CTPDA (Andalusia) - RPS-2023/001

CTPDA - RPS-2023/001
Authority:	CTPDA (Andalusia)
Jurisdiction:	Spain
Relevant Law:	Article 6 GDPR
Type:	Complaint
Outcome:	Upheld
Started:	03.07.2020
Decided:
Published:
Fine:	n/a
Parties:	City Council of Jerez de la Frontera
National Case Number/Name:	RPS-2023/001
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	CTPDA (in ES)
Initial Contributor:	Bernardo Armentano

Based on presumption of common property, the controller initiated a debt recovery proceding against a data subject that was married under full separation regime and illegally disclosed the spouse's debt information to them. The DPA issued a reprimand.

English Summary

Facts

During a debt recovery procedure, the City Council of Jerez de la Frontera (the controller) requested financial data of the data subject's from the National Social Security Institute. The controller erroneously assumed that the data subject was jointly liable for a debt relating to a property acquired by their spouse. However, the data subject was married under a full separation of property regime. After receiving a notice of seizure of the pension paid by the National Social Security Institute, the data subject filed a complaint with the DPA arguing that they received personal information concerning their spouse without their consent. The data subject further alleged that the controller obtained access to their economic and property information without having a legal basis to do so. In response, the controller claimed that the data processing was based on the public interest and on the exercise of its administrative, fiscal and accounting powers. However, it did not check whether the spouses were indeed married in community of property, initiating a seizure procedure against the data subject based on a legal presumption.

Holding

The DPA stressed that, according to the GDPR, information relating to debts is considered personal data as it concerns an identified or identifiable person. In the specific case, the notification sent to the data subject contained not only their full name and ID number, but also those of their spouse. The DPA noted that the processing of the personal data referred to by the data subject was twofold. The first consisted in disclosing the debtor's personal data to a third party, in this case, their spouse. The second consisted in obtaining personal data from the National Social Security Institute. The DPA observed that the controller based these processings on a erroneous "presumption of joint ownership" instead of checking the actual marital status of the data subject, which was easily available to it in the Civil Register. According to the DPA, before engaging in such activities, the controller must make sure that the processing is in compliance with data protection regulations. Therefore, the controller should have carried out the relevant consultations in order to prevent unlawful processing of personal data. The non-observance of basic data verification measures, which the controller had at its disposal, represented an obvious risk to the data subjects. Based on the above, the DPA issued a reprimand for breach of Article 6 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

Resolution RPS-2023/001


                                                             [Proc. PS-2022/003 - File. RCO-2020/045]




                     RESOLUTION OF SANCTIONING PROCEDURE



Subject: Resolution of disciplinary procedure against the City Council of Jerez de la

Frontera for an alleged infringement of the personal data protection regulations.




                                         BACKGROUND




First. On July 3, 2020, a claim was filed with the Council for Transparency and

Protection of Data of Andalusia (hereinafter, the Council) against the City Council of Jerez de

la Frontera (hereinafter, the organ claimed), for an alleged infringement of the regulations of

personal data protection.


The said complaint stated, among other issues, the following:


      "I attach notifications received today, regarding the embargo on the pension

      that I receive from the I.N.S.S. (one notice is in the name of [own name cited], my

      wife, and another notification in my name, each one by name and in separate envelopes and

      closed) I have my wife's authorization to provide a copy of her notification.


      Attached deed of separation of property, formalized before getting married, and

      registered in the civil registry, as can be verified in the last page of the aforementioned

      writing, as proof of my claim against the Hon. City Hall of Jerez de la

      Border.


      I denounce that the aforementioned consistory has notified me a debt and information about my

      wife, without her consent, as you can see in the attached notice,

      which I am the addressee.

      I denounce that the aforementioned consistory has requested personal data of the


      subscribes, financial information on assets, according to the content of the notification that


Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 1 of 19 Document suitable for publication in the Portal del Co www.ctpdandalucia.es I have received, I am not part of that administrative procedure, I do not owe anything

      of IBI, I am not the owner, the house was bought by my wife in the year [yyyy], we

      we got married [later] on [yyyy], [other personal descriptive data] on

      Property separation regime, which I demonstrate by attaching the deeds.

      Having said this, some official of the aforementioned consistory, making use of the power to access


      the personal data of citizens, has made inquiries that did not

      proceed, has requested information in the property registry for which he comments

      in the notification, and has requested information from the INSS, having received

      information in this regard, when they try to seize the pension that I receive, the INSS

      has provided information, which it should not, and the official of the consistory, has

      requested my information from who knows how many administrations, without it being appropriate, since

      I can never be a part of that proceeding, since I don't own the home, and

      just as they have found out that we are married, they must also know that we are

      married under the separation of property regime, and said deeds are registered in the

      civil registry, so the consistory has the means to obtain, first of all,

      this information, not only that we are married, but in the regime that we have

      contracted marriage, before beginning to request information about me,

      SKIPPING ALL MY RIGHTS REGARDING DATA PROTECTION, reason

      so I go to this data protection agency, and request the opening of

      disciplinary file, so that these violations in terms of protection of

      data is not repeated in the future, neither with me, nor with any other citizen. [...]”.


Attached to the claim:


  - Copy of the prenuptial agreement deed, dated [dd/mm/yy], registered in the

    Civil Registry dated [dd/mm/yy].


  - Copy of the notification of the remuneration garnishment proceeding sent to the

    claimant by the City Council of Jerez de la Frontera for a debt of his wife.

  - Copy of the notice of wage garnishment sent to the wife


    of the claimant by the City Council of Jerez de la Frontera for a debt in his name.


Second. On July 20, 2020, another claim with the same

object presented by the claimant in the Spanish Agency for Data Protection, on 3



Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 2 of 19 Document suitable for publication on the C Portal www.ctpdandalucia.es July 2020, giving this transfer to this Council, as it is the competent control authority

in its processing.


The same documentation was attached to the claim as that provided by the claimant to the


Advice.


Third. On July 28, 2020, by virtue of the provisions of article 57 of the Law

39/2015, of October 1, of the Common Administrative Procedure of the Administrations


Public (hereinafter, LPACAP) the director of the Council agreed to the accumulation and processing

joint of both procedures by keeping these a substantial identity.


Room. By virtue of articles 37 and 65 of Organic Law 3/2018, of December 5, of


Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), the

On July 30, 2020, the claim was transferred to the Data Protection Delegate of the

Jerez de la Frontera City Council (hereinafter, DPD) or, where appropriate, the person in charge of the

treatment so that, within a maximum period of one month, he communicated the response given to the

claim and, where appropriate, the actions taken in relation to it.



Fifth. On August 6, 2020, a writ of extension of

the claim presented by the claimant where the following was stated:


      “I request that this extension of the claim be upheld.

      As irrefutable proof of the irregularities committed by the Hon. City hall

      of Jerez de la Frontera, attached notification received, in which it notifies the cancellation of

      embargo on the INSS pension that I receive.


      It is proven that they have provided me with information about my wife that they never owed me

      inform, violating the duty of confidentiality included in both the GDPR and the

      LOPDGDD, in addition, to consult my data in other administrations, because otherwise

      In this way, said body would not be aware that I am receiving a pension from the INSS”.

      […]”.


The claimant attached the notice of cancellation of the wage garnishment

sent by the requested body.



Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 3 of 19 Document suitable for publication on the www.ctpdandalucia.es Portal On September 8, 2020, the Council transferred to the DPD this new documentation sent by

the claimant.



Sixth. On October 7, 2020, the claimant directed a new extension of his

claim to this Council where he reported, among other issues, the following:


   “Attached, response received today, from the DPD of the consistory of my town.

   1º They answer once my claim has been received before you, for which reason my complaint was not addressed.


   right of access in due time and form, if applicable, I request the opening of the file

   sanctioning system, with the sole purpose that it serve so that, in the future, they attend to

   correctly to citizens who exercise their right of access.

   2º Without taking any steps, and as stated in their writing, they presumed that we were

   married in community property, for which they misused the machinery of the

   public administration, I still do not know, because they do not say anything about it, what information


   they requested the INSS about me, but they communicated to third parties, a debt that I did not care about at all

   affects, nor am I responsible for it. If this bad abuse, of the machinery of the

   administration, which allows obtaining information from citizens, and the power granted to them

   of being able to carry out embargoes on pensions or bank accounts, will remain without being penalized

   by this "Andalusian Data Protection Transparency Council" it will not be avoided that,

   in the future continue to violate the rights of citizens...

   Please consider that this extension of claim has been submitted, the file of which corresponds to


   to reference RCO-2020/045, keep in mind that not only was my right to

   access, until I have knowledge of my claim before you, and that in a

   deliberately, they notify me of a debt of my wife, and they inform the INSS that I am a debtor of

   a debt, which is not true or truthful, for these reasons, I reiterate before you, in my

   request that they open disciplinary proceedings against said consistory; For information purposes,

   I inform you that in view of what happened on the part of the consistory, they proceeded to request help from a

   family, to satisfy the debt claimed by the consistory, to avoid, that they continue

   disclosing my wife's file to third parties."


It attached a report sent by the DPD to the claimant dated October 7, 2020 where

stated, among other things:




Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 4 of 19 Document suitable for publication in the Portal del Co www.ctpdandalucia.es "[...] Once the file for the embargo of

      remuneration of the person who brings this claim, it is verified that it was the

      [claimant's wife] who communicated his identity as her husband in writing

      presented by the Jerez City Council on 01/14/2020. An extract of the letter is attached.

      […]


      In this regard, once the existence of this marriage was known, by the Collection

      Municipal, the presumption of profit of the assets existing in the

      marriage that includes the Civil Code in its article 1,361, and therefore the character of

      joint debtor of the debtor's husband.


      Pursuant to article 94 of Law 58/2003, General Taxation, the Collector

      Municipal proceeded to request the INSS data on the pensions they could receive

      the members of the marriage, action for which the authorization of

      the debtors. It is not necessary either, applying the presumption of profit,

      the authorization of the debtor to notify the husband of the seizure of property

      remunerations.


      If you were not given access to the requested file, it was because you were transferred to the

      Collection of the City Council of Jerez de la Frontera of 5 documents presented by the

      You dated 07/03/2020: 2 to the Jerez City Council and the other 3 to the I.N.S.S., to the

      A.E.A.T. and to the Diputación de Cádiz, who in turn transferred them to the City Council of

      Sherry.


      Given such repetition of writings, the embargo was canceled without further delay.

      failing to provide a response to your request for access.”


Seventh. Once the claim began its processing in accordance with the procedure


established in Title VIII of the LOPDGDD, and by virtue of article 67.1 thereof, dated

October 20, 2020, the director of the Council ordered the start of preliminary proceedings of

investigation for the purpose of achieving a better determination of the facts and circumstances

that justify the processing of a possible disciplinary procedure.



Eighth. After carrying out the report of conclusions corresponding to the previous actions

of investigation, on April 27, 2022, the director of the Council issued the Agreement to Start the



Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 5 of 19 Document suitable for publication in the Portal del Co www.ctpdandalucia.es disciplinary proceedings against the City Council of Jerez de la Frontera, with NIF P1102000E,

for the alleged infringement of article 6 GDPR, classified in article 83.5.a) GDPR, and punishable


with warning in accordance with article 77.2 LOPDGDD.


Nineth. Notified the initiation agreement to the requested body, this, on May 13, 2022,


submitted a pleadings brief in which, in summary, it stated the following:

      “[...] First, that the processing activity that encompasses the claim that

      gives rise to this proceeding is included in 'collection' as stated in

      the response to the requirement with reference [reference is cited] made before this

      Council on October 7, 2020. In the same way, the review and

      publication of the Registry of Treatment Activities (RAT) on the website of the

      City Hall of Jerez de la Frontera.


      Second, that the community property regime was effectively presumed in

      where the claimant and his wife were, and that once the

      regulatory considerations, this Council has established a protocol of

      verification of the data before the workers in charge of the collection area of the

      City hall".



Tenth. On July 3, 2020, another claim was filed against the Jerez City Council for

similar facts that were included in the claim mentioned in the previous Background. With

dated December 13, 2022, the Director of the Council for Transparency and Data Protection of

Andalusia, agreed to the accumulation to the present disciplinary procedure, of both

claims to keep substantial identity with respect to the claimed facts; it, of

in accordance with the provisions of article 31 of Law 40/2015, of October 1, on the Regime

Law of the Public Sector and in article 57 of the Law of Law 39/2015, of October 1, of the

Common Administrative Procedure of Public Administrations, and with the purpose of


maintain a single procedure that determines the possible sanction on the facts, which have already

had been considered in the corresponding Initiation Agreement of this procedure

sanction issued against the requested body.



Eleventh. Once the instruction of the procedure was completed, the corresponding



Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 6 of 19 Document apt to be published on the Co Portal www.ctpdandalucia.es resolution proposal, which was notified to the alleged offender on December 15, 2022

establishing a term of ten working days for the formulation of allegations, in accordance

with article 89.2 LPACAP and in relation to article 73.1 thereof.


On December 21, 2022, the allegations of the body entered into this Council

initiated the proposal for a resolution formulated by the instructor of the file, in which the

indicates:


      “First.- That, being the claimant herself the one who provided the corporation with the data of

      her husband by writing dated 01/14/2020, the City Council, has not obtained the

      data of [XXXXX] in a way contrary to the data protection regulations,


      likewise, in the same letter mentioned, it is recorded that the husband of the

      debtor was aware of the debt that is the subject of the claim.

      Second.- That, in this regard, once the existence of this marriage was known, for

      the Municipal Collection, the presumption of profit of the assets was applied

      existing in the marriage that includes the Civil Code in its article 1,361, and therefore

      the character of joint debtor of the husband of the debtor. Not being until a moment

      later, when it is proven that the economic regime of the debtor is the


      separation of assets, the City Council applies the presumption of profit of the

      assets existing in the marriage, therefore, firstly, the City Council

      acts in accordance with what is established in the Civil Code.

      Third.- That, finally, it should be noted that the City Council, once it receives the

      claim by the debtor's husband, and check the deeds of

      prenuptial capitulations of the claimant, acts diligently making the


      cancellation of the embargo as soon as the regime is detected and verified

      matrimonial economy”.



                                      PROVEN FACTS




From the documents in the file and the actions carried out, they can

considered as proven facts that:





Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 7 of 19 Document suitable for publication on the C Portal www.ctpdandalucia.es Primero. According to the inventory of processing activities published by the body
           1
claimed, in application of article 31.2 LOPDGDD and article 6 bis of Law 19/2013, of 9

December, on transparency, access to public information and good governance, the person in charge of

treatment "Collection" is the City Council of Jerez de la Frontera.


The purpose of said treatment is "purposes of public interest based on current legislation,

accounting, fiscal and administrative management”.



Second. On July 3, 2020, the claimant received from the respondent body a notification of

Proceedings of seizure of the pension that he received from the National Institute of Social Security


for a debt incurred by his wife.


Third. In the first clause of the deed of prenuptial capitulations of the claimant,


dated [dd/mm/yy] and registered in the Civil Registry, on [dd/mm/yy], is established as a regime

economic of marriage, the system of absolute separation of property.



Room. The Jerez de la Frontera City Council did not verify whether the spouses were married

in the community property regime or in the separation of property regime and in application of a

"presumption of profit" proceeded to initiate an attachment process against the claimant

as a consequence of a debt contracted by his wife, communicating the data of the

debtor to the now complainant.



Fifth. The City Council of Jerez de la Frontera requested economic and patrimonial data from the

claimant to the National Institute of Social Security after wrongly considering it as


part of a debt collection procedure contracted by a third party and as

alleged joint debtor with respect to his wife's debt.




                                FUNDAMENTALS OF LAW



First. The competence to resolve the disciplinary procedure for possible


1 https://www.jerez.es/fileadmin/Documentos/lopd/

  CITY COUNCIL_OF_JEREZ_DE_LA_FRONTERA_REGISTRO_DE_ACTIVIDADES_COMO_RT__PUBLICO_.pdf


Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 8 of 19 Document suitable for publication on the Portal of www.ctpdandalucia.es Breach of personal data protection regulations, in relation to the facts

described, corresponds to the director of the Board by virtue of the provisions of articles 43.1 and

48.1.i) of Law 1/2014, of June 24, on Public Transparency of Andalusia (hereinafter,

LTPA), in articles 10.3.b) and 10.3.i) of the Statutes of the Council of Transparency and


Data Protection of Andalusia (approved by Decree 434/2015, of September 29) and in

articles 57 and 64.2 LOPDGDD.


The Council, as the regional authority for the protection of personal data, and within its

jurisdiction, exercises the functions and powers established in articles 57 and 58

GDPR.



Second. Article 1.1 of the GDPR states that "[t]he present Regulation establishes the rules relating to

the protection of individuals with regard to the processing of personal data and

the rules relating to the free circulation of such data”. According to article 4.1 GDPR it is understood

by “personal data”, “[a]ll information about an identified or identifiable natural person (“the

interested"); An identifiable natural person shall be considered any person whose identity can be

be determined, directly or indirectly, in particular by means of an identifier, such as

a name, an identification number, location data, an online identifier, or one or

various elements of physical, physiological, genetic, psychological, economic, cultural or

of said person”.


For its part, article 2.1 of the GDPR provides with respect to its scope of application that “[t]he

This Regulation applies to fully or partially automated data processing

personal data, as well as the non-automated processing of personal data contained or intended

to be included in a file”, defining the concept of “treatment” in article 4.2 GDPR

as "any operation or set of operations carried out on personal data or


sets of personal data, whether by automated procedures or not, such as the collection,

recording, organization, structuring, conservation, adaptation or modification, extraction,

consultation, use, communication by transmission, diffusion or any other form of authorization

of access, collation or interconnection, limitation, deletion or destruction”.


In accordance with the previous definitions, and in relation to the case at hand, the data of

a person referring to the name and surnames, DNI, economic and patrimonial data and debt


Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 9 of 19 Document suitable for publication on the C Portal www.ctpdandalucia.es contracted by a third party, must be considered personal data subject to the provisions of

the GDPR, since it deals with information about an identified or identifiable natural person

(The names, surnames and ID of the claimant and his wife appear, which

allows clear identification) to those undergoing treatment. Consequently, both the

personal data processed as the treatment that is carried out of the same must be submitted to

the provisions of the regulations on protection of personal data.


The treatments that are observed in relation to the personal data to which it makes

reference to the claimant are two: the first, the one made by the organ claimed, from

information for which it is responsible as a collection body, a consequence of the management


of debt collection to the City Council itself, communicating the data of the debtor to the

claimant as part of a procedure in which he is not considered an interested party;

and the second, the request by the City Council for economic data on the

claimant to another administration (the INSS) after wrongly considering it as part of the

aforementioned collection procedure.



Third. Article 6.1 GDPR establishes the conditions that give rise to the legality of a

processing of personal data:


      Processing will only be lawful if at least one of the following conditions is met:


      a) the interested party gave his consent for the processing of his personal data for one

      or various specific purposes;

      b) the treatment is necessary for the execution of a contract in which the interested party is

      party or for the application at his request of pre-contractual measures;


      c) the processing is necessary for compliance with a legal obligation applicable to the

      responsible for the treatment;


      d) the processing is necessary to protect the vital interests of the data subject or of another

      Physical person;

      e) the treatment is necessary for the fulfillment of a mission carried out in the interest

      public or in the exercise of public powers conferred on the data controller;






Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 10 of 19 Document suitable for publication in the Portal del Cowww.ctpdandalucia.es f) the processing is necessary to satisfy the legitimate interests pursued by the

       responsible for the treatment or by a third party, provided that such interests are not

       the interests or fundamental rights and freedoms of the data subject prevail

       require the protection of personal data, in particular when the data subject is a child.

       The provisions of letter f) of the first paragraph shall not apply to the treatment carried out


       by public authorities in the exercise of their functions.

As far as this motion for a resolution is concerned, mention must be made of the provisions of

Article 141 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector (in


hereinafter, LRJSP) regarding the "Duty of collaboration between Public Administrations", which

provides the following:


       1. Public Administrations must:

       a) Respect the legitimate exercise by the other Administrations of their powers.


       b) Consider, in the exercise of its own powers, all public interests

       involved and, specifically, those whose management is entrusted to the other

       Administrations.


       c) Provide other Administrations with the information they need about the activity that

       develop in the exercise of their own powers or that is necessary for the

       citizens can fully access information on a matter.

       d) Provide, within its own scope, the assistance that the other Administrations could


       request for the effective exercise of its powers.

       e) Comply with the specific obligations derived from the duty of collaboration and the rest

       that are established by law.


       2. The required assistance and collaboration may only be refused when the public body or

       the entity from which it is requested is not empowered to provide it in accordance with the provisions of

       its specific regulations, does not have sufficient means to do so or when, to do so,

       cause serious damage to the interests entrusted to the guardianship or to the fulfillment

       of their own functions or when the information requested is confidential or

       reserved. The refusal to provide assistance will be communicated with reasons to the

       Applicant administration.




Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 11 of 19 Document suitable for publication on the Council Portal www.ctpdandalucia.es 3. The General Administration of the State, those of the Autonomous Communities and those of the

       Local Entities must collaborate and assist each other in the execution of their acts that have

       to be carried out or have effects outside their respective territorial areas. The possible

       costs that the duty of collaboration may generate may be passed on when so

       agree”.


Room. Article 94 "Authorities subject to the duty to inform and collaborate" of Law 58/2003,


of December 17, General Tax, establishes that:


       "1. The authorities, whatever their nature, the heads of State bodies,

       of the autonomous communities and local entities; [...] and those who, in general, exercise

       public functions, they will be obliged to provide the Tax Administration with as many

       data, reports and records with tax significance is collected by

       provisions of a general nature or through specific requirements, and to provide, to it

       and to its agents, support, assistance, assistance and protection for the exercise of their functions. [...]


       4. [...] The bodies of the Tax Administration may use the information

       provided for the regularization of the tax situation of the obligors in the course of the

       verification or inspection procedure, without it being necessary to carry out the

       requirement referred to in section 3 of the previous article.

       5. The transfer of personal data that must be made to the Administration

       in accordance with the provisions of the previous article, in the previous sections of this

       article or in another norm of legal rank, will not require the consent of the affected party. In this


       scope, the provisions of section 1 of article 21 of the Organic Law shall not apply

       15/1999, of December 13, Protection of Personal Data."

On the other hand, article 170 "Diligence of embargo and preventive annotation" of the aforementioned

Law 58/2003 dictates that:


       "1. Each action of embargo will be documented in diligence, which will be notified to the person


       with which said action is understood.

       Once the assets or rights have been seized, the procedure will be notified to the obligor

       tax and, where appropriate, to the third party owner, possessor or depositary of the assets if it is not

       carried out the actions with them, as well as the spouse of the obligor




Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 12 of 19 Document apt to be published on the Portal del Consej www.ctpdandalucia.es tax when the seized assets are community property and co-owners or co-owners

      thereof".

Article 1361 of the Civil Code establishes that:


      "The assets existing in the marriage are presumed to be joint property until it is proven that

      belong exclusively to one of the two spouses".



Fifth. Article 4 "Registrable Facts" of Law 20/2011, of July 21, on the Civil Registry,

indicates that:


      "They have access to the Civil Registry the facts and acts that refer to the identity, marital status and

      other circumstances of the person. They are, therefore, registrable:


      1st The birth.

      [...]


      7th Marriage. Separation, annulment and divorce.


      8. The legal or agreed matrimonial property regime.

      [...]."


On the other hand, article 8.2 of the aforementioned Law 20/2011, establishes that:


      "All Administrations and public officials, in the exercise of their powers and

      under their responsibility, they will have access to the data contained in the single Civil Registry

      with the exceptions relating to specially protected data provided for in this Law.

      Said access will also be carried out through electronic procedures with the

      requirements and technical prescriptions that are established within the National Scheme of

      Interoperability and the National Security Scheme".



Sixth. In the Agreement to initiate the disciplinary procedure, this Council indicated that, with the

information in the file, it had not been possible to determine specifically the

treatment activity in which the Jerez de la Frontera City Council had framed the

management of embargoes or the request for information as a collection agency to other


administrations. Nor had it been possible to obtain said information by consulting the

inventory of treatment activities through the website of the aforementioned City Council,



Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 13 of 19 Document suitable for publication on the Council Portal www.ctpdandalucia.es since it was not available there, despite the fact that it should be subject to

publication in application of article 31.2 LOPDGDD and, also as part of the Advertising

Assets of the entity, by virtue of article 6 bis of Law 19/2013, of December 9, on

transparency, access to public information and good governance. In this regard, the body


claimed, in his brief of allegations of May 13, 2022, has informed this Council

that the processing activity that encompasses the claim that gives rise to this

procedure is included in 'Collection', as well as that it has proceeded to review and

publication of the Registry of Treatment Activities of the City Council of Jerez de la

Border on the website of the aforementioned Town Hall. This point has been confirmed by this

Advice.


Likewise, in the aforementioned pleadings brief, the requested body confirms to this body

that effectively presumed the community property regime in which the

claimant and his wife, and that, therefore, a verification protocol has been established for the

data to the workers in charge of the collection area of the City Council.


Therefore, in accordance with all of the foregoing, the allegations presented in relation to the

Initiation Agreement do not distort the essential content of the infringement that is declared committed

nor do they imply sufficient justification or exculpation.


Seventh. Notified the resolution proposal to the requested body and as indicated in the

background, he presented a brief of allegations, in which -essentially- he returned to

reproduce allegations made throughout the procedure; in any case, said

Allegations were analyzed and it is considered that they do not distort the essential content of the


an infraction that is declared committed, nor do they imply sufficient justification or exculpation,

regardless, furthermore, of whether the cancellation of the

embargo.


Eighth. From the documentation in the file, and as already stated in the


section Proven Facts, it has been proven that on July 3, 2020, the claimant

received from the City Council of Jerez de la Frontera a notice of seizure of

his pension received from the National Institute of Social Security for a debt contracted by

his wife. Likewise, it has been accredited that in the deed of capitulations


Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 14 of 19 Document suitable for publication on the Portal of www.ctpdandalucia.esprenupciales, dated [dd/mm/yy], in the first clause they establish "the separation system

property as economic regime of their marriage", deed registered in the

Civil Registry on [dd/mm/yy].


The organ claimed, therefore, in application of a "presumption of profit" proceeded

therefore to communicate personal data of a third person to the claimant and to initiate against

This is an embargo process as a consequence of the existence of a debt of which it was


that third person responsible, after accessing their data in the INSS. All this, when I had

accessible, through the existing information in the Civil Registry, the marital situation of the

claimant and the regime of said marriage.


Therefore, this Council understands that the requested body, before proceeding to communicate a

debt contracted by another person to the claimant, a third party unrelated to the procedure of

debt collection, and based on the requirements of the principle of active responsibility in

regarding compliance with data protection regulations, he had to carry out the

procedures or pertinent consultations in order to find out if the spouses were married in

community property regime or property separation regime; all this prior to

the application of the "presumption of profit" invoked, which would have avoided the incorrect

communication of personal data (without there being a cause of legitimacy for it) and the

commencement of the procedure for seizure of the claimant's pension, husband - under

separation of assets- of the person holding the debt. The non-observance of some measures


basic methods of data verification, which the City Council also has at its disposal, supposes

an obvious risk in relation to the processing of personal data in cases such as the one

concerns us and would facilitate the inappropriate communication of said data.


Regarding the second processing denounced by the claimant, the request for data

assets of the same to the INSS, if the organ claimed, in accordance with the

provided in article 141 LRJSP already referenced, would have consulted, for example, the Registry

Civil in order to find out if the spouses were married in community property or in

property separation regime, it would not have been necessary to request information on data

of the claimant to the National Institute of Social Security, within a






Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 15 of 19 Document suitable for publication on the Portal www.ctpdandalucia.es debt collection procedure or, consequently, communicate a debt contracted

for his wife.


Consequently, in relation to the facts that are the subject of the claim, the conduct of the body


claimed, as responsible for the treatment, when consulting the National Institute of

Social Security personal data of the claimant and communicate personal data of the wife

of the claimant related to a private debt of the latter, failed to comply, due to the circumstances

previously exposed, the aforementioned article 6 GDPR, given the absence of legitimacy both for

Consultation of the claimant's data at the National Institute of Social Security (since it is not

joint and several debtor for having married under a separate property regime) as well as for the

Communication of the personal data of said person to the claimant.


Regardless of the above, it is also appropriate to value the measures that with

subsequently the City Council has taken, with a view to better compliance with the regulations.



Nineth. Failure to comply with "the basic principles for treatment, including the

conditions for consent under articles 5, 6, 7 and 9" of the GDPR contemplates

as an infringement of the personal data protection regulations in article 83.5.a) GDPR;

the aforementioned conduct is also contemplated, for prescription purposes, as


very serious infraction in article 72.1 b) LOPDGDD:

      "b) The processing of personal data without the fulfillment of any of the legal conditions

      of the treatment established in article 6 of Regulation (EU) 2016/679”.


In the present case, the infringing circumstances provided for in article 83.5.a) concur.

GDPR transcribed.



Tenth. Article 58.2 GDPR provides that:


      "Each control authority will have all the following corrective powers indicated

      next:


      [...]

      b) send a warning to any person in charge or person in charge of the treatment when the

      processing operations have infringed the provisions of this Regulation;



Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 16 of 19 Document apt to be published on the Portal of www.ctpdandalucia.es [...]


      d) order the controller or processor that the processing operations

      comply with the provisions of this Regulation, where applicable, of a

      certain manner and within a specified period of time;


      […]”.

On the other hand, article 77 LOPDGDD establishes the sanctioning regime applicable to

certain categories of controllers or processors; in particular, in his

Section 1.c) includes "[t]he General State Administration, the Administrations of the

autonomous communities and the entities that make up the Local Administration". In the aforementioned


Article, in its section 2, states that:

      "When those responsible or managers listed in section 1 commit any of


      the infractions referred to in articles 72 to 74 of this organic law, the authority

      of data protection that is competent will issue a resolution sanctioning them

      with warning. The resolution will also establish the measures to be adopted

      so that the conduct ceases or the effects of the infraction that has been committed are corrected".

Thus, in accordance with article 77.2 LOPDGDD, the sanction that should be imposed on the person responsible

of the treatment is the warning, without being able to adopt additional measures due to the fact that

the City Council has already proceeded to its adoption.



Eleventh. In relation to the notification of the resolution of the disciplinary procedure, the

Article 77.2 LOPDGDD provides that "[t]he resolution shall be notified to the person in charge or in charge of the

treatment, to the body on which it depends hierarchically, where appropriate, and to those affected who have


the condition of interested party, if applicable".

In addition, article 77.4 LOPDGDD states that "[s]e must be notified to the authority of


data protection the resolutions that fall in relation to the measures and actions to which

refer to the previous sections", and 77.5 LOPDGDD, which "[w]ill be communicated to the Ombudsman

People or, where appropriate, to similar institutions of the autonomous communities the actions

carried out and the resolutions issued under the protection of this article".






Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 17 of 19 Document suitable for publication on the Con Portal www.ctpdandalucia.es By virtue of all of the above and in accordance with applicable legislation, the Director of the Council

of Transparency and Data Protection of Andalusia




                                          RESOLVES




First. Direct a WARNING to the City Council of Jerez de la Frontera, with NIF

P1102000E, for violation of article 6 GDPR, classified in article 83.5.a) GDPR.


Second. That this resolution be notified to the infringing body.



Third. That this resolution be communicated to the Andalusian Ombudsman, of

in accordance with the provisions of article 77.5 LOPDGDD.



In accordance with the provisions of article 50 LOPDGDD, this resolution will be made

public, dissociating the corresponding data, once it has been notified to the

interested.



Against this Resolution, which puts an end to the administrative process, it is possible to file an appeal

optional replacement before this Council, within a month, or file directly

contentious-administrative appeal before the Contentious-administrative Jurisdiction within the term

of two months, in both cases counting from the day following the notification, of

in accordance with the provisions of articles 30.4, 123 and 124 of Law 39/2015, of 1 December

October, of the Common Administrative Procedure of Public Administrations and in the


Articles 8.3, 14.1 and 46.1 of Law 29/1998, of July 13, regulating the Jurisdiction

Contentious-Administrative.


In accordance with the provisions of article 90.3. a) LPACAP, may be provisionally suspended

firm administrative resolution if the interested party manifests before this Council his/her


intention to file a contentious-administrative appeal and transfers to it, once

filed, the documentation that accredits its presentation. If the Council did not have

knowledge of the filing of the contentious-administrative appeal within the term



Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)

Page 18 of 19 Document apt to be published on the portal www.ctpdandalucia.escorrespondiente or in said appeal the precautionary suspension of the resolution will not be requested,


would terminate the said suspension.



                          THE DIRECTOR OF THE TRANSPARENCY COUNCIL AND

                               DATA PROTECTION OF ANDALUSIA


                                         Jesus Jimenez Lopez



























































Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 19 of 19 Document suitable for publication in the Portal del Cowww.ctpdandalucia.es