AEPD (Spain) - PS/00245/2019

AEPD - PS/00245/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(a) GDPR Article 9(1) GDPR Article 13 GDPR Article 83(5)(a) GDPR Article 83(5)(b) GDPR Article 77 LOPDDGG
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	29.10.2020
Published:
Fine:	None
Parties:	Departamento de Educación del Gobierno de Navarra
National Case Number/Name:	PS/00245/2019
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	AEDP (in ES)
Initial Contributor:	Francesc Julve Falcó

The Spanish DPA (AEPD) has imposed three different warning sanctions on the Department of Education of the Government of Navarra for infringing Articles 5(1)(a), 9(1), and 13 GDPR on the processing of data from surveys answered by schoolchildren.

English Summary

Facts

On 25 February 2019, an individual filed a complaint with the AEDP against the Department of Education of the Government of Navarra regarding a survey conducted by his son in class, asking him about intimate, family, and personal issues.

The respondent stated that the purpose of the surveys was to guide and inform schools and families about the level of education acquired by the schoolchildren. Together with these surveys, context questionnaires were provided to obtain information on the socio-economic and cultural conditions of the schools in order to contextualize the results obtained.

The respondent also explained in detail the respective organic laws that justified the collection of these personal data of the students, in order to know better the conditions of the students. At the same time, it also described the security and confidentiality measures that were being followed to protect this information.

The Department of Education of the Government of Navarra replied to the decision to initiate the procedure, agreeing with the allegations of infringement of Articles 5(1)(a) GDPR and 13 GDPR. On the other hand, they disagreed with the infringement of Article 5(1)(a) GDPR in relation to Article 9(1) GDPR with regard to the question of the gender identity of pupils.

Dispute

Should government surveys of underage students do comply with the principles of transparency, lawfulness, and fairness, respecting Articles 5 (1) (a), 9 (1), and 13 GDPR?

Holding

The Spanish DPA confirmed that the defendant collected specific personal data that was not necessary for the purpose in question. Therefore, if they could have achieved the same purpose without processing those data, there is no legal basis for processing them.

Consequently, the infringement of Article 5(1)(a) GDPR in relation to Article 9(1) GDPR is established. Article 13 GDPR is also considered to have been infringed as regards the information to be provided when personal data are obtained from the data subject.

The Spanish legal system has chosen not to penalize public bodies with a fine, as indicated in Article 77(1)(c) LOPDDGG, and paragraphs 2, 4, 5, and 6 of the same article.

In view of the above, the Director of the Spanish Data Protection Agency decided to impose three different warning sanctions: one for infringement of Article 5(1)(a) GDPR, another for infringement of the same Article 5(1)(a) GDPR in relation to Article 9(1) GDPR, and a third warning sanction for infringement of Article 13 GDPR.

Comment

Particularly interesting here is the argumentation according to which by asking to pupils whether they were a "girl", a "boy", or "other", what was being collected was a special category of data (about gender identity). This is interesting because actually Article 9 GDPR does not mention gender identity as a special category of data. It mentions sexual orientation, which the AEPD believes to be somehow connected to the "other" question. As a consequence of this being about "sensitive data", a legal basis allowing specifically for this processing is needed. However, the AEPD notes that Spanish law on these matters is based on a gender binary, and therefore cannot support questions including the "other" choice (see pages 28 and ff. of the Decision).

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                               1/36








    Procedure No.: PS/00245/2019
938-300320


                RESOLUTION OF SANCTIONING PROCEDURE


       From the procedure instructed by the Spanish Data Protection Agency and in
based on the following


                                     BACKGROUND


FIRST: A.A.A. (hereinafter the complainant) dated 25/02/2019, filed a complaint
before the Spanish Data Protection Agency against the DEPARTMENT OF
EDUCATION OF THE GOVERNMENT OF NAVARRA (DIRECTORATE GENERAL OF EDUCATION)
(hereinafter referred to as the Respondent).


       The complainant states that his son is studying at a state school in the 4th year of
(4EP from now on) and has carried out a nominative survey where, among others
issues, asks about "your gender (boy/girl/other), the language you use
out of school, their feelings about school, their relationships with their peers, or

profession of his parents, with special reference to the military career, issues that
Understands that they are part of the student's privacy and family life".


       "To fill in the survey, students must access the web platform of the de-
Education Department of the Government of Navarre
(https://www.educacion.navarra.es/web/dpto/evaluacion-y-calidad/evaluacion/evaluacion-ex-
terna/evaluacion-de-navarra/educacion-infantil-y primaria-curso-2018-2019)".

SECOND: In view of the facts, the complaint was transferred on 1/04/2019

to inform the requested party of the causes of the incident, measures
adopted to prevent similar incidents from occurring, and copy of the communications
The Commission shall inform the complainant of the decision it has taken concerning the transfer of this
claim.

THIRD: The requested party states:

   1) "Since the implementation of the Organic Law 2/2006, of 3/05, on Education (LOE), all

The education authorities must carry out, during the primary education stage
general diagnostic assessments of the core competencies achieved by their
students (ED from now on). This legislation provides for the implementation of these assessments with
census character [Articles 21 which indicated until its amendment by LO 2/2013 "At the end -
czar el segundo ciclo de la educación primaria"-cuarto de primaria- y 144 de la LOE]. You are

evaluations are of a formative and guiding nature for the centres, and informative for
families and for the whole educational community".

       "In the Autonomous Community of Navarre, from the 2009/2010 school year to the
This 4EP census is being conducted for the 2013/2014 school year.


       With the entry into force of Organic Law 8/2013, DE 9/12, for the improvement of the ca-
In the case of the Education Ministry (LOMCE), this individualised census evaluation was maintained, but it was transferred to the
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/36








giving its application to 3rd and 6th year of Primary Education. See Articles 20, 21 and 144 of the
LOMCE].


       In the Autonomous Community of Navarra, a Census Diagnostic Evaluation was carried out in
3º Primary Education during the 2014/2015 school year and in 6º Primary Education du-
The school year 2015/2016. During these two school years, no eva-
diagnostic evaluation in 4EP".

       Royal Decree-Law 5/2016, DE 9/12, on urgent measures for the extension of the

Article 3 of the LOMCE's implementation timetable abolished the census-based nature of
evaluation in Primary Education, transforming it into an evaluation with a sample character
where the selection of students and schools must be sufficient to obtain representative data
at the level of each Educational Administration. So that from the school year
2016/2017 to date, in the Autonomous Community of Navarre assessments are being carried out

Sample diagnostics in 3rd and 6th year of Primary Education. In order not to lose the individual character of the
of diagnostic evaluations, and under Article 144.2 of the LOMCE, which
provides that "education administrations may establish other evaluations with
diagnostic purposes", in Navarra, the history of diagnostic evaluations was taken up again by censa-
4th year of Primary Education from 2016/2017.



  2) In addition to DE, "simultaneous" context questionnaires are carried out, (CC in
hereinafter) drawn up in accordance with criteria determined by the Ministry of Education, Culture and
Sport, which provide information on socio-economic and cultural conditions
The aim is to provide a context for the results obtained. See, for example
For example, Article 7.5. of ROYAL DECREE 1058/2015, DE 20/11, regulating
the general characteristics of the tests of the final evaluation of primary education are

tableted in the LOE]:

     Simultaneously with the conclusion of the final stage evaluation, the following will be implemented

context questionnaires, to be drawn up by the Ministry of Education, Culture and Sport.
These questionnaires will provide information on socio-economic conditions and
cultural centres for the contextualisation of the results obtained'.


   "Article 8 on results states:

  "1. The result of the final stage evaluation shall be expressed at the following levels for
each of the competences: Insufficient (IN), Sufficient (SU), Good (BI), Remarkable (NT) and
Outstanding (SB).

  The competent education authorities shall record the level obtained by each

in an individual report, which will be given to the parents or
legal guardians and transferred to schools where the students are to continue their
schooling. The report will be of an informative and guiding nature for schools where
have completed the sixth year of Primary Education and for those centres where they
to attend the next school year, as well as for the teaching teams, parents
or legal tutors and the student body."





C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/36








   3) In the Autonomous Community of Navarre, during the seven school years included
between 2009/2010 and 2015/2016 (both inclusive), the DCs associated with DE to which
The students' answers were made anonymously, allowing only the students to perform their tasks.

The study of the factors influencing performance results is a key element of the
school level. From the 2016/2017 school year onwards, it was agreed, subject to prior authoris
The Directorate-General for Education, its online implementation (with identification and
user). He states that once the questionnaire has been answered, no other user or teacher will be able to do so,
neither student nor director can know the identification data of each student (except
two members of the technical unit managing the evaluation procedure). "This

The change is an advantage and an improvement over the statistical analysis carried out after the
The information obtained can be used to link the results of each study to the other.
The aim is to provide information on the social, economic and cultural conditions of the
The students will be given a more detailed explanation of the course at the level of the students or groups of students within the same
centre."


   This fact favours the detection of needs or strengths for the improvement of the system
education, as more individualized information can be obtained.

   "During the current school year 2018/2019, the Community of Navarra is
by carrying out, among other things, the 4EP census survey in all public centres and concerta

two who are registered at that level of education. The online application phase of the CC
for students was held in February 2019 and the competition tests were held in the
The week of 6 to 12 October is the week of the first meeting of the
10/05/2019. You can access the online questionnaire for this school year at the link
http://dpto.educacion.navarra.es/eed/ (the application must be accessed under the name

Irati test user and Irati test password).

        The design, organisation and execution of the DE provided for in the LOE is one of
the functions associated with the Evaluation, Quality, Training, Equality and Convi-
Within this Service, the technical unit responsible for managing them is the Section

of Evaluation and Quality. See DECRETO FORAL 5/2017 of 11/01, establishing the European Commission's
ec the organic structure of the department of education]".

         "Access to the online application that allows you to carry out the survey, through a
numerical user ID and an associated password, and the data that is recorded
in the survey do not contain any nominative reference".


        "School addresses know the users and passwords aso-
The students' names are shared with the teachers responsible for the
supervision of the application of the survey in the centre (generally tutoring teachers).
These data are not public and are only accessible to the director of each centre.

The school is not allowed to use the school's own resources, but only after identification with personal credentials in the school management programme.
EDUCA strainer. This information is also known by the technician of the
Education that manages the assignment of users and passwords.

        "For the users surveyed, the online application only allows access to the en-

It costs only once, so the answers are recorded and the centre cannot access them.
der them. So the school does not know or have access to the answers recorded
by their students. Neither did the Education Department technician who managed
the assignment of users and passwords knows these answers.

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/36








        "The computer technician who designs and manages data collection through the en-
does not know the nominal identification data of the respondents, it only knows the
users and passwords".


        "The Department of Education guarantees the confidentiality of the data provided
for each student in the online questionnaire. In this sense, only two technicians from the uni-
The data analysts in charge of analysing the recorded data know the allocation of the identified
res numerical (users) and the responses. This connection is necessary in order to link
the individual results obtained in the performance tests of the different com-

The following is a list of the main factors that have been taken into account to determine the success of the project and the associated contextual factors (collected by means of the questionnaire).

        In addition, the databases are stored on the network drives of the De-
The schools are located in the Department of Education, and therefore are only accessible from within the Department itself.
access to the computer equipment by means of a user and

password which must be changed every 30 days".

        "For all the above reasons, it should be noted that although the survey does not
is anonymous, personal data are pseudonymised, i.e. they cannot
be attributed to an interested party without the use of additional information. Please note that
This additional information is given separately and is subject to technical and organisational measures.

The Commission has adopted a number of measures designed to ensure that personal data are not attributed to a natural person
identified or identifiable. In fact, the RGPD explicitly introduces this in its Article 32,
concerning the security of the processing of personal data, pseudonymisation as
an appropriate measure to ensure a level of safety commensurate with the risk".


     4) The questions in the questionnaire are not intended to attack convictions or privacy
of the respondent, the objective being to collect the minimum necessary information to allow, after
its subsequent analysis, contextualising the overall results of DE, providing information on the
The following is an overview of the performance of the various competencies assessed, but also of the
on the socio-economic and cultural conditions of the education system. In this respect,

the usefulness of the survey is enormous, both for the schools themselves and for the
Department of Education.

     5) The CC is compulsory for each student of 4EP, although they can leave
unanswered questions, it can even be sent with all your unanswered questions, "without
consequences for the student".


        "The necessary collaboration of students and families responding to the survey, with
It is important to detect needs and to design improvement plans in the centres.
colare. Thus, for example, some studies useful for the education system as a whole,
that would not be possible without the collaboration of families and students, are


o From the questions concerning the parents' level of education, their level of occupation -
The presence in the home of different consumer goods (magazines, housing, etc.)
own, encyclopedias, books, mobile phone with internet access, tablet,) you can obtain
the SOCIO-ECONOMIC AND CULTURAL INDEX (ISEC). Thanks to this indicator, at the level of

centre, in the DE report, the centres have the ISEC of centre and the
estimated for each competition in relation to that index, with the signalling of the
The centre's location. The schools' ISEC is also used, within the


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/36








Department of Education, along with many other factors, when distributing the hours
diversity awareness programmes allocated to schools.


o Questions concerning the use of language in the school and family environment are useful at the
The new courses are part of the Department of Education's internal curriculum, as they allow for studies on language use.
The Committee is pleased to note that the following policies have been adopted to help improve the way schools are advised to
to define and develop its Centre Linguistic Project (PLC).



   6) "On the question of sex, with three answer options, the objective is simply
is to give the survey an all-inclusive character. This also gives
compliance with article 19.a) of the recently approved Provincial Law 17/2019, of 4/04, on
The Commission's report on gender equality, which states that "in statistics and studies, the
nistraciones Públicas de Navarra, to guarantee the effectiveness of the incorporation of

gender perspective in their day-to-day work, they should systematically include the
of sex, collecting the different categories, in all statistics, surveys and
data that they carry out". It should also be stressed that other organisations are educating
University of Navarra (UPNA) or the University of the Basque Country (UBP).
(UPV), already include this format in their access questionnaires. Also with the same
The term "inclusive" is used to cover the full range of family typologies.

The "father" or the "mother" should be the same as the "father" or the "mother". Under no circumstances will I be su-
It is not intended to indoctrinate or convince children or young people to take up the challenge.
Some respondents simply collect and analyse the information that students and their
families share for the diagnosis and improvement of education in Navarra.


   7) "With regard to the question concerning the "level of employment" of the parents, I include
The first is a series of blocks of possible professions, classified in five groups, from the lowest to the highest.
at a higher level according to the professional category involved. Therefore, the profession is not registered.
The value of a number from 1 to 5 represents the lowest or highest
level of employment of the mother and father.


        In view of the above, it is impossible to deduce whether the respondent belongs to
specifically to the category "basic, medium or high scale military", as mentioned in
the claim, or to another category of that group.

   8) "From the Technical Unit responsible for the questionnaire, it is acknowledged that the respondent

The Commission's proposal for a Directive on the protection of individuals with regard to the processing of personal data and on the free movement of such data has not provided sufficient transparency and clarity, at least as far as the Commission is concerned.
In the case of personal data, the information concerning the purpose of the processing will be provided in the form of a report.
The purpose of the processing of personal data and the legal basis for such processing,
as indicated in Article 13.1.c) of the RGPD and Articles 12 to 18 of the LOPDGDD".


        "Considers that at the information level, they should change the aspect of the aims of the
processing for which the data are intended, the legal basis for the processing and the existence of the
right to request from the controller access to, and rectification and deletion of, data
data, and therefore:


        1-An explicit reference is added to the basic information on protection of
data in the action protocol sent to schools and published on the website
of the Department of Education.


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/36








        2- A short letter will be drafted to serve as a model for schools and will be
will provide a single, simple and clear information document (diptych or triptych type) where the
carve out aspects of what an ED is, why it should be carried out, usefulness etc.


        This letter and the information document must be sent to all families. The docu-
This information will also be published on the website of the Department of Education.
the.

- When the data is requested, and during the preliminary phase of preparation, in the

application itself, the information provided in Article 13 shall be included in the home page
of the RGPD indicates that it should be made available to interested parties (student and family).

        More specifically, when collecting the data, it will be presented within the
of the interested party's vision, the following text:


        "In accordance with the provisions of the RGPD and Organic Law 3/2018 on Pro-
Personal Data and Guarantee of Digital Rights, the data of character
The evaluation and quality of the staff will be dealt with by the Evaluation and Quality Section of the Edu-
The Government of Navarre's "responsible" role and its incorporation into the activity of the
The "Primary Education Census Diagnostic Evaluation" treatment is aimed at

to contextualise the overall results of the diagnostic evaluation, providing information on the
The following is an overview of the performance of the various competencies assessed, but also of the
on the socio-economic and cultural conditions of the education system or other factors
associated with it such as language use, school and community climate or
satisfaction with the school. We also inform you that you can exercise your rights

The following are some of the options for access, rectification, deletion and portability of your data, limitation and objection
The evaluation and quality section of the department is responsible for processing them, where appropriate.
The Government of Navarre's Education Department at the e-mail address".

        " Purpose of the treatment To obtain information on the socio-economic conditions of the

and cultural centres for the contextualisation of the results obtained, as well as
as well as other factors related to school performance such as language use, the
school and community atmosphere or satisfaction with the school.

        Legitimacy of processing (legal obligation)


        Rule enabling data processing:
- Organic Law 2/2006, of 3/05, on Education (LOE).
- Organic Law 8/2013, of 9/12, for the improvement of educational quality (LOMCE).

        It is mandatory to provide the data. There are no consequences for not doing so, although the

The collaboration required is indispensable in order to contribute together to the improvement of the system
educational.
        The online application of the survey allows you to leave questions unanswered.

        The recorded data will not be passed on to third parties.


Exceptionally, for possible internal use in the technical units of the Department
The data already analysed will either be sent globally, where there is no identification of the


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/36








The data would be shared anonymously or, if submitted, by the students themselves.
The student's name is not mentioned, that is, without any reference to each student's ID.
There are no international transfers of data.

Data retention time:
A maximum of 3 school years after the school year in which the re
taking them.
Automated decisions No automated decisions will be taken on the information fa-
cylindrical".


9) The person claimed provides a copy of:

A- "ACTIONS PROTOCOL" associated with the "CENTRAL DIAGNOSTIC ASSESSMENT
SAL 4º DE EDUCACIÓN DE PRIMARIA CURSO 2018-2019", published in pdf on the website of
Department of Education from 14/01/2019, on the link: https://www.educacion.na-

varra.es/documents/27590/1381944/Protocolo_4EP_2018_2019_castellano.pdf/fe4a6b07-
50eb-12e9-88b6-ee2671d9156c, 16 pages, on file. It is included in the file with
the name "EVALUATION 4 EP"

        You can access it, standing out:


      1) The index refers to the protocol for the online application of the
socio-economic and cultural questionnaire, who will carry out the tests, delivery and custody,
specific instructions for the English language proficiency test, introduction
of data, obtaining reports -student and centre-, custody of evidence.


      2) On the protocol for the online application of the "socio-economic and
cultural" in point B of the table of contents, page 3, is indicated as the most prominent:

        "The Department of Education will ensure the confidentiality of data provided by
two for each student in the online questionnaire. In the diagnostic evaluation report,

the centres will have the Socioeconomic and Cultural Index, the estimated scores
for each competition in relation to that index, and the graphs with the regression line
Performance-ISEC for each competition, with signalling of the centre's position.

  For the best application of the questionnaire, the centres will follow the instructions below:


The questionnaire must be completed by all students in the 4th year of Primary Education,
  in accordance with the criteria set out in section "(E) Adaptation of tests".

2. The questionnaire will be available at the following address:
http://dpto.educacion.navarra.es/eed/


3. Each student will access the web application using a username (six ca-
rical characters) and a personal password (four characters: two numbers and two le-
after).
CAUTION! This password can only be used once....


5. School principals shall obtain the list of names
The user name and passwords (as many as there are students enrolled) through the in-
Educa Formatics

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/36








(Educa → School evaluation → Diagnostic evaluation).

        This list will also include the identification data of each student (cur-

The name of the group and the full name). The directors will be able to access it from the
28/01/2019.

        At the time of application, the director of the centre will provide the names of
The user name and passwords of each 4th year EP tutor (as many as there are students),
for distribution to your students.


6. Preparation. Before applying, teachers, tutors, students and families will be able to
practice freely, accessing the application with the following username and password
sign of proof:


Test user name: Irati
Test password: Irati

        The centre can prepare the completion of the questionnaire in a way that will
will be appropriate. In any case, it is considered convenient to carry out tutorial activities
The students will be given a questionnaire, instructions on how to fill in the questionnaire, and a list of the questions to be answered.

The Commission will be able to provide the necessary information and to answer questions at the time of implementation.
tas.


7. Implementation session. This session will be planned by the tutorial staff, using the

computers in the centre. The students will access the application, each tutor will distribute
Each student will be given a username and password to enter in the application form.
and fill in the questionnaire.

It is easy to fill in, if it has been prepared in advance, and it is worth noting the if

aspects:

...To end the questionnaire and save the answers, click on the In-
viar. This is a prerequisite for saving the answers.

        If you have left any questions unanswered, when you click on the submit button, the application will be

The Commission warns of this fact, and the questionnaire can continue to be filled in, or
to terminate it by clicking on the send as is button.

        After clicking on the send button and completing the questionnaire, you will not be able to access any further
vely with the username and password used.


8. Deadlines. The questionnaire will be completed between February 1 and 28. The questionnaires
introduced after the deadline, will not be taken into account for the calculation of the centre's ISEC. It is
It is advisable not to leave the application for the last few days, in case any pro-
Access problem.


9. Clarifications and doubts. Any doubts that may arise may be referred to the Evaluation Section.
and Quality, either by e-mail (sec.eka@navarra.es) or through the
telephone ....

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/36









       The correct completion of the questionnaire will allow the centres to have data
more reliable and to know better important aspects for the education of their students.


       Section N contains "Obtaining student and school reports", in
The student report is about the evaluation of the competence of the
mathematics, English and linguistics. A report is also made with the overall results
of the school's students as a whole.


       It is indicated that the EDUCA application through which the tests are instrumented
provides, in addition to the reports, data files and files with the answers of the
students, the questions left blank and the score obtained. It also focuses on
that "the corrected booklets will be kept and preserved in the school until
30/11/2019 date from which they may be destroyed, and that "The student report is a

valid instrument to be given to families in the context of the tutorial action, in the
month of June".

       On the results, assessments and data from the evaluation reports of
context, nothing is indicated.


B-DIAGNOSTIC ASSESSMENT SURVEY 2018-2019 header with instructions
among which it is reported that you have to "answer several questions about yourself and your
family" headed by "sex", options: a-boy, b-girl, c-other options, model
linguistic study, with references among the answers to options, in Spanish,
B, in Basque with Spanish as a subject and some other subjects in Spanish,

language in which he watches TV, or reads books or uses video games, social networks, talks to
the teachers in the classroom and outside, which language they prefer (distinguishing) with
friends in the street, in the school yard or at home with the family, on which continent you have
born you, your mother, your father? Parents' level of education, their employment situation, work
your parents' current job, with jobs and occupations as "Watchman" "worker

of the field", "medical", "military architect of the upper scale", or "medium scale", if
have their own single room, as is the relationship with their classmates on
if you feel lonely, marginalized

-Resolution 30/03/2016 of the Secretary of State for Education "defining the
context questionnaires and the centre's common indicators for the evaluation of

primary education", BOE 15/04/2016. Article 21 of the LOE provides for
individual assessment of all students at the end of the sixth year
and that the evaluation criteria and general characteristics of this evaluation
for the entire Spanish education system will be established by the Government.


- Royal Decree 1058/2015 of 20/11 regulating the general characteristics
of the tests of the final evaluation of primary education established in the LOE. In its ar-
Article 8.1, and in compliance with the provisions of Article 147 of the aforementioned LOE, determines
The results of the final stage evaluations will be made available to the
of the educational community, through common indicators for all schools

and that these common indicators will be established by the Spanish Ministry of Education.
cation, Culture and Sport. In the second section: "Context questionnaires":



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/36








       1. The context questionnaires to be applied in the final evaluation of Education
Primary will be three: One aimed at students in the sixth year of Primary Education who
The evaluation (hereinafter referred to as the student questionnaire), another one addressed to their parents, and a third one addressed to the teachers.

The following are some of the questions asked by the families, mothers and legal guardians (hereafter referred to as the family questionnaire), and a third one
The following questionnaire was sent to the management of the primary school
the address).

       2. The questions and answer options that must be in-
The following are the results of each of the questionnaires defined in the previous section

in ANNEX ONE of this resolution

       In no way does it indicate that the questionnaire should be nominative, or anonymous or
the destination or processing that is undertaken with such data. The ANNEX ONE, questionnaire, does not
requests the inclusion of the student's name.


Articles 144 and 145 of the LOE state:
144
"1. The evaluation criteria for individual evaluations
indicated in articles 20.3, 21, 29 and 36 bis of this Organic Law will be common for the
the State as a whole.

  In particular, the tests and procedures for the evaluations indicated in the

Articles 29 and 36a will be designed by the Ministry of Education, Culture and Sport, through
of the National Institute for Educational Evaluation. These tests will be standardized and
design in such a way as to enable accurate assessments and comparisons to be made
and monitoring the evolution of results over time
obtained.


  The material execution of the tests is the responsibility of the educational administrations
competent. The tests will be applied and qualified by the System's teachers
Educational Spanish outside the centre.

  The procedure for the review of the results of the inspections will be regulated

evaluations.

  Education administrations may establish other assessments for the purpose of
diagnosis".

145
"Evaluation of the centres".

  "1. Podrán education administrations, within the framework of their competencies, to develop and
to carry out evaluation plans for schools, which will take into account the
socio-economic and cultural situations of the host families and students, the environment
of the centre itself and the resources available to it.


  2. Asimismo, education administrations will support and facilitate the self-evaluation of
the educational establishments."


LOE, Additional Provision Twenty-third. Students' personal data
  "1. Schools may collect personal data on their students that are

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/36








necessary for the exercise of their educational function. These data may refer to
to the origin and family and social environment, to personal characteristics or conditions, to
development and results of their schooling, as well as to those other circumstances whose

knowledge is necessary for the education and guidance of students.

  2. Parents or guardians and the students themselves must collaborate in obtaining
information referred to in this article. The incorporation of a student into a
school will imply consent to the processing of your data and, where appropriate, the
transfer of data from the centre where he had been attending school with

previously, under the terms established in the legislation on data protection. At
in any case, the information referred to in this paragraph shall be strictly necessary
for the teaching and guidance function, and may not be used for purposes other than
educational without express consent.

  3. Technical standards and regulations shall be applied to the processing of student data

organisational arrangements to ensure their security and confidentiality. The teaching staff and the rest of the
personnel who, in the exercise of their duties, have access to personal and family data or who
affect the honour and privacy of minors or their families will be subject to the duty of secrecy.

  4. The transfer of data, including those of a reserved nature, necessary for the system
educational, will be carried out preferably by telematic means and will be subject to the legislation in

protection of personal data. In the case of the transfer of data between
Autonomous Communities or between them and the State, the minimum conditions shall be
agreed by the Government with the Autonomous Communities, within the Conference
Education Sector".

       LA LOMCE reformulated the wording of article 147 of the LOE, indicating

       147:

  "The Government, after consulting the Autonomous Communities, shall present annually to the

Congress of Deputies a report on the main indicators of the system
the results of Spanish diagnostic evaluations or
and the recommendations arising from them, as well as on the
highlights of the Council's report on the education system
State school.


  The results of the evaluations carried out by the education authorities shall be
brought to the attention of the educational community through common indicators for
all Spanish schools, without identification of personal data and
after consideration of the socio-economic and socio-cultural factors of the context".



    1) The claimant has been contacted by post to inform him of
which is manifested to the AEPD.


FOURTH: The complaint was admitted for processing by the Director of the AEPD on 11/06/2019.

FIFTH: On 20/12/2019, it was agreed by the Director of the AEPD:



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid Sedeagpd.gob.es 12/36








       "FIRST: START THE PROCEDURE FOR PENALTIES against the
DIRECTORATE GENERAL OF EDUCATION ( DEPARTMENT OF EDUCATION, GOVERNMENT
DE NAVARRA), for the alleged infringement of Article 5.1(a) of the GPRS, in accordance with

Article 83(5)(a) of the GPRS.

       SECOND: Initiate the procedure for sanctioning the
DIRECTORATE GENERAL OF EDUCATION ( DEPARTMENT OF EDUCATION, GOVERNMENT
DE NAVARRA), for the alleged infringement of Article 5.1 a) of the RGPD in relation to Article
Article 9.1 of the same RGPD, in accordance with Article 83.5.a) of the said RGPD.


       THIRD: START THE PENALTY PROCEDURE for APPEAKANCE to the
DIRECTORATE GENERAL OF EDUCATION- DEPARTMENT OF EDUCATION, GOVERNMENT
DE NAVARRA), for the alleged infringement of Article 13 of the RGPD in accordance with the ar-
Article 83.5(b) of the RGPD.


SIXTH: Against the agreement of initiation, the claimed one dated 14/01/2020 makes the
The following claims are made:

1) He agrees with the imputation of the infraction of article 5.1 a) of the RGPD and
establishes as a proactive measure the review, deletion and modification of any data

identification of the CC carried out during the course of 4EP 2018/2019. In the event that it is decided to continue
In this and subsequent courses, the evaluation will be carried out anonymously, from
so that the RGPD is not applicable.

2) The infringement of Article 13 RGPD is assumed, since when the CC were made, no information was provided on the results of the tests.

The Committee has also adopted an appropriate position on data processing and the rights of parents and guardians of children.
the students. Work is underway to establish a model clause. The department of
Education has published an entire section on the website dedicated to Data Protection -
of the register of processing activities, documentation of interest
and models for educational institutions and managers and frequently asked questions about treatment of

data in the field of education.

3) They do not agree that Article 5(1)(a) has been infringed in relation to
The Committee is pleased to see that the RGPD is in line with 9.1 of the RGPD when the "other options" variant is included in the CC
in the question "sex", although the service in charge of the evaluation did not determine any more specificities.
The questionnaire referred to in the "other options" box.

Including this option within the gender variable refers or is referring only to
the gender identity of students, and the Spanish Data Protection Agency seems
confuse it with sexual orientation or sexual life, which are especially protected by
the European standard. Article 5 of the Provincial Law 8/2017 of 19/06 on social equality in the
LGBTBI+ people in force at the time the questionnaires were taken and

clearly differentiates "definitions for the purposes provided for in this foral law are

- LGBTBI+ lesbian, gay, bisexual, transgender, intersex people
and other minorities on the basis of sexual and/or gender identity, sexual orientation and/or
gender issues.


- sexual orientation orientation of erotic sexual or affective desire experienced by a per-
The awareness of belonging to one sex is directed towards other sexual identities.


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/36








- gender identity a feeling of belonging to a human group defined around the
categories of men and women, identifying with either of them (binary) both (no bina-
rio) or none (gender)".

        It ends by indicating that, without prejudice to the anonymisation of the CCAs that are carried out,

From now on, this department understands that it did not violate article 9 of the regulation,
since it was only asking for the gender identity of the students.

SEVENTH: On 4/03/2020 it was decided to start the trial period
requesting:

   1) To the Department of Education of the Government of Navarra (Directorate General of
education):

        1.1.1.Provision or regulation of the Government of Navarra authorising or permitting
        resume diagnostic evaluations of 4EP from the 2016/2017 school year.

     On 2/06/2020 he replied that this was the decision of the Director General of

Education 273/2016 approving the instructions that will regulate the course
16/17 the organisation and operation of centres. The fourth section, two, establishes
the conditions under which the DE tests will be reapplied at the end of the 4EP It is in-
The legal framework for the diagnostic evaluation will be coordinated by the evaluation section.
and quality. It will have external tests that will evaluate competencies and will be applied
and corrected in the schools. "This evaluation is of a formative and guiding nature-

for the centres. The information obtained from this analysis will be relevant to the
educational attention to the needs detected. The centres will decide when and how to for-
The Committee is also concerned that reports should be sent to families before the end of the school year if they are not available.
It is advisable that this is done in the context of the tutorial action".

         1.1.2 What is the distinction between census-type and sample-type evaluations?

     It states that the census refers to the participation of the entire population under study,

such as 4EP, which samples only a certain set of the target population
study.

          1.1.3 You said: "From the 2016/2017 school year onwards, it was agreed, before the end of the year, to
The Commission has authorised the Directorate-General for Education to implement the online application of the
socio-economic and cultural aspects of the diagnostic and individualised evaluations of the

The Navarra education system will no longer be anonymous and will be accessed through a password per-
The aim is to guarantee the confidentiality of the data provided by students in the
Answers answered"

        In this connection, you are requested:

            -It is understood that what is done online, are both types of tests, the
diagnostic competency tests, and context questionnaire tests? In this sense, it is
requests that you report on the need or obligation for both types of questioning -
The student must be identified, and the provision or rule from which this identity is deduced must be specified.
tificability.

     It indicates that DE is a tool for diagnosing and identifying the degree of acquisition of

The aim is to improve the basic skills of all students to include improvements at the individual level.
and the centre. The need to generate reports for families in the area of ac
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid Sedeagpd.gob.es 14/36








The tutorial is based on the level of acquisition of the assessed skills of each student.
The diagnostic evaluation tests are nominal and in Navarre they are
diagnostic tests have always been done manually on paper.

The CC has been online since the academic year 2011/2012 and until the
2016/17 had always been answered anonymously

          1.1.4. You are asked to report on the generation of the password keys and
user in the questionnaires, in the diagnostic one and in the context one, moreover, if the keys
user name and password are the same as the second one, if they are related or can be
relate both questionnaires in terms of their author.

       As only the context questionnaire was done online, the answers were
that:

       -Credentials were generated in the academic year 2018-19 that allowed the identification of the
participating students.

       - "EDUCA's iidgnrpersona, the management information system, was used

educational department of the Department of Education. The centres distributed the identifiers to the
Students, each their own, and they completed the questionnaire. “

       "As the questionnaire did not allow access for the second time, the centres could not
The answers are known."" "In the Department, not all people
had access to the answers to the questionnaire were able to identify the people
The first of these was the introduction of a new system for the management of the health care unit.
process, because they had the answers and also the list of identifiers

and people."

       At EDUCA, users and passwords for the questionnaires for the 2018-19 academic year and an-
The previous years have been eliminated (this is done each time the current school year is loaded).
EDUCA only serves as a system to facilitate these credentials. Both the questionnaire
as the response records are outside EDUCA.

         1.1.5. In "Protocol of actions" associated with the "Census Diagnostic Evaluation
  4ºEP curso 2018-2019" published on the Department of Education's website refers to
  The protocol for the online application of the socio-economic and cultural questionnaire is applicable.

  Above it, which appears in point B of the index, page 3 is indicated as the most outstanding -
  do

     For the best application of the questionnaire, the centres will follow the following instructions
nes:

     -3: Each student will access the web application using a
user (six numeric characters) and a personal password (four characters: two nú-

Careful! This password can only be used once ....

       On the key generation system, they are asked for the mode of generation of
the username and password, for this CC data to be filled in to obtain-
the, method of storage, how long the questionnaires are kept, and which units, and
people had access and why they could and should access it.

       It is reported that measures have been taken since the academic year 2019/2020, related to
the issues which are the subject of this test:


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 15/36








        The Director-General for Education issued an Instruction on 23 January 2020
the online questionnaire will be anonymous this academic year 2019-2020 and through
a random key that will guarantee the confidentiality of the data provided by the student
The answers to these questions are The copy of the reply, signed on 23/01/2020, also states: 'Once
No other user, teacher, student, director or teacher has answered the questionnaire.

The staff of the education department will be able to find out the identification data of each es-
tudiante"." The directors of the centres will obtain through EDUCA the relation-
The use of usernames and passwords to be allocated among the student body will be
ra random."

        All records, archives and backups where the information could be accessed have been destroyed.

confidential data of students from previous courses may appear.

        It also provides a pdf guide on the website called "day-to-day evaluation".
Census data for the fourth primary school year 2019-2020, protocol of actions" It is indicated that from -
The questionnaire should be filled in by all students who are studying 4EP and who, in order to access the

Each application will use a random username/password but only once, even though it uses
Passwords will be obtained through the EDUCA application and will be distributed randomly.
tory to the students. There are also instructions for the assessment of competencies
which is handmade on paper, in the form of booklets in which the answer is selected
ta. It is indicated that a student report is generated and with the generic definition of the levels
The level achieved in each assessed competence is directly scored by the

The following information is provided for each test and space for observations can be filled in by your-
tor or tutor . As for the custody of the evidence, it is said that the booklets were kept in
They will be available and preserved until 30/11/2020.


1) To the Ministry of Education and Vocational Training - Institute of Evaluation and
Educational Administrations:



        2.1 Regarding the DE questionnaire on basic competences and CC, please
to report:

        On which courses are they compulsory?

     On 12/03/2020, it indicates that Organic Law 8/2013 of 9/12 provides for three evaluations
In the third and sixth grades (end of primary school), and in the second year of primary school, the
daria, in the fourth year (Articles 20.3, 21 and 29).

     It states that CC are carried out in cases of:

     a) Individualised assessment of third year of primary education, with the following results
The education authorities are responsible for regulating whether or not
apply or not CC and of what type.

     b) It is carried out in the final evaluation of primary education, sixth grade, in accordance with
Article 7.5 of RD 1058/2015 of 20/11 which regulates the general characteristics of
tests of the final evaluation of primary education, it is indicated: "simultaneously with the

the final stage evaluation will be carried out using context questionnaires which will
The Ministry of Education, Culture and Sport. These questionnaires were described in
the resolution of 4/12/2017 of the Secretary of State for Education, Vocational Training and
Universities . These evaluations have been carried out at the end of the 2015-2016 academic year, until
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 16/36








         2018-2019. The implementation of these evaluations is the responsibility of the government
         The Ministry of Education is responsible for compliance with these regulations.

              It refers to the appeal decided by the Constitutional Court on various provisions of the
         Royal Decree 310/2016 of 29/07, by Judgement 114/2019 of 16/10 which considers
         partially a positive conflict of competences and declares the unconstitutionality and

         nullity of the provisions of the aforementioned Royal Decree related to the preparation of the CC, which already
         is not within the competence of the Ministry of Education as it corresponds to
         (STCO 109/2019 FJ 9) because it "does not constitute a
         direct configuration of the requirements for obtaining a diploma
         academic. Therefore, Article 5.1 of the RD states that "as of the ruling, the

         information on the socio-economic and cultural background conditions of the centres
         The results of the survey will be obtained through the application of different context questionnaires", has not
         to be prepared by the National Institute for Educational Evaluation, of the Ministry of
         Education, Culture and Sport. The same sense of the content of this ruling is appreciated,
         referred to RD 1058/2015 which regulates the general characteristics of the
         final evaluation of Primary Education, is contained in the related plenary judgment

         of the T Co, No. 109/2019 of 3/10.


              CC are also carried out in the final assessment of Compulsory Secondary Education which
         is regulated by the provisions of Article 22 of Royal Decree Law 5/2016 of 9/12 on measures
         urgent for the extension of the calendar for the implementation of the Organic Law 8/2013. These
         questionnaires have been established by annual ministerial order for the courses

         2016, 2.017, 2018.
2.1.2. Indicate if both questionnaires are developed in the same act.

              They say that CCs can be aimed at students, their parents and guardians

         and that addressed to the management of the primary school.

              He adds that in the schedules planned for the application of the tests a pe-
         The period for students to complete the CC and for families to complete the CC
         the questionnaire at your home.

               2.1.3. Report whether both questionnaires are nominal and can and should be identified by the
         The student who completes the form will be given a copy. Legal basis from which this identification can be deduced

              He says that both the assessment tests and the QCs "are carried out in an ano-
         The It is clear that this statement is contrary to what has also been stated in evidence
         by the respondent who stated that the "diagnostic evaluation is of a nomi

         In Navarre, they have always been done manually on paper," although the question
         I could have understood the question about the various context questionnaires that exist.
         here. As for the legal basis:

              Third PD

               "It is the responsibility of the educational administrations. Within the scope of the Ministry of
         Education and vocational training the instructions given each school year reco-
         I expressly request that the evaluation data be processed anonymously. "To guarantee the
         Anonymity of the answers to the family questionnaire will be given out in envelopes that the families can use to send in their own answers.

         The Commission will be able to close the questionnaires once they have been filled in".
              PD, final evaluation

         C/ Jorge Juan, 6 www.aepd.es
         28001 - Madrid Sedeagpd.gob.es 17/36








     "Article 8.4 of Royal Decree 1058/2015 states that "the results of the evaluations
The final stages will be brought to the attention of the educational community through in-
dicators common to all Spanish schools without identification of data from

personal nature and after consideration of the socio-economic and cultural factors of
context.

     It should be noted that since the entry into force of Royal Decree Law 5/2016 the
The evaluation is sample-based and has a diagnostic purpose, so the indicators are not common.
The new system will be available for all Spanish centres. According to article 3: "the provisions of the Royal Decree
1058/2015 of 20/11 shall apply only to the extent that they do not conflict with this provision".
Competence for the material conduct of the tests lies with the educational authorities.

catives. In the area of the Ministry's competence, the annual instructions include in
the following paragraph:' confidentiality. All participants in the evaluation process
will at all times maintain the utmost confidentiality regarding the content of the
and their results until they are made public. In any case, the
personal data resulting from the application of the tests must be processed in accordance with
the provisions of the regulations in force. “

     ESO final evaluation

     Royal Decree 310/2016 of 29/07 regulating the final evaluations of

Article 3.1(g) of the Secondary Education Act states that the following shall apply
to educational administrations to take measures to ensure the custody and
confidentiality of the evidence as well as ensuring the anonymity of the data of
students in the correction and grading phase of the tests"

     Article 5.3 "Context questionnaires shall in all cases be anonymous".

        2.1.4. Indicate whether the Institute develops uniform criteria related to the identification of
      The ability of the questionnaires/pupil.

    It states that the Institute coordinates the implementation of the evaluation in the field of com-
The Ministry's competence. The identification of students in these evaluations is done me-
The students are assigned a unique numerical code prior to the completion of

the evaluation. The Institute does not know the correspondence between codes and names so
cannot identify the student body.

    In 3rd year of PD, the only course in which the evaluation is individualized and a report is given
of results to the students, the identification is done in the educational centres themselves and in
the Provincial Directorates of Education in Ceuta and Melilla or the Regional Ministries of Education
the different countries. Since the evaluations of 6th year PE and 4th year ESO are not

individualized students are not identified at any time. The Institute shares with
the Autonomous Communities the method used for the anonymisation of evaluations
but it is up to them to implement this system or not.

        2.1.5. On whether the Institute is aware of the context questionnaires that are carried out by the
      different Autonomous Regions, and whether to issue any kind of report.

       It states that it is not compulsory in relation to assessments of its competence.

        2.1.6. On whether you have implemented in such questionnaires or addressed the issue of
      questions about gender identity?



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid Sedeagpd.gob.es 18/36








     It states that the Autonomous Communities drawn up by the Institute and those defined in the BOE for the 6th
 EP and 4th year of ESO that have been prescribed for all educational administrations has-
 The 2019/2020 course does not contain any questions on gender identity, only

 to the student if he or she is a boy or a girl and to the families the questionnaires refer to their child or
 daughter.

 1) You can access the website of the claimed party at the following address: https://www.educacio-
 n.navarra.es/web/dpto/evaluación-y-calidad/evaluacion/evaluacion-externa/evaluacion-de-
 navarra/child and primary education - course 2018-2019, entitled "Protocol of actions

 of CENSAL DIAGNOSTIC ASSESSMENT 4th year of Primary Education Academic year
 2018-2019", the file contains the name "webnavarra eva 4 instru" and
 The archive contains the publication of all the elements of the test.
 ba even the answers. It opens for verification, the maths test, com-
 and you can see that on the front of the booklet there are spaces for the identification
 cation of the student, centre, classroom, date, location, referring to the DE as mentioned.

 It is therefore proven that the competence assessment questionnaire developed in
 the diagnostic assessment test must be nominative.

     The guide for the use of the EDUCA computer application indicates that this
 application, tasks can be carried out according to an assigned profile and as an example,
 generate report for families in relation to the diagnostic evaluation, Identify the alumni
 The Commission has been exempted from this requirement, and has made observations, recorded responses, and access to the report on the results of the work of the Commission.

 There are three profiles: director, tutor and manager - management team and
 administrative staff.

EIGHTH: A proposal for a resolution, of the verbatim, is issued on 8/09/2020:

       "1-The Director of the Spanish Data Protection Agency should sanction
with a warning to the defendant, by:

       - a breach of Article 5(1)(a) of the GPRS, pursuant to Article 83(5)(a)
of the RGPD.



       - a breach of Article 5.1(a) of the GPRS, in conjunction with Article 9.1 of the
RGPD and 9.1 of the LOPDGDD, in accordance with article 83.5 a) of the RGPD.



       -a breach of Article 13 of the GPRS, pursuant to Article 83(5)(b) of the
RGPD"

       Allegations are received on 23/09/2020 reiterating this.


                                 PROVEN FACTS

1) The complainant states that his son is in 2018/2019, 4th grade of primary school (9-
10 years) in an Associated School of the Autonomous Community of Navarre and has had to
a nominal questionnaire which among other things contains questions such as sex:
(boy/girl/other options), about the language you use outside school, your feelings

to school, their relationships with their peers, or their parents' profession.


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid Sedeagpd.gob.es 19/36








2) In the Spanish primary education system, there are two modalities
individualised diagnostic evaluation (ID) for all students.


       Third year evaluation: the degree of mastery of the skills will be checked,
skills and abilities in oral and written expression and comprehension, calculation and resolution
of problems. If this assessment proves to be unfavourable, the teaching team will have to adopt it,
in collaboration with families, the most appropriate ordinary or extraordinary measures
setting and implementing plans to improve individual or collective results that allow
solve the difficulties.


       Final evaluation of Primary Education, in the sixth year, which will check the

degree of acquisition of linguistic and mathematical communication skills, and
of basic competences in science and technology, as well as the achievement of the objectives of the
stage. The result of the evaluation will be expressed in the levels: Insufficient (IN), Sufficient
(SU), Good (BI), Notable (NT) or Outstanding (SB). The level obtained by each student is
will be recorded in a report that will be given to the parents or legal guardians. This report will
will be of an informative and guiding nature for those schools where students have

for the sixth year of Primary Education and for those who will continue
their studies, as well as for teaching teams, parents or legal guardians and
students.

3) Simultaneously with the conclusion of the final stage evaluation, the following will be applied

context questionnaires (CC), complementary to the competence test, which
will be drawn up ( at the date of the complaint ) by the Ministry of Education, Culture and Sport.
These questionnaires provide information on the socio-economic conditions and
cultural centres for the contextualisation of the results obtained.


Royal Decree 1058 /2015 of 20/11 regulating the general characteristics of
the tests of the final evaluation of primary education established in the LOE in its article
The following is a summary of the results of the evaluations carried out in the sixth year of primary school by the
CC indicates that there would be three, one for the student, one for the families and one for the school do-
and that "the questions and answer options that must be
included in each of the questionnaires defined in the previous section are those indicated

in ANNEX ONE of the resolution"


4) The education regulations provide that the Autonomous Regions may carry out other evaluations
for diagnostic purposes, in accordance with Article 144.2 of Organic Law 2/2006,

of 3/05, on Education, modified by the Organic Law 8/2013, of 9/12, for the Improvement of
Educational Quality. In the Autonomous Community of Navarre, this power is used and ED and CC are carried out
for the fourth year of primary school from the 2009/2010 school year.

       In the Autonomous Community of Navarre, the EDs are carried out on forms that are named for each

paper format,(booklets in which the data for each student is filled in at the
the test, considering that it has been carried out in accordance with the
to relate the degree of acquisition of competences and improvement of the student.

5) In the Autonomous Community of Navarre, during the seven school years between
2009/2010 and 2015/2016 (both inclusive), the forms for the fourth grade CC

that the students respond to were made anonymously, without containing their data
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 20/36








personal. From the 2016/2017 school year, "it was agreed", to carry out the CC through a
application, online, no longer anonymous, accessed through the pair (user
password) that was assigned to the students. In the academic year 18-19, the CCs were

during the month of February 2019 and the DE tests during the week of 6 to
10/05/2019.

6) The respondent had a PROTOCOL of action associated with the assessment
census diagnosis of the fourth year of primary education for 2018/2019 published on its website
since 14/01/2019, in which it referred to both DE and CC tests. In the pun-

In addition to 5 of the INSTRUCTIONS for the implementation of the questionnaire, it was indicated (for the questions
In the case of the context studies, which were carried out online, the DE was done on paper, while the directors of the
A list of user names will be made available to teachers and school principals.
The computer application allows you to enter your name and password, as well as the number of students enrolled.
EDUCATE. This list will also include the identification data of each student

(course, group and full name). The directors will be able to access it from the
of 28/01/2019. At the time of application, the director of the centre provides
The usernames and passwords will be given to each 4th year EP tutor (as many as there are
students), for distribution to their students.

The test is carried out using the centre's computers, distributing

each tutor to each student their username/password to be entered in the
application and complete and submit the questionnaire. Before sending it, the application warns of
possible unanswered questions, and may disregard this option and terminate the
How to send it as it is, or fill in what is missing.



7) The personal data of the students collected in the forms of the CC
were stored in the databases of the respondent that were kept in the
network units of the Department of Education server, accessible from within
of the Department itself, and on the computer equipment by means of a user name and password.


8) In the form of the CC associated with the DE, for the 2018-2019 fourth year of primary school,
The "Questions and answer options which must be included in the
The "PUPIL QUESTIONNAIRE" is included in each of the questionnaires
instructions, informing that you have to "answer several questions only".
and your family". All questions are answered by ticking boxes in the answers.

The following are offered under the heading of "sex", options: a-boy, b-girl, c-other "For the sake of the
How often have you missed this course in an unjustified way? How many
days a week you dedicate to doing homework? options, linguistic model in which you study,
with references among the answers to options, in Spanish, B, in Basque with the caste-
The course is taught in Spanish, the language in which you watch television,

or reads books or uses video games, social networks, talks to teachers in the classroom and was
ra, which language he uses preferably (distinguishing) with friends in the street, in the courtyard
from school or at home with your family, on which continent were you born, your mother, your father?
Parents' level of education, their employment situation, your parents' current job, with trades
and example jobs such as "watchman" "farm worker", "doctor", "architect

"upper scale military", or "middle scale", if they have their own single room,
as is the relationship with his classmates about whether he feels lonely, marginalized.



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid Sedeagpd.gob.es 21/36








The context questionnaire does not have to contain the identification data of the student who is carrying out the
This follows from the analogical application of the provisions for these CC in the RD which refers to
the CC for the compulsory tests of the sixth year of primary school


9) Filling in the CC form is compulsory for each student in the fourth year of
primary, although questions can be left unanswered, it can even be sent with
all your unanswered questions.

10) As stated by the respondent, the legal authorisation for the processing of data for the CC
is the fulfillment of a legal obligation derived from the LO 2/2006, LOE, with

amendments to the LO 8/2012 LOMCE, although no regulation states that the CC
must contain the student's identification data. The aforementioned regulations for education
The primary education system consists of the Organic Law 2/2006, of 3/05, on Education, modified by the
Organic 8/2013, of 9/12, for the Improvement of Educational Quality, which provides in its article
21 conducting an individual assessment of all students at the end of the sixth
Primary Education course. The Royal Decree 1058/2015, of 20/11, regulates

general characteristics of the tests of the final evaluation of Primary Education,

11) On the question in the CC of, sex of the student completing the questionnaire, with
three response options, boy-girl, other options, was introduced unilaterally by
the one requested in application of Article 19.a) of the Provincial Law 17/2019, of 4/04, on equality

between men and women, which points out that "in statistics and studies, the
The aim is to ensure that the public authorities of Navarre are effective in incorporating the perspective of
in their day-to-day work, they should systematically include the variable of sex, rec
The different categories, in all statistics, surveys and data collection
that they carry out". As determined by the rules applicable to the CC, the questions of
This questionnaire was prepared by the Ministry of Education, which did not introduce any aspect of the

guno on the subject. If it was pointed out that education administrations could introduce
new issues, but not expand on them.

12) With the EDUCA application in which the data is stored, it is possible to produce information on the
month and access the questionnaires, see the answers, the questions left blank, and the
score obtained. The "corrected booklets", alluding to ED, are kept in the

school until 30/11/2019. Families are given a "student report at the
month of June"

(13) At least in the CC, there was no reference to the collection, storage, storage, processing and distribution of the products.
The processing of personal data, the legal basis or the exercise of rights
chos. It is not known if the same thing happened in the diagnostic skills questionnaire (DQ)

which has not been the subject of the complaint, although the interdependence between am-
bos.

(14) In the course of these proceedings, the respondent has stated that

     -You have added explicit references to the basic information on data protection in

 the protocol of actions sent to the schools and published on the website of the De-
 Education Department.

     -Implementing the information on DE and CC that will be given to the families, in addition
 to be exhibited on the Regional Ministry's website.

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 22/36








     -The information aspects of data collection and processing will be provided
  when the data is requested in the online application itself.

     -Provides for a data retention period of three school years following the school year
  in which they are collected.

     - Users and passwords for the cur-
  so 2018-19 and earlier (this is done each time the current school year is loaded) and

  in evidence claimed to have destroyed all records, files and backups
  in which data on students from previous courses may appear.

     The Director-General for Education issued an Instruction on 23 January 2020
  it is provided that the CC online will be anonymous this academic year 2019-2020 and through a key
  random.

     -The protocol of actions for the questionnaires for the 2019-2010 academic year has been changed
  of the fourth year of primary school published on the web.





                             LEGAL FOUNDATIONS

                                              I

        By virtue of the powers conferred on each authority in Article 58(2) of the GPRS

control, and in accordance with the provisions of Articles 47 and 48.1 of the LOPDGDD, the
The Spanish Data Protection Agency is competent to resolve this procedure.


                                             II


        As a starting point, it should be noted that the twenty-third additional
of the Organic Law 2/2006, of 3/05, on Education, generally establishes the principles
in relation to the processing and communication of personal data within
of its scope, by providing for the following:


        "1. Schools may collect personal data from their students that
        are necessary for the exercise of their educational function. Such data may make
        reference to the origin and family and social environment, characteristics or conditions
        and results of their schooling, as well as those of other
        circumstances whose knowledge is necessary for the education and guidance of

        the students.

        2. Parents or guardians and the students themselves must collaborate in obtaining
        the information referred to in this article. The incorporation of a student
        to an educational establishment will imply consent to the processing of its data and,

        where appropriate, the transfer of data from the centre where it was
        schooling, under the terms established in the legislation on
        data protection. In any case, the information referred to in this section
        will be the strictly necessary for the teaching and guidance function, and cannot
        be treated for purposes other than educational without express consent.

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid Sedeagpd.gob.es 23/36









       3. In the processing of student data, normas técnicas and
       organisational arrangements to ensure their security and confidentiality. The teaching staff and the

       other personnel who, in the exercise of their duties, access personal data and
       or that affect the honour and privacy of minors or their families will be
       subject to the duty of secrecy.

       4. The transfer of data, including those of a reserved nature,  necesarios to the
       educational system, will be carried out preferably by telematic means and will be subject to

       legislation on the protection of personal data, and the
       minimum conditions shall be agreed by the Government with the Communities
       Autonomous within the Sectoral Conference on Education".

         In this complaint, the issue at stake is the competence of the assessment of

the quality of teaching by means of questionnaires, in this particular case, not in the
The evaluation of acquired knowledge is not the same as the evaluation of socio-economic factors and
cultural issues related to the homes, environment and environments where the
student. For example, the Socio-economic and Cultural Index (ISEC), which also includes
among others, in the PISA tests, is calculated from some of the answers of
The students and their families in the context questionnaires, which summarise various aspects of the

training on the social and family context of the students and is elaborated from data
as the level of education of the father, mother, their professions, or level of resources do-
The use of a computer for personal use is also possible.

         On whether for the 2018/2019 academic year the current regulations required the course to be
Some kind of context assessment, and if required, if this is a requirement, is
must be anonymous or identifiable, it should be noted:

         Even with the modification of the LOE by the LOMCE (2013), it is not apparent that
there is a reference to the obligation to carry out any evaluation of the students of 4EP. An-

Article 21 of the LOE also did not indicate that it was obligatory or
census, stating: "At the end of the second cycle of primary education all children
centres will carry out a diagnostic assessment of the basic skills achieved
by their students. This evaluation, which is the responsibility of the educational administrations, will have
training and guidance for the centres and information for families and the community

together with the educational community. These evaluations will have as a reference framework the
general diagnostic evaluations established in article 144.1 of this law".

         Article 20.3 of the LOMCE states

         "Schools will carry out an individualised assessment of all pupils
The school will be open to all students at the end of the third year of Primary Education, as arranged by the Admissions Authorities.
The educational institutions, which will check the degree of mastery of the skills, ca-
patience and skills in oral and written expression and comprehension, calculation and
problems in relation to the degree of acquisition of competence in line-based communication

and mathematical competence. If this assessment is unfavourable, the team will be able to
The teacher shall take the most appropriate ordinary or extraordinary measures

       Since 30/12/2013 the diagnostic evaluation is on the teaching of sixth form.
It follows that it will not be anonymous, as Article 21(3) indicates that the result of the analysis will be published in the Official Journal of the European Union.
The certificate will also be given to the parents.


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 24/36








      It indicates that with the entry into force of the LOMCE, the individual assessment
The 4EP census was maintained for the 3rd and 6th grades of primary school, and that voluntary
In accordance with Article 144.2 of the LOMCE in Navarre, the historical evaluation of the

4EP diagnostic census data from 2016-2017.
       The result is that there is no obligation derived from the law, which expressly establishes

the carrying out of any kind of evaluation, or specifically the evaluation of
context, although article 144.2 of the LOE states: "The educational administrations
may establish other assessments for diagnostic purposes.
claimed

       Taking as an example of context evaluation, that of the end of primary school, it is pointed out
in Royal Decree 1058/2015, in its article 7.5, which at the same time as the
of the final stage evaluation, context questionnaires developed by the

Ministry of Education, Culture and Sport. These questionnaires will make it possible to obtain
information on the socio-economic and cultural conditions of the centres for
contextualisation of the results obtained. Also in its article 8.1, and "giving
compliance with Article 147 of the LOE, the results of the final stage evaluations
will be brought to the attention of the educational community through common indicators

for all Spanish schools, and that these common indicators will be
established by the Ministry of Education, Culture and Sport."
         On whether the applicable regulations establish that the data from the context questionnaire

must be anonymous, or the resolution of 30/03/2016 of the
State Secretariat for Education, Vocational Training and Universities, which
define the context questionnaires and common centre indicators for
The final evaluation of primary education determines in its article 7.5 that "in a
At the same time as the final stage evaluation is carried out, questionnaires will be applied to
context, to be drawn up by the Ministry of Education, Culture and Sport. These questionnaires

will provide information on the socio-economic and cultural conditions of
centres for the contextualisation of the results obtained. It is indicated as outstanding:

          Article Two: Background questionnaires.


       "The context questionnaires to be applied in the final evaluation of Educa-
There will be three primary schools: one for pupils in the sixth year of primary education
to carry out the evaluation (hereinafter referred to as the student questionnaire), another one addressed to their
parents and legal guardians (hereinafter referred to as the family questionnaire), and a third
addressed to the management of the primary school (hereinafter referred to as the

for the management).

       2. The questions and answer options that must be
included in each of the questionnaires defined in the previous section are those indicated
in ANNEX I to this resolution


       3. Educational administrations may:

    a) To apply questionnaires addressed to other groups, in addition to those indicated in article
The second paragraph of paragraph 1 of this resolution.




C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 25/36








    b) To include other questions in each questionnaire in addition to those referred to in Article
the second part of this resolution. However, no response options may be added
other than the questions set out in ANNEX ONE to this resolution.


    c) Apply the different questionnaires in the format considered most appropriate (pa-
pel or digital).

    d) To define the time and place of completion of the different questionnaires.


   e) Lay out the questionnaires according to their needs and alter the order of the questions.
This includes the possibility of jointly designing the questionnaire for the
and the questionnaire for families, provided that it is clearly stated who
you must complete each part.


        The third point states that "The National Institute for Educational Evaluation facilitates the
educational administrations will provide a code book with the necessary instructions and
mandatory for the correct recording of data and subsequent processing
of the common indicators" .

        This State Secretariat resolution has been amended by a resolution of

4/12/2017, BOE of 27/12, which varies one question in this ANNEX ONE.

        No aspect of data protection is included in the resolution or in the
modifies it.


        The ANNEX ONE mentioned above lists the questions and response options that
The following should be included in each of the questionnaires, indicating and differentiating
The student's form must be filled in by the parents or guardians. The question-
The student body starts with the question "Are you a boy or a girl?
and contains questions about how often you use a computer or tablet

for school work in each of the following locations, how many days a week of
The first thing you have to do is to do your homework. It contains a block total of 11 questions, ending with the "In
general to what extent you agree with these statements about your teachers and
teachers? A) I know what you expect me to do...There is no indication in any section that the ques-
The context context is to be nominative or the student is or can be identified in
The identity of the students who complete the questionnaire is therefore not revealed.

ec as necessary in any rule, nor is it justified in relation to the purpose of the data
The following is a list of

        The questionnaire for families starts with questions such as in which country they were born.
If you and your daughter or son, please indicate how often you use the family home

following resources..., with four response options, number of people who convert
see at home, degree of satisfaction with the following aspects related to the school... in
As for the teaching staff, or the question of whether you would recommend this centre, how many
days a week your child does homework including studying how often you
or other people in the house talk about the following with your son or daughter... you also wonder

the highest level of study completed by the mother or father, or the category that
better describes the employment situation of the mother and father.



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid Sedeagpd.gob.es 26/36








        In the context test that made the claim of 4 EP, for the student are contained
17 issues, some other than ANNEX ONE, plus the above-mentioned boy/girl,
related to the use of language, including those referred to in ANNEX ONE

questionnaire for families, such as those referring to parents, parents' employment status,
their level of education and the kind of work they do.

        The issue must be linked not only to existing legislation, but also to
contextual assessments that are carried out in conjunction with evaluations of
and for the purpose of the data extracted from this evaluation of the

context.


        The result is that there is no obligation derived from law, which expressly establishes
the carrying out of any kind of evaluation, or specifically the evaluation of
context, although article 144.2 of the LOE states: "The educational administrations
may establish other assessments for diagnostic purposes.
claimed.


         It is concluded that the online context questionnaire for
4EP students contain personal data, it is not anonymous, it is not justified because
must not be anonymous, having been so in the past, and has no information clause of
data collection.

        While the DE questionnaire of competencies is nominative, it contains the da-
It is clear from the regulations that such identification must be
However, the CC does not have such a character, which is furthermore completed in
different moments. Nor does it follow from its purpose that it should be nominative

when, they were anonymous, those carried out before the one carried out in the academic year 2018-
2019.

        However, for the academic year 2018-19 which is the subject of the complaint, the CC was nominated by the
ve, the access and user passwords being assigned by the system itself. No indication

In no section of the regulations in force does the CC have to be named or have
o the student surveyed should be identified, so that the identity of the students who meet the requirements of the
The questionnaire is not required by any standard, nor is it justified in
The data will be used in accordance with the purpose for which they are intended, and it will be possible to obtain the same factual information.
The data will be processed without processing the personal data of the students, i.e. without filling in their names.

The questionnaire.

                                            III

        The respondent collected information associated with some data and stored it in her
systems for the realisation of indicators, which according to the precedents do not require

san of the identification of the author of the questionnaire. The collection and processing of this data
This involves the processing of specific personal data that is not necessary for the purposes of
The Commission is also aware of the need to ensure that personal identification data are recorded, and therefore ex-
The data protection laws, which do have proof of ED, are being processed.
As an example, it should be noted that the statistical analyses of the centre's group or at national level -

The information provided in the questionnaire should not be correlated with the identified or identifiable author of the questionnaire.



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid Sedeagpd.gob.es 27/36








         As for the statement by e claiming "that although the survey is not
  anonymous, personal data are pseudonymised, i.e. they cannot
  be attributed to an interested party without the use of additional information", that Regulation extends

  their protection, as set out in Article 1(2), to the rights and freedoms
  of natural persons, and in particular their right to protection of the
  personal data, defined in Article 4.1 as "any information relating to a person
  identified or identifiable natural person ("the data subject"); an identifiable natural person
  any person whose identity can be established, directly or indirectly, in particular
  by means of an identifier, such as a name, an identification number, data

  location, an online identifier or one or more elements of the identity
  physical, physiological, genetic, psychological, economic, cultural or social characteristics of that person.

         Therefore, the respondent is charged, generally speaking, with the following
  of the 2018-2019 academic year made with personal data of 4EP students, the
  commission of the infringement of Article 5.1.a) of the RGPD, which states

   "The personal data will be:


   (a) processed in a lawful, fair and transparent manner in relation to the data subject ("lawfulness,
  loyalty and transparency")


        The infringement is connected to the cases in which the various bases are determined
Article 6 of the RGPD, entitled "Lawfulness of processing", contains the following
indicates:

  1. Treatment shall only be lawful if at least one of the following conditions is met
      nes:" and those which serve this purpose.


         In this case, there is no need for such questionnaires to be associated
   the student who completes them, who must be named, and the rule does not indicate that it affects
   to the student or must contain his or her data. This applies to the entire questionnaire in general,
   and it is established that there is no legitimate basis for the processing carried out.

         As a general rule, data should only be collected for specific purposes.
  and legitimate and explicit purposes. This prerequisite involves analysing whether the personal data
  The following are the main reasons why the treatment is necessary and right for the
  The aim is to develop and assess the CC The specification of the purpose

  of data processing analysed the current regulations and purposes of the processing by the CC
  does not result in personal data having to be used to fulfil the purpose for which
  is designated in the LOE and concordant norms.

         If the aims of the questionnaire treatments can be achieved without the use of a

  The processing of personal data, in addition to proving that it is not
  It follows that there is no concrete legitimate basis for this, considering that the
  processing of personal data has an impact on the fundamental rights of the student,
  in terms of personal data and privacy. So if the same purpose can be
  achieved without processing the data, if it does not derive from the regulations in force that are to be processed, not
  there is a legal basis for processing them.


                                              IV

         Because it deals with "sex" in the same questionnaire: with the options "boy",
  C/ Jorge Juan, 6 www.aepd.es
  28001 - Madrid Sedeagpd.gob.es 28/36








"girl", and "other options" is charged with the infringement of Article 5.1.a) of the RGPD,
considered as special category data as they relate to "data relating to
the sexual life or sexual orientation of a natural person", which has no basis

legal to be treated as it has been in the CC questionnaire, by introducing in the
question: sex: boy, girl, a third with the selection of "other options".

       The complaint does not detail what this option refers to, which is intended to
socio-economic questionnaires accompanying the evaluation test of
diagnosis where knowledge and skills are valued. The ED tests are

the 2018-2019 CC, which are also denounced, without being
inform the parents of the processing of data, and that the questionnaires do not contain
information clauses that must contain the aspects and purposes of the data for the purposes
information and exercise of rights.

        These articles are marked:


  5"1. The personal data will be:

  (a) processed in a lawful, fair and transparent manner in relation to the data subject ("lawfulness,
loyalty and transparency")


  9. 1. The processing of personal data revealing ethnic origin is prohibited
or racial, political opinions, religious or philosophical convictions, or the
and the processing of genetic data, biometric data to identify
unambiguously to a natural person, data relating to health or data relating to life
sexual orientation of a natural person.


  9.2. Paragraph 1 shall not apply where one of the following circumstances applies
following:

  a) the data subject has given his explicit consent to the processing of such data

for one or more of the specified purposes, except where the law of
Union or of the Member States provides that the ban referred to in the
paragraph 1 may not be lifted by the person concerned;"


       Adding Article 9.1 of the LOPDGDD "For the purposes of Article 9.2.a) of
Regulation (EU) 2016/679 , in order to avoid discriminatory situations, the only
consent of the data subject will not be sufficient to lift the ban on data processing
whose main purpose is to identify their ideology, trade union membership, religion, orientation

sexual orientation, beliefs or racial or ethnic origin.
    It is recalled that the option presented in the context questionnaire was "sex", in addition
of the boy-girl one, "other options". This is a question included in ANNEX ONE of the

Royal Decree 1058/2015 and in the resolution of 30/03/2016, recalling that the
The possibility for the Autonomous Regions of " Including other questions in each questionnaire in addition to the
The following are the main points made in Article 2 of this resolution. However, no op-
The following questions were answered by the Commission, other than the questions in Annex 1 to the Preliminary Report
The resolution. There is the possibility of introducing new ones. This regulation, provides for

ANNEX ONE: "Questions and answer options which must be included in the
The questions and answer options that are asked in each of the questionnaires are

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 29/36








The following should be included in each of the questionnaires defined under the heading
The definitions of the above are those indicated in ANNEX I to this resolution".


        First of all, the model questionnaire created by the respondent is out of line with the
The model of the ANNEX ONE of the resolution of
30/03/2016 which does not include this term.

        It is noted that within sex the given option of "other option" is unrelated.
The "gender of the student" is not biologically determined, but is
that would fall under the issue of gender identity that is introduced without explanation
in the questionnaire.


        Gender refers to the social and cultural construction that defines the different carac-
emotional, affective and intellectual characteristics, as well as the behaviours that each person
The concept of "gender equality" is not a new one, but it is one that has been assigned to men and women as their own.

The main reason for this is the fact that men and women do not identify with these characteristics, and so, apart from the
Male and female there would be other genders: trans, intersex, non-binary gender, pangene -
ro, etc. In this way, there are as many genders as there are identities, and therefore as many identities.
gender as people.


        On the specific term "gender identity", the RGPD makes no mention of it.

        On the other hand, "sexual orientation" is the emotional, romantic, sexual and psycho-
(Wikipedia) and is how it is experienced by the person in a sustained way over time.
describes different from gender identity.

        The Universal Declaration of Human Rights, the International Covenant on
Civil and Political Rights and the International Covenant on Economic, Social and Cultural Rights
include in their guarantees on non-discrimination, lists of prohibited grounds for

discrimination. These lists do not explicitly mention sexual orientation and identity
but conclude with the expressions "any other condition" or "any other
social status". The use of these expressions shows that the intention was that these lists
were open and illustrative; in other words, the grounds for discrimination are not
closed.

        It is clear and corroborated that sexual orientation and gender identity are two as-

different points. In its case law, general comments and concluding observations, the
United Nations treaty bodies have consistently held
that sexual orientation and gender identity are prohibited grounds for discrimination
nation in accordance with international law. Moreover, the procedures have long been
The special procedures of the Human Rights Council have recognised the discrimination that exists

because of sexual orientation and gender identity.

        In the same vein, various mechanisms for the protection of human rights
at the international level, such as the Committees, have affirmed that States have an obligation
to protect people from discrimination on the basis of their sexual orientation. It is possible to
This is reflected in decisions of the Human Rights Committee - (Toonen v.
Australia, 1994) and in general comments of the Committee on Economic Rights, So-

Committee on the Rights of the Child, the Committee against Torture, the Committee on the Rights of the Child, the
The Committee on the Elimination of Discrimination against Women For example, in its observation
In general, the Committee on Economic, Social and Cultural Rights points out that the States parties to the Covenant have a duty to protect the rights of the child.

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 30/36








must ensure that a person's sexual preferences do not constitute a
obstacle to the realization of the rights recognized by the covenant. Gender identity
is also recognised as a prohibited ground of discrimination. The Committee on Economic, Social and Cultural Rights

The right to non-discrimination in Article 2 of the Convention on the Rights of the Child has been interpreted as
The Convention on the Rights of the Child includes sexual orientation and gender identity.
     The CC that was made in February 2019, according to the petitioner, is intended to comply with the

mandate contained in legal provisions to ensure the effective integration of
the gender perspective in the ordinary activity of public authorities "including
systematically the gender variable in statistics, surveys and data collection that
carry out", an action which, as indicated in Article 19 of Law 17/2019 of 4/04 of the same
The number of men and women it indicates:


     The Public Administrations of Navarre, in order to guarantee the efficiency of the incorporation of
The gender perspective in their day-to-day work should be

     a) Systematically include the variable of sex, collecting the different categories, in
all the statistics, surveys and data collection they carry out.


     b) Establish new gender indicators that will make it possible to better understand
differences in values, roles, situations, conditions, aspirations and
the needs of women and men, and their manifestation and interaction in the reality that
should be analysed and included in statistical operations.


     (c) Carry out sufficiently large samples so that the various variables
can be analysed according to the gender variable, and deal with the available data on
so that the different situations and needs of women and girls can be
men in the various fields of action".

        As can be seen, the above-mentioned rules of reference, which are based on the ANNEX

ONE, refers exclusively to the variable "sex" differentiating exclusively between
boy-girl.

        The introduction of such a gender identity identifying its holder would have to
be carried out in any case, when there is a relationship between what is being asked, for some purpose that

the data is to be obtained for the purpose for which the data is to be processed, without any attempt to collect data by
have them, without a specific purpose, and in this case, the survey was of a socio-economic and
The evaluation of the project was carried out by the Ministry of Health and the Ministry of
studies or analyses that aspect, so it makes no sense to establish a single
that scope, with no connection to the rest of the issues. In this sense, it is not appreciated

need in the treatment of that option when carrying out the questionnaire.

        Furthermore, for statistical purposes, Spanish regulations maintain, as does the
in most European countries, the binary model of sex: male and female, which appears
Article 170 of the Decree of 14/11/1958 approving the
Regulation of the Civil Registry Law. In this case, moreover, the possibility of introducing

in the questionnaires the variable "other options" under "sex" does not correspond to this
The concept of "legal aid" is not well understood and lacks the necessary legal basis in our legal system.

        In the Agency's view, the exception provided for in point (j), being the processing
necessary for statistical purposes, does not apply, as it requires that the

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid Sedeagpd.gob.es 31/36








provided for in Union or Member State law, which must be proportionate to the
objective pursued, respecting in substance the right to data protection and establishing
appropriate and specific measures to protect the interests and fundamental rights of

and the above-mentioned regulations only cover the variable "sex".

       In any case, a questionnaire is presented here in which the student, while not mentioning the
If your sexual orientation is not clear, you can deduce that you do not feel like a boy or a girl, if you mark other
options, an issue that can be considered to be related to sexual orientation, which
The issue is often developed in the standards in a unitary way, and in the background, to a question that I would like to address.

This is a very important issue, and one that should be related to expressing your beliefs, as gender identity is a matter of concern to all of us.
The internal structure of each, as defined by the Inter-American Committee on Economic, Social and Cultural Rights, is as follows
The European Union is committed to the promotion of human rights in accordance with resolution AG/RES. 2653 (XLI-O/11):
Human Rights, Sexual Orientation and Gender Identity, 23 /04/2012 which defines
like:


       "Gender identity is the internal and individual experience of gender as each
The person experiences it deeply, which may or may not correspond to the sex assigned to him or her.
The body's personal experience (which could be in the form of a "body" or "body") is the most important factor in determining whether or not a person is born.
to change the appearance or function of the body through medical techniques,
surgical or other, provided that it is freely chosen) and other ex

gender issues, including dress, speech and manners."

        That is, she is questioning her sense of gender, with which she identifies, if she co-
affects the one assigned at birth: woman or man, or "others", when their sex is felt, with the
which is identified, does not coincide with that assigned at birth, which is outside the character and purpose

of the educational context questionnaire as it is not oriented in that way and it should not
oblige minors or any other person to express or declare their beliefs
personal and intimate affairs. This prohibition is based on the following
points out the precept transcribed, in avoiding discriminatory situations, such as those that could
The public register of the sexual orientation of girls and women in the

persons or the collection of gender identity of various groups without a
determined or without a legitimate basis, or of beliefs.

       According to this provision, the general rule is a ban on processing
of such data, unless one of the exceptions set out in its
paragraph 2.


       The contribution of the information of the questionnaire was obligatory, not being it
to all issues. In any case, this should be clearly reported
and thus indicated in the data collection systems.


         The infringement of Article 5.1.a) of the RGPD is considered and accredited in relation to
9.1 of the RGPD and 9.1 of the LOPDGDD.

                                            V

         The questionnaire does not contain any information clause on the protection of

data.

         No content or information given to students, parents/parents
on the completion of this questionnaire.
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 32/36









        Considering the previous declaration of infringement of Article 5.1.
The lack of a legitimising basis for the treatment of 4EP students by the CC, and

The purpose of this is to analyse the conduct of the respondent, which in this case was indeed collected from
The course is designed for the personal use of all students.

        As soon as personal data is collected, it means that it was not contained in
the same information on the purpose, legitimate basis and exercise of rights of the alumni
The Commission is not aware of any such information, as it was not included in the questionnaire, nor is it clear that the information was given

a, parents/guardians on the completion of this questionnaire.

        In this case, it was possible to know who each of the questionnaires corresponded to by
have associated user and password data, identifiable since they were assigned
by the directors of the centres.


        The information collected and the transparency of such collection and processing is
a principle established by the GDR in Articles 12 and 13.
are not sufficient to legitimise the processing of personal data, but they are a condition is
The processing of personal data is essential to guarantee the legality of the processing.


        In order to be valid, the treatment must be legal, fair and transparent.
The aim is to ensure that the public is supported on a legitimate basis and that it is informed at the time of any re
take the data from the points made in Articles 12 and 13 of the RGPD. Also the
contraventions of these principles are independent.


        The defendant does not comply with the provisions of Article 13 of the RGPD, as indicated in the Informa-
The information to be provided when personal data are obtained from the data subject:


        "1. Where personal data relating to a data subject are collected, the
When the data are obtained, the data controller will provide you with all the
information below:


a) the identity and contact details of the person in charge and, where appropriate, his representative

b) the contact details of the data protection delegate, if applicable;

(c) the purposes of the processing for which the personal data are intended and the legal basis of
treatment;


(d) where the processing is based on Article 6(1)(f), the legitimate interests
of the person in charge or of a third party;

e) the recipients or categories of recipients of the personal data, where applicable;


(f) where appropriate, the controller's intention to transfer personal data to a third country or
international organization and the existence or absence of a decision on the adequacy of
Commission, or, in the case of transfers referred to in Article 46 or 47 or Article
49(1), second subparagraph, reference to adequate or appropriate safeguards and
means of obtaining a copy of these or the fact that they have been lent.


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid Sedeagpd.gob.es 33/36








2. In addition to the information referred to in paragraph 1, the controller
shall provide the data subject, at the time the personal data are obtained, with the following
information necessary to ensure fair and transparent data processing:


a) the period during which the personal data will be kept or, when this is not possible,
the criteria used to determine this deadline;

b) the existence of the right to request access to the data from the data controller
and their rectification or deletion or the limitation of their

processing, or to oppose the processing, as well as the right to the portability of the data;

(c) where the processing is based on Article 6(1)(a) or Article 9,
paragraph 2(a), the existence of the right to withdraw consent at any
time, without affecting the lawfulness of processing based on prior consent
to its withdrawal;


(d) the right to lodge a complaint with a supervisory authority;

(e) whether the communication of personal data is a legal or contractual requirement, or a
necessary to enter into a contract, and whether the data subject is obliged to provide the
personal data and is informed of the possible consequences of not providing such data;


(f) the existence of automated decisions, including profiling, to be
referred to in Article 22(1) and (4) and, at least in such cases, significant information
on the logic applied, as well as the importance and expected consequences of such
treatment for the interested party.


3. Where the controller plans the further processing of data
for a purpose other than that for which they were collected, will provide the
information about that other purpose and, prior to such further processing, information

any additional relevant information within the meaning of paragraph 2.

4. The provisions of paragraphs 1, 2 and 3 shall not apply when and to the extent

that the person concerned already has the information".


        In the context of the information provided to children or their representatives, the
The use of short notices in simple language should be particularly stressed in Wales.
The course is short, concise and didactic and easy to understand. A short notice will contain the in-
basic training to be communicated when collecting personal data directly from the inte-

(Articles 10 and 11). This notice shall be accompanied by a further notice ex
tense, perhaps a hypertext link, which will contain all the relevant details. It informs you-
The legal representatives and the children who have the custody of the child shall (always) be informed of the
required quality
                                             VI

        Article 83.5 a and b of the GPRD, considers that the infringement of "the principles
treatment, including the conditions for consent under the

Articles 5, 6, 7 and 9" and "the rights of the data subjects under Articles 12 to 22;
is punishable under Article 83(5) of the said
Regulation, with administrative fines of up to EUR 20,000,000 or, in the case of
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid Sedeagpd.gob.es 34/36








one company, for an amount equivalent to 4% of turnover at most
overall annual total for the previous financial year, opting for the highest amount".
In addition, Article 83.7 of the GPMR states

       "Without prejudice to the corrective powers of the supervisory authorities under
Article 58(2), each Member State may lay down rules as to whether it may, and
to what extent, imposing administrative fines on public authorities and bodies is
in that Member State".


       The Spanish legal system has chosen not to penalise with a fine the
public entities, as indicated in Article 77.1. c) and 2. 4. 5. and 6. of the LOPDDGG:

"1. The regime established in this Article shall apply to processing operations for which
are responsible or in charge:

  c) The General State Administration, the Administrations of the Communities
The local authorities and the entities that make up the local administration.


  2. Where the persons responsible for, or in charge of, the activities listed in paragraph 1 commit
any of the offences referred to in Articles 72 to 74 of this organic law, the
The competent data protection authority shall issue a decision sanctioning
the same with caution. The resolution will also set out the measures that
the appropriate action should be taken to bring about the cessation of the conduct or the correction of the effects of the infringement that is
would have committed.


  The decision shall be notified to the controller or processor, to the body of which
depends hierarchically, where appropriate, and to those affected who had the status of
interested, if any.

  4. The data protection authority must be informed of decisions that

be made in connection with the measures and actions referred to in paragraphs
previous.

  5. The following shall be communicated to the Ombudsman or, where appropriate, to the analogous institutions
the autonomous communities the actions carried out and the decisions taken at
under this article.


  6. When the competent authority is the Spanish Data Protection Agency, it shall
will publish on its website, with due separation, the resolutions referring to
entities in paragraph 1 of this article, with express indication of the identity of the
the controller or processor who committed the infringement".


       Article 58(2) of the GPRS states: "Each supervisory authority shall have all the
 The following corrective powers are indicated below:
       (b) to punish any controller or processor with a warning

where processing operations have infringed the provisions of this Regulation
mento;

       (d) order the controller or processor to carry out the processing operations

treatment in accordance with the provisions of this Regulation, where appropriate, of
in a certain way and within a specified time".

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid Sedeagpd.gob.es 35/36








       Therefore, in accordance with the applicable legislation and assessed on the basis of
graduation of penalties whose existence has been established,



       the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: TO IMPOSE ON THE DEPARTMENT OF EDUCATION OF THE GOVERNMENT OF
NAVARRA, with NIF S3100007H:


- A warning penalty for an infringement of Article 5.1.a) of the GPRS, of
in accordance with Article 83.5(a) of the GPRS.

- A warning penalty for an infringement of Article 5.1.a) of the GPRS, in
relation to Article 9.1 of the RGPD and 9.1 of the LOPDGDD, in accordance with Article

83.5 a) of the RGPD.

- A penalty of a warning for an infringement of Article 13 of the RGPD,
in accordance with Article 83.5(b) of the GPRS.

SECOND: To notify this resolution to the DEPARTMENT OF EDUCATION OF THE

GOVERNMENT OF NAVARRA.

THIRD: TO COMMUNICATE this resolution to the PEOPLE'S DEFENDER, of
in accordance with the provisions of Article 77.5 of the LOPDGDD


FOURTH: In accordance with the provisions of article 50 of the LOPDGDD, this
The decision will be made public after it has been notified to the interested parties.

       Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with Article 123 of the LPACAP, the

The interested parties may lodge an appeal for reconsideration with the Director of
the Spanish Data Protection Agency within one month from the day
following the notification of this decision or directly in an appeal
before the Administrative Chamber of the National Court of Justice, with
in accordance with Article 25 and the fourth additional provision, paragraph 5
of Law 29/1998, of 13/07, regulating the Contentious-Administrative Jurisdiction, in

two months from the day following the notification of this act, as laid down in
provided for in Article 46.1 of the aforementioned Law.

       Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, it is
may suspend, as a precautionary measure, the final administrative decision if the interested party

expresses its intention to lodge an administrative appeal. If this is the
In this case, the interested party must formally communicate this fact in writing to the
Spanish Data Protection Agency, presenting it through the Electronic Register
of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the
other registrations provided for in Article 16.4 of the aforementioned LPACAP. It must also be transferred to

the Agency the documentation proving that the contentious action has been effectively brought
administrative. If the Agency is not aware that the action has been brought
administrative proceedings within two months from the day following notification
of this resolution, would terminate the precautionary suspension.

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid Sedeagpd.gob.es 36/36












Mar Spain Martí
Director of the Spanish Data Protection Agency







































































C/ Jorge Juan, 6 www.aepd.es

28001 - Madrid sedeagpd.gob.es