AEPD (Spain) - TD/00183/2021

AEPD (Spain) - R/00634/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 15 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	01.09.2021
Published:	06.09.2021
Fine:	None
Parties:	EMPRESA MUNICIPAL TRANSPORTES URBANOS, S.A. DE GIJÓN
National Case Number/Name:	R/00634/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Carmen Villarroel

The Spanish DPA concluded that it is not justifiable to deny access to a video recording when third parties are shown, since new technologies allow to anonymise images in a way that no harm to third parties is done.

English Summary

Facts

A data subject filed an access request with a council transport company regarding the results of a selection process for a job, with which outcome the data subject did not agree. Therefore, they wanted to access the videos of one of the driving tests.

Since the controller did not answer, the data subject filed a complaint with the Spanish DPA (AEPD).

The controller alleged that they would not give away the videos since the cameras were set so they only recorded the outside of the vehicles, and as they additionally may had recorded third persons such as passerbys.

The data subject answered that if case law has concluded that written answers to an exam are personal data, therefore a driving test shall have the same nature. The data subject also argued that nowadays it is possible to blur or pixel images so no personal data from third parties is shared.

Holding

Firstly, the AEPD brought forward Recital 59, that recommends the controller to facilitate data subjects the access of their rights.

Secondly, the AEPD argued that given that new technologies make it possible, by means of techniques that can anonymise images in a way that no harm to third parties is done and, in addition, that there is a legitimate interest of the data subject, since they are requesting evidence of impartiality in the test that was carried out, there is no reason why the data subject should not be able to have access to the recordings that may constitute a fundamental part of the selection process to obtain a job.

Therefore, the AEPD concluded that, since the controller had not answered the access, the controller still had the obligation to provide an answer, either by means of grating access to the data or by means of a justified refusal.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                               1/6








     File No.: TD / 00183/2021


                              RESOLUTION NO: R / 00634/2021


Considering the claim made on February 16, 2021 before this Agency by A.A.A.,
(from now on the complaining party), against EMPRESA MUNICIPAL TRANSPORTES
URBANOS, S.A. DE GIJÓN, (from now on the claimed part), for not having been
duly attended to your right of access.


The procedural actions provided for in Title VIII of the Law have been carried out.
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD), the following have been verified



                                      FACTS

FIRST: The complaining party exercised the right of access against the complained party
with NIF A33696279, without your request having received the answer legally
established.

It shows that it does not agree with the results obtained in some
evidence to obtain a job, for which he requests: “… RIGHT TO
ACCESS to the recording made on October 28, 2020 (…) during the
practical test of the selection process to cover 60 driver seats ... "


The complaining party provides various documentation related to the claim made
before this Agency and on the exercise of the right exercised.

SECOND: In accordance with article 65.4 of the LOPDGDD, which has provided for a
mechanism prior to the admission for processing of claims made before
the AEPD, consisting of transferring them to the Data Protection Delegates

designated by those responsible or in charge of the treatment, for the intended purposes
in article 37 of the aforementioned norm, or to these when they have not been designated,
transferred the claim to the claimed entity to proceed with its
analysis and respond to the complaining party and to this Agency within a period of
month.


Since the response provided to this Agency by the data controller does not
accompanies the necessary communication that must be addressed to the complaining party,
informing about the decision adopted on the occasion of the claim, it is reiterated
again said request so that the affected party can respond to the claim
formulated and a copy of said response is sent to this Agency.



THIRD: The result of the transfer procedure indicated in the previous Fact does not
allowed to understand satisfied the claims of the complaining party. On
Consequently, dated June 17, 2021, for the purposes provided in its article

64.2 of the LOPDGDD, the Director of the Spanish Agency for Data Protection
agreed to admit the submitted claim for processing and the parties were informed that the


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/6








maximum period to resolve this procedure, which is understood to have started
by means of said agreement of admission to processing, it will be of six months.


The aforementioned agreement granted the claimed entity a hearing procedure, to
that within a period of fifteen business days it present the allegations it deems
convenient. Said entity made, in summary, the following allegations:

As stated by the defendant, already in his day he attended the request of the claimant
after the results of the selective tests were published and, the claimed

did not agree with the result.
They add that they explained to him that they could not facilitate the recordings because what was
The engraving was the exterior of the vehicle and not its image. They insist on this point, the image
of the claimant is not recorded at any time.
Namely: “… the recordings of the

claimant, being used exclusively as a work tool for
determine the final score of the driving test. (…) Practical tests
driving are recorded by three cameras (…) arranged in such a way that
they only collect details of the exterior of the vehicle while making the tour (...)
yes, images of third parties are inevitably collected (pedestrians and vehicles on the road)
… ”


FOURTH: After examining the allegations presented by the defendant, they are the subject of
transfer to the complaining party, so that, within fifteen business days, it can formulate
allegations that it deems appropriate.


The claimant reiterates his request for access to the recordings and justifies it, among others
as follows: “… if the jurisprudence has indicated that the written examinations
professionals are considered personal data, a driving test to aspire
a job has to carry the same nature ... "
According to the claimant, the refusal to deliver the

recordings because third-party data appears in them. Add that the techniques
current trends such as the pixelation of the images make it easier to
recordings without exposing third party data.


                           FOUNDATIONS OF LAW


FIRST: The Director of the Spanish Agency for
Data Protection, in accordance with the provisions of section 2 of article 56 in
in relation to paragraph 1 f) of article 57, both of Regulation (EU) 2016/679 of the
European Parliament and of the Council of April 27, 2016 on the protection of

natural persons with regard to the processing of personal data and the free
circulation of these data (hereinafter, GDPR); and in article 47 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD).


SECOND: In accordance with the provisions of article 55 of the RGPD, the Agency
Spanish Data Protection is competent to perform the functions that
are assigned to it in its article 57, among them, that of enforcing the Regulation and
promote the awareness of those responsible and those in charge of the treatment

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/6








about their obligations, as well as dealing with claims
submitted by an interested party and investigate the reason for them.


Correlatively, article 31 of the RGPD establishes the obligation of those responsible
and those in charge of the treatment to cooperate with the control authority that requests it in
the performance of their duties. In the event that they have designated a
data protection officer, article 39 of the RGPD attributes to him the function of
cooperate with said authority.


Similarly, the domestic legal system, in article 65.4 of the LOPDGDD, has
Provided a mechanism prior to the admission for processing of the claims that are
made before the Spanish Agency for Data Protection, which consists of giving
transfer of the same to the data protection delegates designated by the
responsible or in charge of the treatment, for the purposes provided in article 37 of

the aforementioned norm, or to them when they have not designated them, to proceed to the
analysis of said claims and to respond to them within a month.

In accordance with these regulations, prior to the admission for processing of the
claim that gives rise to the present procedure, it was transferred to the
responsible entity to proceed with its analysis, provide a response to this Agency

within a month and certify having provided the claimant with the proper response,
in the event of exercise of the rights regulated in articles 15 to 22 of the
GDPR.

The result of said transfer did not allow for the satisfaction of the claims of the

complaining party. Consequently, on June 17, 2021, for the purposes
provided for in article 64.2 of the LOPDGDD, the Director of the Spanish Agency for
Data Protection agreed to admit the submitted claim for processing. Saying
The agreement of admission for processing determines the opening of the present
lack of attention to a request to exercise the rights established in the

Articles 15 to 22 of the RGPD, regulated in article 64.1 of the LOPDGDD, according to the
which:

"1. When the procedure refers exclusively to the lack of attention of a
request to exercise the rights established in articles 15 to 22 of the
Regulation (EU) 2016/679, will start by agreement of admission for processing, which will be

adopt in accordance with the provisions of the following article.
In this case, the term to resolve the procedure will be six months from
from the date the claimant was notified of the admission agreement to
Procedure. After this period, the interested party may consider their
claim".


The purging of administrative responsibilities in the framework of the
of a sanctioning procedure, whose exceptional nature implies that it is chosen,
whenever possible, due to the prevalence of alternative mechanisms that have
protection in current regulations.


It is the exclusive competence of this Agency to assess whether there are responsibilities
administrative procedures that must be purged in a sanctioning procedure and, in
Consequently, the decision on its opening, there being no obligation to initiate a

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/6








procedure before any request made by a third party. Such a decision must
be based on the existence of elements that justify said start of the activity
sanctioning, circumstances that do not concur in the present case, considering that

with this procedure, the guarantees and
Claimant's rights.

THIRD: The rights of people in terms of data protection
Personal data are regulated in articles 15 to 22 of the RGPD and 13 to 18 of the
LOPDGDD. The rights of access, rectification, deletion,

opposition, right to limitation of treatment and right to portability.

The formal aspects relating to the exercise of these rights are established in the
Articles 12 of the RGPD and 12 of the LOPDGDD.


It also takes into account what is expressed in Considering paragraphs 59 and following of the
GDPR.

In accordance with the provisions of these rules, the person responsible for the treatment
should arbitrate formulas and mechanisms to facilitate the interested party the exercise of their
rights, which will be free (without prejudice to the provisions of articles 12.5 and 15.3

of the RGPD), and is obliged to respond to requests made no later than a
month, unless you can show that you are unable to identify the
interested party, and to express their reasons in case they were not to attend said
application. The person responsible is responsible for the proof of compliance with the duty of
Respond to the request for the exercise of their rights made by the affected party.


The communication addressed to the interested party on the occasion of their request must
express themselves in a concise, transparent, intelligible and easily accessible way, with a
clear and simple language.


In the case of the right of access to personal data, in accordance with the
established in article 13 of the LOPDGDD, when the exercise of the right is
refers to a large amount of data, the person in charge may request the affected party to
specify the “data or processing activities to which the request refers”. The
Right will be understood to be granted if the person in charge facilitates remote access to the data,
the request being considered accepted (although the interested party may request the information

referring to the extremes provided for in article 15 of the RGPD).

The exercise of this right may be considered repetitive on more than one occasion.
during the period of six months, unless there is legitimate cause for it.


On the other hand, the request will be considered excessive when the affected party chooses a medium
other than the one offered that involves a disproportionate cost, which must be
assumed by the affected party.

FOURTH: In accordance with the provisions of article 15 of the RGPD and article 13 of the

LOPDGDD, “the interested party has the right to obtain from the person responsible for the treatment
confirmation of whether or not personal data concerning you is being processed and, as such
case, right of access to personal data ”.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/6








Like the rest of the rights of the interested party, the right of access is a
very personal right. Allows the citizen to obtain information about the treatment
what is being done of your data, the possibility of obtaining a copy of the data

personal concerns that are being processed, as well as
information, in particular, about the purposes of the treatment, the categories of data
the personal concerned, the recipients or categories of recipients to whom
the data, the foreseen term or conservation criteria, the
possibility to exercise other rights, the right to file a claim with the
control authority, the information available on the origin of the data (if these are not

have been obtained directly from the owner), the existence of automated decisions,
including profiling, and information on data transfers
personal to a third country or an international organization. The possibility of
Obtaining a copy of the personal data being processed will not affect
negatively to the rights and freedoms of others, that is, the right of access is

will be granted in a way that does not affect third party data.

In the case analyzed here, the complaining party exercised its right of access to
some recordings made during a selective process and, the defendant replied to
this Agency denying the right of the claimant to obtain said recordings
arguing that the image of the claimant does not appear and that the recorded

disclose third party data.
On the one hand, this Agency has to analyze the relevance or not of the claimant
you can get some recordings where it does not appear but contains details
from an exam you have taken. And on the other, we have to take into account that the
The complainant has replied to this Agency arguing his refusal but has not

documentary proof of having answered the claimant.

Based on the foregoing, considering that the present procedure is intended to
object that the guarantees and rights of those affected are duly
restored, and given that the new technology allows by means of techniques that

anonymize the images show recordings in a way that does not harm third parties
and, also adding a legitimate interest on the part of the claimant since, this
requesting samples of impartiality in the test carried out, for all this, no
we find reason why the claimant cannot have the recordings that
can be an essential part of your selective test to obtain a
job.


Finally, and given that the defendant did not document documentary proof of having attended the
right as it did with this Agency, it is necessary to estimate the claim that
originated the present procedure considering that the right of access was not carried out
out in the right way.



Considering the cited precepts and others of general application,
the Director of the Spanish Data Protection Agency RESOLVES:


FIRST: ESTIMATE the claim made by A.A.A. and urge COMPANY
MUNICIPAL TRANSPORTES URBANOS, S.A. DE GIJÓN with NIF A33696279, for
that, within ten business days following notification of this
resolution, send the complaining party a certification that addresses the right

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/6








of access requested or is denied for reasons indicating the reasons why

It is not appropriate to attend the request, in accordance with the provisions of the body of the
present resolution. The actions carried out as a result of this
Resolution must be communicated to this Agency within the same period. The
Failure to comply with this resolution could lead to the commission of the offense

considered in article 72.1.m) of the LOPDGDD, which will be sanctioned, in accordance
with art. 58.2 of the GDPR.

SECOND: NOTIFY this resolution to A.A.A. and a MUNICIPAL COMPANY

TRANSPORTES URBANOS, S.A. OF GIJÓN.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to

counting from the day after the notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the

Contentious-administrative jurisdiction, within two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.


                                                                                 1037-180321
Mar Spain Martí

Director of the Spanish Agency for Data Protection


























C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es