collegiate body in the General Administration of the State and its Agencies
   public institutions have as an indispensable budget the determination in their creation law or in the agreement



Resolution (File RCO-2020/088)
Page 25 of 34 Document suitable for publication on the Council Portal www.ctpdandalucia.esde October 11, of the Legal Regime of the Public Sector (hereinafter, LRJSP), regarding the

constitution of collegiate bodies. All this in terms of considering the application of the

                                    3
established in article 18 of the aforementioned law regarding the recording of its sessions.


Well, the formal consideration as collegiate bodies of the departments of

didactic coordination, within the teaching coordination and guidance bodies of the


public centers, it must be questioned because it is not found in the regulations themselves

applicable sector cited in the brief of allegations no express mention in this regard.



    with other Public Administrations by which said body is created, of the following extremes:

    a) Its goals or objectives.


    b) Its administrative integration or hierarchical dependency.


    c) The composition and criteria for the appointment of its President and the remaining members.

    d) The functions of decision, proposal, report, monitoring or control, as well as any other functions assigned to it.

    attribute.


    e) The provision of the necessary credits, if applicable, for its operation.


    3. The legal regime of the collegiate bodies referred to in section 1 of this article will comply with the

    norms contained in article 19, without prejudice to the organizational peculiarities contained in the

    this Law or in its rule or creation agreement.”

3 Article 18 LRJSP provides that:

    "1. Minutes will be drawn up for each session held by the collegiate body by the Secretary, who will specify

    necessarily the attendees, the agenda of the meeting, the circumstances of the place and time in which it is held.

    has celebrated, the main points of the deliberations, as well as the content of the agreements adopted.


    The sessions held by the collegiate body may be recorded. The file resulting from the recording, together with

    the certification issued by the Secretary of its authenticity and integrity, and how many documents in

    electronic medium were used as session documents, they may accompany the minutes of the sessions, without

    need to record in it the main points of the deliberations.

    2. The minutes of each session may be approved in the same meeting or in the immediately following one. The Secretary

    will prepare the minutes with the approval of the President and will send it through electronic means, to the

    members of the collegiate body, who may express their agreement or objections by the same means

    to the text, for the purposes of its approval, being considered, if affirmative, approved at the same meeting.


    When the decision was made to record the sessions held or to use documents in

    electronic medium, must be kept in a way that guarantees the integrity and authenticity of the



Resolution (File RCO-2020/088)
Page 26 of 34 Document suitable for publication on the Council Portal www.ctpdandalucia.esIn fact, neither in Organic Law 2/2006, of May 3, on Education, nor in Law 17/2007, of 10

of December, of Education of Andalusia, nor in Decree 327/2010, of July 13, by which

The Organic Regulation of Secondary Education Institutes is approved in the field

Andalusian, much less in the Order of August 20, 2010, which regulates the


organization and operation of secondary education institutes, as well as the schedule

of the centers, of the students and of the teachers, a similar reference is made specifically

condition, which does occur in the case of the governing bodies of the centers (Council

School and Faculty of Teachers) who are expressly qualified as collegiate by the

article 48 of Decree 327/2010, distinguishing them from teaching coordination bodies

among which are the different departments, as already noted in the

Fifth legal consideration of the Agreement to initiate this sanctioning procedure.


Likewise, the allusion in the writing of allegations to own interpretation techniques

hermeneutics or subjective grammatical analysis of the names of the titles of the

different chapters and sections that regulate the teaching bodies in question, declines before the

criterion of normative interpretation in accordance with the proper meaning of the words to which

refers to article 3 of the Civil Code. In this regard, it is once again insisted that in all

provisions in question distinguish a regulation for the “collegiate governing bodies”


and another for the “teaching coordination bodies”, without the previous epithet. Consistent with

As stated above, Decree 327/2010 itself, in its article 90, addresses tutoring, the condition of which

single-person is undoubtedly one of the different teaching coordination bodies.

It can also be seen that the figure of the Secretary, provided for the collegiate bodies in

Article 16 LRJSP is expressly contemplated in the composition of the two bodies.

government colleges, School Council and Faculty Senate, not so in the

didactic coordination departments nor in the rest of the teaching coordination bodies

of Decree 327/2010.


It is also significant that in the report dated January 8, 2021, directed by the

applicant to the DPD, the teaching coordination bodies are distinguished from the collegiate bodies,

when it is indicated that: “From the center management it was understood from the beginning of the course that, at


   corresponding electronic files and access to them by the members of the body

   collegiate.”


Resolution (File RCO-2020/088)

Page 27 of 34 Document suitable for publication on the Portal of Cwww.ctpdandalucia.esamparo of said law [40/2015], the sessions of the collegiate bodies could be recorded and therefore

analogy of functioning of the teaching coordination bodies…”.


On the other hand, it would not be appropriate to argue the content of article 20 LRJSP, regarding

the requirements to constitute collegiate bodies, as they do not have a basic nature and are of

application exclusively to the General Administration of the State and the state public sector, such

as established in the fourteenth final provision 2. a) of the aforementioned law.


Without prejudice to the above, it cannot be ignored that article 92 of Decree 327/2020


consecrates a plural composition of each didactic coordination department by being

made up of all the teachers who teach the teachings entrusted to them,

and that article 94 attributes to the heads of the departments, among others, the powers

to convene and preside over department meetings and take minutes thereof.


On such a normative basis, it can be concluded that the aforementioned coordination departments

didactics, when they meet in sessions to exercise the powers that the regulations

recognizes them, they are governed in terms of their operation, with an analogical character, by the

standards established for collegiate bodies.


Note that the modification carried out in the

Chapter I, section 2 of the Regulations for the Organization and Operation of the center against

that this sanctioning procedure is followed, which begins by indicating: “The operation

of the teaching coordination bodies of the [educational center] (Departments, educational teams,

etc.), by analogy it will be equal to the operation of a collegiate body.”


In any case, and with this we begin to fully analyze the content of the allegation that

aims to conclude with the legality of the data processing involved in the recording of the audio of

certain sessions of the teaching department of [name of department], must

It means that although article 15 LRJSP, of a basic nature, establishes the obligation of

drawing up a minute of each session held by a collegiate body, article 18 of the


The aforementioned rule does not stipulate said obligation regarding the recording of such sessions by indicating

simply that “they may be recorded”, also optionally admitting that the

file resulting from the recording, along with the certification issued by the Secretary of the




Resolution (File RCO-2020/088)

Page 28 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.esauthenticity and integrity thereof, accompany the minutes of the sessions, without the need to

record the main points of the deliberations.


Consequently, we are not in the situation that concerns us before a treatment of

data that is necessary for compliance with a legal obligation applicable to the person responsible

of the treatment that could determine its legality in accordance with the provisions of article 6.1.e)

RGPD, since, as just noted, the law provides for the possibility of recording sessions


but it does not impose it, so a favorable decision in this regard should be adopted,

like any other collegiate agreement, by majority vote of the corresponding body

(article 17.5 LRJSP) or be incorporated, where appropriate, in the internal regime regulations of the

body, actions that, according to what was reported during the procedure, had not been

produced at the time of holding the department sessions during the months

of [mm] and [mm] of 2020.


Nor can data processing be covered in the case of article 6.1.e) of the

RGPD regarding the fulfillment of a mission carried out in the public interest or in the exercise of

public powers conferred on the data controller. The powers in the field of

educational public service attributed to the didactic coordination departments

require the recording of the sessions for their exercise, which could constitute at least

I add an “additional guarantee” in the expression of the claimed party, in such a way that, as

indicates the Spanish Data Protection Agency in its report 2018-0175 “if a certain


treatment is not 'necessary' for the fulfillment of the mission carried out in the public interest or in the

exercise of public powers conferred by the ordinance, such treatment would not only lack

sufficient legitimizing legal basis provided for in section e), but would also infringe the

principle of data minimization contained in article 5.1. c) of the RGPD…”.


Regarding the review that appears in the allegations about the pandemic framework in which

the actions took place and the mention of the instructions of the Vice-Ministry of

Education and Sports, related to the organization of educational centers motivated by the crisis

health of COVID-19, it should be noted on the one hand that they do not contemplate the

requirement to record sessions, and, on the other hand, which is not discussed in this procedure

the opportunity or convenience of holding meetings via videoconference,




Resolution (File RCO-2020/088)

Page 29 of 34 Document suitable for publication on the Portal of the Cwww.ctpdandalucia.essino the adequacy and compliance of the treatment inherent to the recording of the same to the

data protection regulations.


Finally, it must be clarified about the purpose that the document of allegations attributes to the

recording of the sessions, consisting of exclusive consultation of the matters incorporated in

the agenda of the meetings, that the information that the member or member of a

body that acts in a collegiate manner must have at its disposal is guaranteed by the


right to have the minutes sent to them through electronic means so that they can

express by the same means their agreement or objections to the text for the purposes of its

approval (article 18.2 LRJSP).


Consequently, from all of the above it is evident that the claimed entity has carried out a

illicit processing of personal data, consisting of audio recording of the sessions of the

Teaching department of [name of department] corresponding to the months of [mm] and

[mm] of 2020, by not complying with the aforementioned treatment with any of the conditions established in

article 6.1 GDPR.


On the other hand, regarding the allegation regarding the duty of information to people

members of the department about the recording of a certain session, there is

accredited, as the members of the department themselves have certified, that the body

claimed before the telematic session held on [dd/mm/yy], informed them that the aforementioned

session and the subsequent ones were going to be recorded.    Notwithstanding the above, you must specify this

body that, based on the data in the file, it has been verified that the body

claimed since [dd/mm/yy] audio recorded meetings of the Department of [name of


department], however, the testimonial statements provided correspond to the

[dd/mm/yy]; It is then evident that there were meetings held in [dd/mm/yy] and

[dd/mm/yy], of which there is no evidence that it was reported that these were going to be

recorded.


On the other hand, this Council must point out that at the meeting held on [dd/mm/yy],

informed those attending the meeting of the identity and address of the person responsible for the treatment,

as well as the purpose for which the personal data were going to be processed but not the rest of the

the extremes required by article 13 RGPD, including those related to the time of



Resolution (File RCO-2020/088)

Page 30 of 34 Document suitable to be published on the Portal of www.ctpdandalucia.esconservation thereof, who is responsible for its deletion or if it is going to be

automate. Nor has it been accredited, despite having been required by this

Council, that the Institute inform the professors attending the

the recorded sessions of all the requirements demanded by article 13 GDPR on the


processing of your personal data.

Finally, regarding the classification of the infraction, the body complained of understands that,


difference from what is indicated in the Startup Agreement, the infringement due to the lack of the duty to

information required in article 13 RGPD, by virtue of article 74.a) LOPDGDD, must be

consider mild and not very serious (article 72.1.h LOPDGDD), however, as has already been pointed out

previously this organism, at least from [dd/mm/yy] to [dd/mm/yy] has not been

proven that the claimed body reported on any of the requirements demanded by the

Article 13 GDPR, so the classification of the infraction must be maintained.


In accordance with all the above, this Council understands that the allegations presented are not

distort the essential content of the infringement that is declared committed nor do they constitute cause for

sufficient justification or exculpation.



Fifth. Failure to comply with "the basic principles for treatment, including the conditions

for consent under articles 5, 6, 7 and 9" of the GDPR is considered an infringement

to the personal data protection regulations in article 83.5.a) RGPD; the facts

attributable to the claimed body are also considered, for the purposes of prescription,

as a very serious violation in article 72.1.b) LOPDGDD:


   “b) The processing of personal data without any of the conditions of legality of the

   treatment established in article 6 of Regulation (EU) 2016/679”.



On the other hand, failure to comply with "the rights of the interested parties under articles 12 to

22" of the RGPD is considered a violation of personal data protection regulations

in article 83.5.b) RGPD; the facts attributable to the claimed body are equally

considered, for the purposes of prescription, as a very serious infraction in article 72.1.h)

LOPDGDD:





Resolution (File RCO-2020/088)

Page 31 of 34 Document suitable for publication on the Portal www.ctpdandalucia.es "h) The omission of the duty to inform the affected party about the processing of their data


      personal in accordance with the provisions of articles 13 and 14 of Regulation (EU) 2016/679 and

      12 of this organic law".

In the present case, the offending circumstances provided for in articles 83.5.a) and

83.5.b) RGPD transcribed.



Sixth. Article 58.2 GDPR provides that:


      “Each supervisory authority will have all of the following corrective powers indicated

      next:


      [...]

      b) send a warning to any person responsible or in charge of processing when the

      processing operations have infringed the provisions of this Regulation;


      [...]


      d) order the person responsible or in charge of the treatment that the treatment operations

      comply with the provisions of this Regulation, where applicable, in a manner

      certain way and within a specified period;

      […]”.


On the other hand, article 77 LOPDGDD establishes the sanctioning regime applicable to

certain categories of data controllers or processors; in particular, in his

section 1.d) includes "Public bodies and public law entities linked or

dependent on Public Administrations.” In the aforementioned article, in section 2, it is


notes that:

      "When those responsible or in charge listed in section 1 commit any of


      the infractions referred to in articles 72 to 74 of this organic law, the authority

      of data protection that is competent will issue a resolution sanctioning them.

      with warning. The resolution will also establish the measures to be adopted

      so that the conduct ceases or the effects of the infraction that has been committed are corrected."

Thus, in accordance with article 77.2 LOPDGDD, the sanction that must be imposed on the person responsible

of treatment is warning.



Resolution (File RCO-2020/088)

Page 32 of 34 Document suitable for publication on the Con Portalwww.ctpdandalucia.esAs an additional measure, the [educational center] is urged to inform the members of the

Department of [name of department], of all the extremes required by article 13

GDPR, within one month.



Seventh. In relation to the notification of the resolution of the sanctioning procedure, the

Article 77.2 LOPDGDD provides that "[t]he resolution will be notified to the person responsible or in charge of the

treatment, to the body on which it depends hierarchically, if applicable, and to those affected who had

the status of interested party, if applicable".


Furthermore, article 77.4 LOPDGDD states that "[t]he

data protection the resolutions that fall in relation to the measures and actions to which


the previous sections refer to", and 77.56 LOPDGDD, which "[s]hall be communicated to the Ombudsman of the

People or, where appropriate, to the analogous institutions of the autonomous communities the actions

carried out and the resolutions issued under this article".


Eighth. Presidential Decree 10/2022, of July 25, on restructuring of


Ministries, modified by Presidential Decree 13/2022, of August 8, creates the

Ministry of Educational Development and Vocational Training, to which they correspond, according to the

Article 4 of the aforementioned standard, “the powers currently attributed to the

Ministry of Education and Sports, except for competitions in sports.”



By virtue of all the above and in accordance with the applicable legislation, the Director of the Council

of Transparency and Data Protection of Andalusia




                                           SOLVE



First. Send a WARNING to the [educational center (Department of Educational Development and

Vocational Training), with NIF S4111001F, for violations of articles 6 and 13 RGPD,

typified in articles 83.5.a) and 83.5.b) RGPD.



Second. As an additional measure, urge the [educational center, that within one month from




Resolution (File RCO-2020/088)

Page 33 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.es the notification of this resolution, the members of the Department of

[department name] of all the extremes required by article 13 GDPR. Of the

Actions carried out must be reported to the Council within the same period.



Third. That this resolution be notified to the offending body.



Room. That this resolution be communicated to the Andalusian Ombudsman,

in accordance with the provisions of article 77.5 LOPDGDD.



In accordance with the provisions of article 50 LOPDGDD, this Resolution will be made

public, dissociating the corresponding data, once it has been notified to the

interested.



Against this Resolution, which puts an end to the administrative route, an appeal can be filed

optional replacement before this Council, within a period of one month, or directly file

contentious-administrative appeal before the Contentious-Administrative Jurisdiction within the term

of two months, in both cases counting from the day following the day of its notification,

in accordance with the provisions of articles 30.4, 123 and 124 of Law 39/2015, of 1

October, of the Common Administrative Procedure of Public Administrations and in the

articles 8.3, 14.1 and 46.1 of Law 29/1998, of July 13, regulating the Jurisdiction

Contentious-administrative.


In accordance with the provisions of art. 90.3.a) LPACAP, the

firm resolution through administrative channels if the interested party expresses before this Council his

intention to file a contentious-administrative appeal and transfers to it, once

filed, the documentation that proves its presentation. If the Council did not have

knowledge of the filing of the contentious-administrative appeal within the period

corresponding or in said appeal the precautionary suspension of the resolution is not requested,

would end the aforementioned suspension.


                       THE DIRECTOR OF THE TRANSPARENCY COUNCIL
                           AND DATA PROTECTION OF ANDALUSIA
                                    Jesus Jimenez Lopez





Resolution (File RCO-2020/088)

Page 34 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.es