CTPDA (Spain) - RPS-2023/007: Difference between revisions
From GDPRhub
mNo edit summary |
m (fixed broken reference) |
||
| Line 3: | Line 3: | ||
|Jurisdiction=Spain | |Jurisdiction=Spain | ||
|DPA-BG-Color= | |DPA-BG-Color= | ||
|DPAlogo= | |DPAlogo=Logo-ctpda.png | ||
|DPA_Abbrevation=CTPDA | |DPA_Abbrevation=CTPDA | ||
|DPA_With_Country=CTPDA ( | |DPA_With_Country=CTPDA (Andalusia) | ||
|Case_Number_Name=RPS-2023/007 | |Case_Number_Name=RPS-2023/007 | ||
Latest revision as of 12:54, 8 July 2024
| CTPDA - RPS-2023/007 | |
|---|---|
 | |
| Authority: | CTPDA (Andalusia) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 6(1)(c) GDPR Article 6(1)(f) GDPR Article 13 GDPR Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 03.12.2020 |
| Decided: | 18.05.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | RPS-2023/007 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Spanish |
| Original Source: | CTPD (in ES) |
| Initial Contributor: | lm |
The Andalusian DPA found that an education department lacked a legal basis for recording audio of its meetings. It considered that a national law’s requirement that minutes be documented and that they “may be recorded” did not constitute a legal obligation under Article 6 GDPR.
English Summary
Facts
On 23 December 2020, a data subject filed a complaint with the Andalusian DPA (CTPD) against a Department of Education and Educational Development (the controller). The data subject claimed that since the 2020/2021 school year, all meetings of the educational department were audio recorded.
The controller relied on Article 18 of Law 40/2015, which calls for minutes to be drawn up for each meeting of the education department, as a legal basis for the audio recordings. It stated that the processing of data was aimed at this law’s instructions, with the purpose of convening the sessions and consulting the matters in the agenda. The controller also claimed that since the beginning of the 2020/2021 school year, a decision by the Head of the Department that was endorsed by all members except the data subject had subjected each meeting to audio recording. Notably, this was done without modifying the Rules of Organization and Operation of the Center Plan until 2 February 2021.
The CTPD’s investigation revealed that up until the date of this modification in February 2021, there was no regulation of the recordings of the sessions. The controller affirmed that it had informed those attending the telematics session that the same and subsequent meetings would be recorded, the identity and contact information of the controller and the purpose of the processing. However, the controller did not verify that it had informed the members of the Department that the sessions would be recorded or of other Article 13 GDPR requirements.
Holding
On 19 July 2022, the CTPD initiated sanctioning proceedings against the controller for violations of Articles 6 and 13 GDPR.
The CTPD noted that though Article 18 of Law 40/2015 establishes the obligation to draw up minutes of each session held by a collegiate body, it does not require the recording of such sessions by simply stating that “they may be recorded.” This does not create an obligation to record. Further, the ‘right’ of members to have information discussed at the meetings at their disposal can be guaranteed with minutes sent by electronic means. As a result, the CTPD found that this is not a case where processing is necessary to fulfil a legal obligation or a public purpose pursuant to Articles 6(1)(c) or (e) GDPR.
The CTPD also found a violation of Article 13 GDPR. It noted that some meetings were held where there was no evidence of a notice that the meeting would be recorded. In addition, even in the initial meeting where some of the affected data subjects were informed that the same and future meetings would be audio recorded, the disclosure still fell short of Article 13 GDPR. In particular, the controller failed to inform data subjects in an express, clear and precise manner of the purposes of recording, their rights and how to exercise them, the identity of the data protection officer or the period of retention.
In determining the sanction, the CTPD considered that the violation should be considered mild and not serious pursuant to Article 74(a) LOPDGDD. The CTPD ultimately issued a warning with no fine and ordered the controller to correct its infringing actions within a month.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Resolution RPS-2023/007
[Proc. PS-2022/015-File RCO-2020/088]
RESOLUTION OF SANCTIONING PROCEDURE
Subject: Resolution of resolution of sanctioning procedure against the [educational center]
(Department of Education and Sports) for an alleged violation of protection regulations
of personal data.
BACKGROUND
First. On December 23, 2020, [XXXXX] (hereinafter, the claimant), filed
claim before the Transparency and Data Protection Council of Andalusia (hereinafter,
the Council) against the [educational center] (hereinafter, the claimed body), for an alleged
violation of personal data protection regulations.
The aforementioned claim stated:
"[…] FIRST.
From the beginning of the current 2020/2021 school year and by decision of the Head of the
Department [name of department], endorsed by all members of the referred
department, with the exception of the complaining person, the
sessions corresponding to the meetings of the aforementioned body (specifically and until the
moment those developed on days [dd/mm/yy]; all this without having been addressed with character
prior to any modification of the Regulations for the Organization and Operation of the Plan of
Center, in order to provide said actions with the necessary guarantees, established in the
Regulation (EU) 2016/679, as well as in the aforementioned Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights.
Similarly, the head of the Directorate of the [educational center] has been recording audio
all the sessions of the Faculty Senate that have taken place in this course
Resolution (File RCO-2020/088)
Page 1 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.es without undertaking any regulatory modification in this regard, in application of the standards
mentioned above.
SECOND.
Dated [dd/mm/yy] the claimant, whose arguments expressed in a manner
verbal opposition to the aforementioned recordings were completely ignored by the Headquarters
of the department and the director of the [educational center] himself, addressed separate letters to the
Territorial Delegation in Granada of the Ministry of Education and Sports and the Director of the
[educational center], respectively, in which it warned of its irregular nature, contrary to the
European and Spanish regulations on the matter, given their complete non-observance of the
fundamental right to the protection of personal data, requesting the cessation of
said actions and the reestablishment of the grossly violated legality. To the effects
appropriate evidence, copies of the aforementioned writings are attached as documents No. 1 and
nº2 respectively (paragraphs relating to other matters have been deleted, including
in them).
In effect, the claimant alleged in his writings that he had not been informed in
in any way of the security measures adopted, of a technical and organizational nature, to
guarantee the security of the personal data collected, that is, its integrity and
confidentiality and protection against unauthorized or illicit processing and against its
accidental loss, destruction or damage. Likewise, he had not been informed of the
measures taken to guarantee that all those who have access to the
personal data could only process said data in the exercise of the functions they have
assigned; since not even a deadline had been set for its conservation, ignoring the
mandate inherent in the aforementioned norms that orders to preserve them for the time
strictly necessary for the purposes for which they were collected and to address
the responsibilities that may arise from their treatment, so that when
cease to be necessary or relevant for said purpose, their
destruction.
[...]
And as one might expect, the mandatory delegate of education does not exist in the [educational center] either.
data protection, a legal figure of outstanding importance in Regulation (EU) 2016/679,
Resolution (File RCO-2020/088)
Page 2 of 34 Document suitable for publication on the Portal del Cwww.ctpdandalucia.es subsequently incorporated into Spanish legislation (art. 34.1.b) of Organic Law 3/2018,
of December 5, Protection of Personal Data and guarantee of digital rights).
ROOM.
To date, none of the aforementioned writings have received any response, not even from the
address of the [educational center] nor of the Territorial Delegation of Education and Sports,
It is understood that the actions denounced have the implicit protection of
both instances, with everything that this entails.
And all this despite the fact that the aforementioned legislation requires that the administrations
public authorities expressly, clearly and precisely inform the purpose of the recordings, the
rights of the interested parties and how to exercise them and of the person responsible for the treatment of the
data obtained, as well as the identity of the data protection officer (figure
contemplated in the merited Organic Law 3/2018 for educational centers) and the term of
conservation of said data or the criteria to determine it; none of which, as has
exposed, has been duly satisfied by the management of the [educational center] (with
the acquiescence of the Territorial Delegation of Education and Sports), aware of these
facts and who was responsible, in any case, for having promoted with all diligence the
modification of the Organization and Functioning Regulations of the center in order to grant
due guarantees to the recordings made by the Head of the Department of [name of
department] and by the director of the center himself, among them, the non-use of the data
personal data for purposes other than those for which they were theoretically obtained, the
security measures to be implemented to prevent its subsequent alteration and destruction in the
Right moment. […]”.
Along with the claim, a copy of the document presented by the claimant was provided,
on [dd/mm/yy], before the Territorial Delegation in Granada of the Ministry of Education and
Sports and before the [educational center].
Second. Pursuant to articles 37 and 65 of Organic Law 3/2018, of December 5, of
Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD),
On January 11, 2021, the claim was transferred to the Protection Delegate of
Data from the Ministry of Education and Sports (hereinafter, DPD) so that, within the period
maximum of one month, will communicate the response given to the claim and, where appropriate, the
Resolution (File RCO-2020/088)
Page 3 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.esactuations carried out in relation to it.
In response to the previous request, on February 11, 2021, he joined the Council
DPD report where, among other issues, it reported:
“[…] This means that there is no registration activity in the Department's RAT.
treatment that consists of recording and/or video recording of meetings held
electronically, although this DPD will propose to the bodies
responsible for the Ministry's implementation."
Likewise, the DPD attached a letter sent to the complainant, dated February 10
of 2021, as well as a report from the Director of the [educational center] where, among other issues,
indicated that:
"[…] First. –On “if the recording of the sessions of the collegiate bodies of the center
"It appears specifically provided for in its organization and operating regulations."
In the organization and operation regulations (ROF) of the [educational center] it appears
the recording of the sessions of the collegiate bodies of the center from day 2 of
February 2021, approved by the School Council after being informed by the Senate. With
Previously, this modification had not been contemplated, since the modifications of the
ROF must be carried out prior to November 15 as a result of the
proposals that arise from the self-evaluation report of the 2019-2020 academic year.
[...]
Thus, according to article 18 of Law 40/2015, of October 1, on the Legal Regime of the
Public Sector (Official State Gazette of 02-10-2015) in point 1. From each session
held by the collegiate body, minutes will be drawn up by the Secretary, who will specify
necessarily the attendees, the agenda of the meeting, the circumstances of the
place and time in which it was held, the main points of the deliberations, as well as
as the content of the agreements adopted.
The sessions held by the collegiate body may be recorded. The file resulting from
the recording, together with the certification issued by the Secretary of authenticity and
integrity of the same, and how many documents in electronic format were used as
Resolution (File RCO-2020/088)
Page 4 of 34 Document suitable for publication on the Cowww.ctpdandalucia.es Portal. Session documents may accompany the minutes of the sessions, without the need for
record in it the main points of the deliberations.
From the center's management it was understood from the beginning of the course that, under the protection of said
law, the sessions of the collegiate bodies could be recorded and by analogy of
functioning of the teaching coordination bodies, with the sole intention of being able to
reflect in a reliable and authenticated manner what was discussed at said meeting.
The recordings of these sessions have no other purpose than the situation
extraordinary and innovative in educational centers where, as advised by
Instructions of July 6, 2020, from the Vice-Ministry of Education and Sports, regarding the
organization of teaching centers for the 2020/2021 school year, motivated by the crisis
health of covid19, where it says “the part of the non-school schedule and mandatory permanence
in the civil servant teaching center will be carried out, in general, in a
telematics, prioritizing work meetings through videoconference”, being able
transfer to the minutes of the different bodies the content of said session by the
secretary with the greatest possible reliability, since the operation is far from being the same
than in a face-to-face session.
The unexpected circumstances caused by COVID-19 force us to carry out the
telematic meetings. Therefore, with the advice of the inspector of
reference of the center, on February 2, 2021, it was unanimously approved in the
school board of the [educational center], the modification of the ROF that adapts to the
current situation giving coverage to the recording that was already being produced of these
meetings, as the teaching staff had previously been informed from the
beginning of course.
The recordings of the sessions of the collegiate and teaching coordination bodies are
carried out through the official digital platform that the Ministry of Education and Science
of Andalusia has put at our disposal with all the security guarantees
necessary: Moodle Centers.
Second. – Regarding “if, prior to recording the sessions, people are informed
interested parties from all the extremes required by article 13 of the General Regulation of
Data Protection".
Resolution (File RCO-2020/088)
Page 5 of 34 Document suitable for publication on the Con Portalwww.ctpdandalucia.es Prior to the recordings, the faculty and the coordinating body are informed
teacher that said session is going to be recorded. From the first faculty session of the
This course it has been notified that said session is going to be recorded.
The content of the Cloister and Teaching Department sessions is of a
Totally professional, none of them contain personal data.
[…]
Likewise, I inform you that in the recordings made that the person alludes to
complainant [XXXXX], appears with his image turned off and identified through a nickname
“[XXXXX]”, without appearing their name and surname or image.
[…]”.
Third. The claim began its processing in accordance with the procedure established in the
Title VIII of LOPDGDD, and by virtue of article 67.1 thereof, dated March 16,
2021, the director of the Council ordered the start of prior investigation actions to the
purposes of achieving a better determination of the facts and circumstances that justified the
processing of a possible sanctioning procedure.
Room. Within the framework of these actions and with the aim of completing the information
related to the reported events, on May 10, 2021, the Council requested
to the DPD to send information and documentation on the causes that had motivated
the incident and the actions carried out in relation to the claim. Specifically, it
had to send:
- Copy of supporting documentation related to the evaluations that were made on the
different options to implement as a control system, including, where appropriate, the
corresponding risk analysis.
- Copy of the record of treatment activities related to the aforementioned activity, with the
data required by article 30 GDPR and its legal basis. In particular the legitimizing basis
for the processing of the data object of the claim by the Department of
[name of the department], since this is not constituted as a collegiate body.
Resolution (File RCO-2020/088)
Page 6 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.es - Copy of the informative document for interested parties on the processing of their data
personal data [articles 13 and 14 GDPR].
- Information on the technique used to control access to recordings by
of staff on the Moodle Centros digital platform.
- If applicable, copy of the instructions given by the person responsible for the treatment in
relation to the access and processing of the data object of the recording, with indication of
the way in which said instructions have been disclosed.
- Where applicable, information on the existence of security measures, standards,
procedures, rules that may exist in the aforementioned Center or established by the
controller on how data protection is ensured
of the people affected by the recordings.
- Any other information or documentation that you consider relevant.
In response to the previous request, on June 4, 2021, the DPD sent this Council
report from the Director of the [educational center] which stated, among other issues, that:
“[…] 3.-Copy of the informative document for interested parties on the treatment of
your personal data (articles 13 and 14 GDPR)
The processing of personal data of all center staff is collected
in our Center Plan, specifically in the Management Project.
According to the LEA (Art. 126), the Center Plan is a document that is made up of: the
educational project, the organization and operating regulations and the
management. The Center Plan is a public and multi-year document, it obliges and relates to
the entire Educational Community, and at all times its knowledge is facilitated,
in the center itself and on our website [educational center website].
Thus, within the Center Management Project, (can be consulted in our
website [educational center website]), in section 9, page 79, everyone is informed
center staff regarding the processing of your personal data:
[…]
Resolution (File RCO-2020/088)
Page 7 of 34 Document suitable for publication on the Cowww.ctpdandalucia.es Portal 5.- If applicable, copy of the instructions given by the person responsible for the treatment
of the data subject to the recording, with an indication of the way in which it has been disclosed
these instructions.
The unexpected circumstances caused by COVID-19 force us to carry out the
telematic meetings. For this reason, the modification of the ROF was approved in
CHAPTER I, Section 2 on Faculty Participation, by the faculty of
teachers with only 1 vote against and unanimously in the school council of the
[school]. The following paragraph was added:
THE functioning of the teaching coordination bodies of the [center website
educational] (Departments, Educational Teams, ETCP...), by analogy it will be equal to the
functioning of a collegiate body. The legal regime of the collegiate bodies
will comply with the rules contained in Law 40/2015, of October 1, of Regime
Legal of the Public Sector.
Based on article 18 of the aforementioned law:
[...]
The ROF of the [educational center] can be consulted on our website [school website
educational]
The recordings of the sessions of the collegiate and teaching coordination bodies are
carried out through the official digital platform that the Ministry of Education and Science
of Andalusia has put at our disposal with all the security guarantees
necessary: Moodle Centers.
[...]
7.-Any other information or documentation that you consider relevant. [center
educational]
Finally, I would like to state, as I did in the previous report that was sent to me
requested that the management of the [educational center] has always acted in good
faith, trying to be faithful to reality, and keeping in mind the regulations in force.
Likewise, I want to state that there is no type of complaint from the community
educational about data processing at the center, with the exception of this teacher.
Resolution (File RCO-2020/088)
Page 8 of 34 Document suitable for publication on the Portal del Conswww.ctpdandalucia.es We understand that this complex situation that we are experiencing due to the crisis
health, especially in educational centers, may reveal some
irregularity in the procedure of the operation of the collegiate bodies or of
teaching coordination, since it is not the usual one that had been carried out until March
2020.”
Fifth. After completing the report corresponding to the previous investigation actions,
On July 19, 2022, the director of the Council issued the Agreement to Start the procedure
sanctioning against the [educational center] (Department of Education and Sports), with NIF S4111001F,
for the alleged violations of articles 6 and 13 RGPD, typified in articles 83.5.a) and
83.5.b) RGPD, and punishable with a warning in accordance with article 77.2 LOPDGDD.
Sixth. Once the initiation agreement was notified to the claimed body, it, on August 8, 2022, presented
brief of allegations in which, in summary, he stated the following:
“[…] FIRST.- A distinction is made in the agreement to initiate the sanctioning procedure
between the governing bodies and the teaching coordination bodies to conclude that
The latter are not collegiate bodies and, consequently, the
established in article 18 of the LRJSP regarding the recording of its sessions.
In this regard, it is worth mentioning that Organic Law 2/2006, of May 3, on Education,
under the provisions of the same CHAPTER III of Title V, establishes which bodies are
members of government and teaching coordination of public centers, pointing out
those that follow: School Council (Section 1), Faculty of Teachers (Section 2) and Others
teaching coordination bodies (Section 3), among which are the
didactic departments.
We must highlight that the School Council, Faculty of Teachers and Other governing bodies
Teaching coordination is regulated in the same chapter of Organic Law 2/2006,
mentioned above, therefore, subjecting it to a hermeneutical criterion of interpretation,
It could be deduced that they have a common characteristic, which is the one referred to in the title of the
cited chapter, that is, that they are collegiate bodies. This interpretation remains
reinforced if we analyze what the aforementioned legal body dedicates the following chapter to, which, in
Resolution (File RCO-2020/088)
Page 9 of 34 Document suitable for publication on the Cowww.ctpdandalucia.es Portal, in contrast to collegiate bodies, is dedicated to single-person bodies:
director, head of studies and secretary.
Likewise, if we go to a grammatical analysis, when the third section refers to “Others
teaching coordination bodies” it can be deduced that the “others” cannot exist,
without the “ones”, which are nothing more than those referred to in the first and second sections.
Therefore, it is considered that the fact that Decree 327/2010, of July 13, by the
that the Organic Regulations of Secondary Education Institutes are approved, in
its article 48.1, as expressly cited by that Council in its initial agreement, in the
fifth legal consideration, in fine, states that “The School Council and the Faculty
Faculty are the collegiate governing bodies of educational institutes
secondary”, which is true, it cannot be inferred that the rest of the organs should not
be considered as collegiate bodies, since what, in the opinion of the undersigned, is
inferred from said normative premise is that the “Other teaching coordination bodies”
They are not governing bodies, but rather teaching coordination bodies, but it cannot be deduced
that are not collegiate bodies, especially if analyzed in light of what is included in
the previous paragraphs on the analysis of the organic law, from which this
Decree, as a regulatory development.
For this reason, it is considered that they are collegiate bodies of teaching coordination, but not of
government. Excluding these bodies from the consideration of collegiate bodies means,
judgment of the undersigned, and in the terms cited above, go against the principles of
interpretation of the rules established in article 3 of the Civil Code.
For completeness, it should be noted that, apart from the didactic departments,
educational teams or boards of directors also meet in a collegial manner.
evaluation that make their decisions using the majority system, which is what
relevant for the purposes of considering the operation in a collegiate manner.
SECOND.- It is therefore appropriate to analyze whether, in the case of the departments
of didactic coordination, the requirements established in article 20 of the
Law 40/2015, of October 1, on the Legal Regime of the Public Sector (hereinafter
LRJSP), regarding the constitution of collegiate bodies. And it is included, with special
emphasis, the public powers that are exercised by the teaching staff and by the
Resolution (File RCO-2020/088)
Page 10 of 34 Document suitable for publication on the Cowww.ctpdandalucia.es Portal of the departments, as justification of the legality in the processing of data
personal character.
In this regard, it is worth pointing out the following:
- The teaching departments have been formally created: article 130.2 of the Law
Organic 2/2006; article 82.1 g) and article 92 of Decree 327/2010, of July 13, by
which approves the Organic Regulations of Secondary Education Institutes.
- They are made up of three or more people. Specifically, in the case of
Department of [name of department], has been integrated into the course
2021/2022 by [nn] people.
- Has assigned administrative functions of decision, proposal, advice,
monitoring or control:
• Article 130.2 of Organic Law 2/2006, of May 3, on Education.
• Article 92.2 of Decree 327/2010, of July 13, which approves the
Organic Regulation of Secondary Education Institutes [...].
• Order of January 15, 2021, by which the curriculum corresponding to
the stage of Compulsory Secondary Education in the Autonomous Community of Andalusia
[…].
• Article 19.1 of the Order of August 20, 2010, which regulates the
organization and operation of secondary education institutes, as well as the
hours of the centers, of the students and of the teachers (proposal for the distribution
between the teaching staff of the subjects, modules, areas, courses, groups and, where appropriate,
shifts assigned to them).
- Decree 327/2010, cited above, establishes its integration into the structure of the center
and its dependence on the governing bodies of the center and the departments
(Teaching faculty, department head, head of studies and management,
fundamentally).
- Has established the criteria for the designation of the person to whom it corresponds
the exercise of leadership of the department (article 95.1 of Decree 327/2010).
Resolution (File RCO-2020/088)
Page 11 of 34 Document suitable for publication on the Con Portalwww.ctpdandalucia.es - Part of its operating regime is normatively established, as it is
attributes to the person who heads the department the competence to
“Convene and chair department meetings and take minutes thereof”
(article 94 b) of Decree 327/2010), which must be put in relation to articles 17
to 19 of the LRJSP.
- The material and economic allocations that correspond to you for your
operation (article 94 d) and e) of Decree 327/2010).
- All the regulations, previously mentioned, are published in the Official Gazette of the
Junta de Andalucía and serve as a basis for the exercise of decision-making powers
(such as, to highlight an example, the review of the final grade
obtained by the students or on the decision of promotion and qualification).
THIRD.- Regarding the DUTY OF INFORMATION to the person who owns the data about
the object of the treatment, the REGULATIONS OF ORGANIZATION AND OPERATION of the
[educational center], includes in its chapter I, section 2, referring to “The participation of
Teaching Staff” that “Based on article 18 of the aforementioned law: The sessions that
celebrate the collegiate body. The file resulting from the recording, along with the certification
issued by the Secretary of the authenticity and integrity of the same, and how many documents
in electronic format were used as session documents, they may accompany the
minutes of the sessions, without the need to record in it the main points of the
deliberations.”
In this sense, article 68 i) of Decree 327/2010, establishes among the functions of the
Faculty Senate, of which the person filing the claim is a member,
the competence to “Inform the regulations of organization and operation of the
institute”, prior to its approval by the School Council.
The aforementioned regulation, on a mandatory basis, must contemplate “The criteria and
procedures that guarantee rigor and transparency in decision-making by the
different governing and teaching coordination bodies, especially in the processes
related to the schooling and evaluation of students” (article 26.2 b of the
Decree 327/2010). Likewise, in the third section of the aforementioned article it is stated that
"In the preparation of the organization and operating regulations, they may carry out
suggestions and contributions to it from the teaching staff, administration staff and
Resolution (File RCO-2020/088)
Page 12 of 34 Document suitable for publication on the Portal of the Conwww.ctpdandalucia.es services and complementary educational attention, the boards of delegates of the
student body and the associations of the students and parents of the students.”
Likewise, article 22.3 of the aforementioned Decree establishes that “The Teaching Staff
will make proposals to the management team for the preparation of the Center Plan, will establish
criteria regarding the orientation and tutoring of students, will inform the regulations of
organization and operation and will approve and evaluate the educational aspects of the Plan of
Center referred to in letters b), c), d), e), f), g), k), m), ñ), o), p) and q) of article 23.3”.
From this we deduce the necessary knowledge of the Center Plan, of which the
regulation of organization and operation is an integral part, it must have all the
faculty of the center, configuring, not only as a right, participation in the
preparation and approval of the same (through the coordination departments
didactics and the teaching staff), but is constituted as a duty of
mandatory compliance, in application of what is established in article 22.4 of the Decree:
"4. The Center Plan, which will have a multi-year nature, will obligate all the institute's staff
and will link its educational community. It may be updated or modified, as appropriate.
case, after the self-evaluation processes referred to in article 28 or at the proposal of the
director depending on his or her management project.”
Regardless of whether or not there was an express provision in the organization and
operation, and being a legal provision, if it is planned that the meeting
corresponding is recorded, the members of the body must be informed and
approved its implementation in the manner determined by the aforementioned regulations or, in its
default, by majority vote.
The information that, as a member of the collegiate body, you must have at your disposal,
is guaranteed, since its members have the right to have a copy sent to them
of the Act (article 18.2 of Law 40/2015).
Therefore, it is not considered that there has been a lack of information to the people
members of the department about the fact that the recording of
a certain session.
Nor has it been justified in a concrete way, with all due respect, and in
strict terms of defense, the factual assumptions that determine the special
Resolution (File RCO-2020/088)
Page 13 of 34 Document suitable for publication on the Portal del Conwww.ctpdandalucia.es seriousness that is considered due to the lack of imputed information and that, in the opinion of that
Council, are deserving of the most serious classification of the infraction [ art. 72.1 hours of the
LOPDGDD ] instead of the general breach of the right to information of the
affected by not providing all the information required by articles 13 and 14 of the
Regulation (EU) 2016/679, which establishes article 74 a) of the aforementioned Organic Law, and
which is considered a minor infraction, so it is warned of a possible
incorrect qualification and grading of the proposed offenses and sanctions.
Likewise, if this were considered by the Transparency and Transparency Council
Data Protection of Andalusia, and with a subsidiary nature to the above, it is requested, to the
protection of the provisions of article 77.2 of Law 39/2015, that the
opening of a trial period in which people's statements are collected
that make up the Department of [name of department], so that the
knowledge of the aspects derived from the recording of the session, the context of the
list of services as officials in which it is carried out and its purpose,
evidence that is requested to be considered requested at the proposal of the person formulating the
present allegations.
FOURTH.- Regarding the LICITUDE OF THE TREATMENT, express reference has already been made
to the different foundations in which, apart from its technical consideration as
collegiate bodies or not, the exercise of administrative powers by the
of the didactic coordination departments that undoubtedly affect the
sphere of rights of users of the public educational service, with special
reference to the process of evaluating student learning (which greatly affects
intensity to the personal, vital and professional development of people) and that is found
inserted, both in the very configuration of the didactic programs and the criteria
and evaluation instruments, which are a procedural guarantee for students
in said process; as in the review procedures for claims
against final grade obtained. Both are powers attributed to the
didactic coordination departments.
Consequently, it is considered that the teaching center and the educational Administration
are entitled to collect and process personal data, in accordance with the provisions
in article 6.1, letters c) and e) of the European Data Protection Regulation 2016/679
Resolution (File RCO-2020/088)
Page 14 of 34 Document suitable for publication on the Cowww.ctpdandalucia.es Personal Portal and articles 15 to 18 of Law 40/2015, of October 1, Regime
Public Sector Legal.
Likewise, it should be noted that the aforementioned actions take place within a framework
characterized by the pandemic situation in which the sessions of the different
organs of the center were carried out electronically and the recording of the sessions
represented an additional guarantee of the rights of users, especially
of the students, which the teachers and the different departments of the center
education still had the obligation to respect and the governing bodies in
ensure that they are fulfilled.
In this sense, being a power included in the regulations, the sessions may
be convened in person or remotely as long as it is ensured by means
electronic devices, telephone and audiovisual devices also being considered as such, the identity
of the members (Article 17.1), the recording is considered an appropriate element
to achieve this objective.
In this sense, for the 2020/2021 academic year, the INSTRUCTIONS OF JULY 6, 2020,
OF THE VICE-MINISTRY OF EDUCATION AND SPORTS, RELATING TO THE ORGANIZATION OF
THE TEACHING CENTERS FOR THE 2020/2021 SCHOOL YEAR, MOTIVATED BY THE
COVID-19 HEALTH CRISIS, included in their tenth instruction, section 6, what
go on:
6. Without prejudice to the in-person attention of the on-call service in those centers in which
that this is contemplated, the part of the non-school schedule and mandatory stay at the center
of civil servant teaching will be carried out, in general, electronically,
prioritizing work meetings via videoconference. However, it
will attend in person by appointment, during the hours authorized for this purpose, at
families who have difficulties accessing electronic tutoring.
And for the 2021/2022 academic year, the INSTRUCTIONS OF JULY 13, 2021, OF THE
VICE-MINISTRY OF EDUCATION AND SPORTS, RELATING TO THE ORGANIZATION OF THE
SCHOOL CENTERS AND CURRICULAR FLEXIBILIZATION FOR THE SCHOOL YEAR
2021/22, in its ninth instruction, section 6, stated the following:
Resolution (File RCO-2020/088)
Page 15 of 34 Document suitable for publication on the Cowww.ctpdandalucia.es Portal 6. Without prejudice to the in-person attention of the on-call service in those centers where
that this is contemplated, the part of the non-school schedule and mandatory stay at the center
of the civil servant teaching staff may be carried out, in general, in a
telematics. However, it will be attended in person by appointment, during the hours
enabled for this, to families who have difficulties accessing tutoring
electronics.
In default, which is considered, as expressly provided for in the Regulations of Organization and
Operation, the agreement for the recording of the sessions of the collegiate bodies
of the educational center must be considered adopted by majority vote (Article 17.5)
On the other hand, the arguments already included in the preceding allegations, with special
reference to the second allegation, in the opinion of the undersigned, determine that “the
processing is necessary for compliance with a legal obligation applicable to the
responsible for the treatment” and that “the treatment is necessary for the fulfillment of a
mission carried out in the public interest or in the exercise of public powers conferred on the
responsible for the treatment", considering that, in the present case, the
conditions of legality of article 6.1, sections c) and e) of European Regulation 2016/679,
of April 27, 2016, on Protection of Personal Data.
The processing of the data is for the calling of the sessions and in the case of the
recording of these, for exclusive consultation of the matters incorporated in the order
on the day of the meetings.
The personal data incorporated in the minutes will be kept indefinitely with
archival purposes, without being able to be treated for other purposes, except scientific or statistical.
In this regard, the request formulated in the third allegation, in fine, is reiterated.
regarding the proof of the aforementioned extremes regarding the adequate knowledge by
part of the rest of the members of the Teaching Coordination Department of [name
from the Department]
FIFTH.- For all these reasons, it is not considered that the processing of personal data has been
done without any of the conditions of legality established in article 6.
of the European Regulation, cited above.
Resolution (File RCO-2020/088)
Page 16 of 34 Document suitable for publication on the Portal del Conwww.ctpdandalucia.es Consequently, with the above, it is not considered that any
very serious violation, of those contemplated in article 72 of Organic Law 3/2018,
of December 5, Protection of Personal Data and guarantee of rights
digital.
For this reason and there being, at least, reasonable doubts of legal interpretation,
as well as especially burdensome conditions for the operation of the center
educational in a pandemic situation that has seriously conditioned the
functioning of educational centers, and, consequently, the conditions in
that public employees perform their public function, or their
responsibility, in the case of governing bodies, it is not considered that the
reported conduct is reprehensible, since, in an unprecedented situation of
provision of public service by telematic means, the only thing that has existed is the
maximum zeal to guarantee compliance with legal obligations and powers
that make up the public educational service.
And this is because, since the procedure initiated has a sanctioning nature, it should not
absolutely disregard the assessment of the voluntariness or negligence of the subject
obliged.
Said public service, apart from a duty for the educational Administration and for the
educational centers, is configured as a fundamental right whose exercise
corresponds to a multiplicity of people, which must be put in relation to the
right that is reported to have been infringed and whose ownership affects a single person.
Ultimately, from everything previously stated, it is inferred the absence of the conduct
typical attributed by that Council to this educational center, being able to extract the
following conclusions:
As has been based on the preceding allegations, with special reference to the
second section of this writing, the treatment has been carried out with the conditions of
legality established in article 6.1 c) and e) of European Regulation 2016/679.
Likewise, with respect to the information on the processing of the data of which it is
owner, the person who files the claim is accredited, not only the
knowledge of all the points contemplated in article 13 of the Regulation
Resolution (File RCO-2020/088)
Page 17 of 34 Document suitable for publication on the Portal of the European Cowww.ctpdandalucia.es 2016/679, but the legal obligation to know them, in your capacity as a teacher,
public official, member of the department and the Faculty,
The members of the Department of Information have also been informed.
didactic coordination of [name of department] on the occasion of the celebration of
each of the sessions of the department, without prejudice to what is determined, in its
case, in the testing phase.
For all these reasons, in use of the powers conferred,
SOLICITOUS:
FIRST.- Please consider this document presented, please admit it, and in merit of what
exposed, considers ALLEGATIONS formulated against the agreement to start
sanctioning procedure, identified at the beginning, by which the
sanctioning file initiated for the imposition of two very serious offenses, typified
in articles 72.1, sections b) and h), respectively.
SECOND.- Considering, based on said allegations, that the
factual assumptions necessary for the consideration of the existence of any of
the infractions included in title IX of the LOPDGDD, or, at least, that said facts
clearly constitute an administrative infraction, and, after processing the
procedure, proceed to annul the agreement to initiate the procedure
sanctioning, considering it contrary to law.
THIRD.- Subsidiarily to the above, and in the event that it is decided
continue with the processing of the procedure, it is agreed, under the provisions established
in article 77.2 the opening of a trial period, which enables, after
notification to this party, the proposal of those that are appropriate to its right, among which
Those included in the third section, in fine, of the allegations are found
contained in this writing.”
Seventh. On September 16, 2022, the Council notified a letter to the
claimed body, by virtue of which he was informed that, in accordance with the principle of
“proactive responsibility”, it is up to the data controller to demonstrate the
conformity of the treatment activities carried out, in the terms established in the
article 5.2 and recital 74 GDPR, so what was requested in his written notice was not appropriate.
Resolution (File RCO-2020/088)
Page 18 of 34 Document suitable for publication on the Cowww.ctpdandalucia.esalegaciones Portal, dated August 8, 2022, in which it requested this organization to collect the
declaration of the people who make up the Department of [name of department].
Likewise, the requested body was required to, in order to complete the
documentation that would allow the ongoing procedure to be resolved, to send to this Council the
documentation that it deems appropriate to support and prove that the proceeding was
appropriately to fulfill the duty to inform interested parties about the treatment
of the personal data in the processing object of the claim, with express indication of the
detailed information that was provided to all affected people.
In response to the previous request, dated October 7, 2022, it was entered into this
Tip the following documentation:
- Writing from the Director of the Center certifying who the members of the Center had been.
Department of [name of department] during the 2020-2021 academic year, as well as
All members of the aforementioned Department attended the telematic session of the
[dd/mm/yy].
- Copy of various writings from members of the Department of [name of department]
where they certified that in the [dd/mm/yy] session they were informed that it was going to be
recorded, as well as the identity and address of the person responsible for the treatment and the
purpose of the processing of personal data: “I declare that in the telematic session of the
Department dated [dd/mm/yy], by D. [...] the members of the
Department of [name of department] that the aforementioned meeting and the subsequent ones, held
by videoconference, they were going to be recorded.”
Eighth. Once the instruction of the procedure was completed, the corresponding
proposed resolution, which was notified to the alleged infringer on April 11, 2023,
establishing a period of ten days for the formulation of allegations, in accordance with the
article 89.2 LPACAP and in relation to article 73.1 of the same standard.
After the aforementioned period and until the date of this Resolution, there has been no
entry no allegation by the instituted body.
Resolution (File RCO-2020/088)
Page 19 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.es PROVEN FACTS
From the documents in the file and the actions carried out, they can
be considered as proven facts:
First. According to the statements of the DPD, it currently does not exist in the Registry of
Treatment Activities of the Department of Educational Development and Vocational Training, 1
no treatment activity consisting of recording session videoconferences
of collegiate bodies, of administrative units of the Ministry, nor of its centers and
educational services, nor of any other nature.
Second. Since [dd/mm/yy], at the [educational center], the meetings of the
Department [name of department].
Third. Until February 2, 2021, the date on which the Regulations of
organization and operation [educational center], the recordings of the
sessions of the coordinating bodies of the Institute, being the sessions of the Department of
[department name], recorded, between [dd/mm/yy] and [dd/mm/yy] .
Room. The claimed body has proven that it informed those attending the telematic session
held, on [dd/mm/yy], that the same and subsequent meetings were going to be recorded,
providing the identity and address of the person responsible for the treatment, as well as the purpose for the
that the personal data would be processed, but it has not been proven that the Institute
inform you of all the details required by article 13 GDPR.
Fifth. It has not been proven that the Institute informed the members of the
Department attending the sessions held in [dd/mm/yy] and [dd/mm/yy] that these
were going to be recorded and it has not been proven that they were informed of the extremes
required by article 13 GDPR.
1
Name of the Ministry after Presidential Decree 10/2022, of July 25.
Resolution (File RCO-2020/088)
Page 20 of 34 Document suitable for publication on the Cwww.ctpdandalucia.es Portal FUNDAMENTALS OF LAW
First. The competence to resolve the sanctioning procedure due to possible
breach of personal data protection regulations, in relation to the facts
described, corresponds to the director of the Council by virtue of the provisions of articles 43.1 and
48.1 i) of Law 1/2014, of June 24, on Public Transparency of Andalusia (hereinafter,
LTPA), in articles 10.3.b) and 10.3.i) of the Statutes of the Transparency Council and
Data Protection of Andalusia (approved by Decree 434/2015, of September 29) and in
articles 57 and 64.2 LOPDGDD.
The Council, as the autonomous authority for the protection of personal data, and within its
jurisdiction, exercises the functions and powers established in articles 57 and 58
GDPR.
Second. Article 1.1 GDPR establishes that “[t]his Regulation establishes the rules
relating to the protection of natural persons with regard to data processing
personal data and the rules relating to the free circulation of such data. According to article 4.1
GDPR means “personal data”, “[a]ll information about an identified natural person or
identifiable ("the interested party"); An identifiable natural person will be considered any person whose
identity can be determined, directly or indirectly, in particular by means of an identifier,
such as a name, an identification number, location data, an identifier
online or one or more elements of the physical, physiological, genetic, psychological,
economic, cultural or social of said person.”
For its part, article 2.1 GDPR provides regarding its scope of application that “[t]he
This Regulation applies to the fully or partially automated processing of data
personal data, as well as the non-automated processing of personal data contained or intended
to be included in a file”, defining the concept of “treatment” in article 4.2 RGPD
as “any operation or set of operations carried out on personal data or
sets of personal data, whether by automated procedures or not, such as the collection,
registration, organization, structuring, conservation, adaptation or modification, extraction,
Resolution (File RCO-2020/088)
Page 21 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.esconsulta, use, communication by transmission, dissemination or any other form of authorization
of access, collation or interconnection, limitation, suppression or destruction.”
According to the previous definitions, and in relation to the case at hand, the voice of a
person, must be considered personal data since it is information about a
identified or identifiable natural person to whom treatment is performed. Therefore,
both the personal data collected and the subsequent processing carried out on the
They must comply with the provisions of the data protection regulations.
personal.
The processing operations observed in relation to the personal data (voice) of
The teachers are the ones who carry out the requested body to audio record the sessions.
corresponding to the meetings of the Department of [name of department].
Third. One of the principles established in article 5 GDPR in relation to the
processing of personal data is that of “legality, loyalty and transparency”, included in the
section 1 a) of the aforementioned article: personal data will be “treated in a lawful, fair manner
and transparent in relation to the interested party.”
For its part, article 6.1 GDPR states regarding the “legality of the processing” that:
"1. The treatment will only be legal if at least one of the following conditions is met:
a) the interested party gave his or her consent to the processing of his or her personal data for one or
several specific purposes;
b) the processing is necessary for the execution of a contract in which the interested party is a party or
for the application at his request of pre-contractual measures;
c) the processing is necessary for compliance with a legal obligation applicable to the
responsible for the treatment;
d) the processing is necessary to protect vital interests of the interested party or of another person
physical;
e) the processing is necessary for the fulfillment of a mission carried out in the public interest or in
the exercise of public powers conferred on the data controller;
Resolution (File RCO-2020/088)
Page 22 of 34 Document suitable for publication on the Portal del Conswww.ctpdandalucia.es f) the processing is necessary for the satisfaction of legitimate interests pursued by the
responsible for the treatment or by a third party, provided that said interests do not prevail
the interests or fundamental rights and freedoms of the interested party that require protection
of personal data, particularly when the interested party is a child.
The provisions of letter f) of the first paragraph will not apply to the treatment carried out by
public authorities in the exercise of their functions.
On the other hand, article 13 GDPR refers to the "Information that must be provided when the
personal data are obtained from the interested party", and establishes that:
"1. When personal data relating to him or her is obtained from an interested party, the person responsible for the
treatment, at the time these are obtained, it will provide you with all the information
indicated below:
a) the identity and contact details of the person responsible and, where applicable, their representative;
b) the contact details of the data protection officer, if applicable;
c) the purposes of the processing for which the personal data are intended and the legal basis of the
treatment;
d) where the processing is based on Article 6(1)(f), legitimate interests
the person responsible or a third party;
e) the recipients or categories of recipients of the personal data, where applicable;
f) where applicable, the intention of the controller to transfer personal data to a third country or
international organization and the existence or absence of a decision on the adequacy of the
Commission, or, in the case of transfers indicated in articles 46 or 47 or article
49, paragraph 1, second subparagraph, reference to adequate or appropriate guarantees and the
means to obtain a copy of these or to the place where they have been made available.
2. In addition to the information mentioned in section 1, the data controller
will provide the interested party, at the time the personal data is obtained, the following
information necessary to guarantee fair and transparent data processing:
a) the period during which the personal data will be kept or, when this is not possible, the
criteria used to determine this term;
Resolution (File RCO-2020/088)
Page 23 of 34 Document suitable for publication on the Council Portalwww.ctpdandalucia.es b) the existence of the right to request access to the data from the person responsible for the treatment
personal data relating to the interested party, and its rectification or deletion, or the limitation of its
processing, or to oppose processing, as well as the right to data portability;
c) when the processing is based on Article 6(1)(a) or Article 9,
section 2, letter a), the existence of the right to withdraw consent at any time
moment, without affecting the legality of the treatment based on prior consent
upon his withdrawal;
d) the right to file a claim with a supervisory authority;
e) whether the communication of personal data is a legal or contractual requirement, or a requirement
necessary to sign a contract, and if the interested party is obliged to provide the data
personal and is informed of the possible consequences of not providing such data;
f) the existence of automated decisions, including profiling, to which
referred to in article 22, sections 1 and 4, and, at least in such cases, significant information
about the logic applied, as well as the importance and intended consequences of said
treatment for the interested party.
3. When the data controller plans the subsequent processing of data
personal data for a purpose other than that for which they were collected, will provide the
interested party, prior to said further processing, information about that other purpose and
any additional information relevant under paragraph 2.
4. The provisions of paragraphs 1, 2 and 3 shall not apply when and to the extent
"that the interested party already has the information."
And article 11 LOPDGDD provides regarding “Transparency and information to the affected person” that:
"1. When personal data is obtained from the affected person, the person responsible for the treatment
may comply with the duty of information established in article 13 of the
Regulation (EU) 2016/679 providing the affected person with the basic information referred to in the
following section and indicating an electronic address or other means that allows
easily and immediately access the rest of the information.
2. The basic information referred to in the previous section must contain, at least:
a) The identity of the person responsible for the treatment and his representative, if applicable.
Resolution (File RCO-2020/088)
Page 24 of 34 Document suitable for publication on the Council Portal www.ctpdandalucia.es b) The purpose of the treatment.
c) The possibility of exercising the rights established in articles 15 to 22 of the Regulations
(EU) 2016/679.
If the data obtained from the affected person were to be processed for the preparation of profiles, the
basic information will also include this circumstance. In this case, the affected
You must be informed of your right to object to the adoption of individual decisions
automated actions that produce legal effects on him or significantly affect him
Similarly, when this right occurs in accordance with the provisions of article 22 of the
Regulation (EU) 2016/679.
3. When the personal data had not been obtained from the affected person, the person responsible
may comply with the duty of information established in article 14 of the
Regulation (EU) 2016/679, providing the basic information indicated in the section
above, indicating an electronic address or other means that allows access
simple and immediate to the rest of the information.
In these cases, the basic information will also include:
a) The categories of data subject to processing.
b) The sources from which the data came.”
Room. The Agreement to Start the sanctioning procedure has been notified to the claimed body, as
As indicated in the Background, he presented allegations on August 8, 2022.
Focusing on their content, we can first see a claim to
conclude that the teaching coordination bodies of public centers, although they are not
governing bodies, they are collegiate bodies, and that, specifically, the departments of
2
didactic coordination meets the requirements established in article 20 of Law 40/2015,
2
Article 20 LRJSP establishes with respect to the “Requirements to establish collegiate bodies” that:
1. Collegiate bodies are those that are formally created and are made up of three or more people,
those that are assigned administrative functions of decision, proposal, advice, monitoring or control, and
that act as part of the General Administration of the State or one of its public organizations.
2. The constitution of a collegiate body in the General Administration of the State and its Agencies
public institutions have as an indispensable budget the determination in their creation law or in the agreement
Resolution (File RCO-2020/088)
Page 25 of 34 Document suitable for publication on the Council Portal www.ctpdandalucia.esde October 11, of the Legal Regime of the Public Sector (hereinafter, LRJSP), regarding the
constitution of collegiate bodies. All this in terms of considering the application of the
3
established in article 18 of the aforementioned law regarding the recording of its sessions.
Well, the formal consideration as collegiate bodies of the departments of
didactic coordination, within the teaching coordination and guidance bodies of the
public centers, it must be questioned because it is not found in the regulations themselves
applicable sector cited in the brief of allegations no express mention in this regard.
with other Public Administrations by which said body is created, of the following extremes:
a) Its goals or objectives.
b) Its administrative integration or hierarchical dependency.
c) The composition and criteria for the appointment of its President and the remaining members.
d) The functions of decision, proposal, report, monitoring or control, as well as any other functions assigned to it.
attribute.
e) The provision of the necessary credits, if applicable, for its operation.
3. The legal regime of the collegiate bodies referred to in section 1 of this article will comply with the
norms contained in article 19, without prejudice to the organizational peculiarities contained in the
this Law or in its rule or creation agreement.”
3 Article 18 LRJSP provides that:
"1. Minutes will be drawn up for each session held by the collegiate body by the Secretary, who will specify
necessarily the attendees, the agenda of the meeting, the circumstances of the place and time in which it is held.
has celebrated, the main points of the deliberations, as well as the content of the agreements adopted.
The sessions held by the collegiate body may be recorded. The file resulting from the recording, together with
the certification issued by the Secretary of its authenticity and integrity, and how many documents in
electronic medium were used as session documents, they may accompany the minutes of the sessions, without
need to record in it the main points of the deliberations.
2. The minutes of each session may be approved in the same meeting or in the immediately following one. The Secretary
will prepare the minutes with the approval of the President and will send it through electronic means, to the
members of the collegiate body, who may express their agreement or objections by the same means
to the text, for the purposes of its approval, being considered, if affirmative, approved at the same meeting.
When the decision was made to record the sessions held or to use documents in
electronic medium, must be kept in a way that guarantees the integrity and authenticity of the
Resolution (File RCO-2020/088)
Page 26 of 34 Document suitable for publication on the Council Portal www.ctpdandalucia.esIn fact, neither in Organic Law 2/2006, of May 3, on Education, nor in Law 17/2007, of 10
of December, of Education of Andalusia, nor in Decree 327/2010, of July 13, by which
The Organic Regulation of Secondary Education Institutes is approved in the field
Andalusian, much less in the Order of August 20, 2010, which regulates the
organization and operation of secondary education institutes, as well as the schedule
of the centers, of the students and of the teachers, a similar reference is made specifically
condition, which does occur in the case of the governing bodies of the centers (Council
School and Faculty of Teachers) who are expressly qualified as collegiate by the
article 48 of Decree 327/2010, distinguishing them from teaching coordination bodies
among which are the different departments, as already noted in the
Fifth legal consideration of the Agreement to initiate this sanctioning procedure.
Likewise, the allusion in the writing of allegations to own interpretation techniques
hermeneutics or subjective grammatical analysis of the names of the titles of the
different chapters and sections that regulate the teaching bodies in question, declines before the
criterion of normative interpretation in accordance with the proper meaning of the words to which
refers to article 3 of the Civil Code. In this regard, it is once again insisted that in all
provisions in question distinguish a regulation for the “collegiate governing bodies”
and another for the “teaching coordination bodies”, without the previous epithet. Consistent with
As stated above, Decree 327/2010 itself, in its article 90, addresses tutoring, the condition of which
single-person is undoubtedly one of the different teaching coordination bodies.
It can also be seen that the figure of the Secretary, provided for the collegiate bodies in
Article 16 LRJSP is expressly contemplated in the composition of the two bodies.
government colleges, School Council and Faculty Senate, not so in the
didactic coordination departments nor in the rest of the teaching coordination bodies
of Decree 327/2010.
It is also significant that in the report dated January 8, 2021, directed by the
applicant to the DPD, the teaching coordination bodies are distinguished from the collegiate bodies,
when it is indicated that: “From the center management it was understood from the beginning of the course that, at
corresponding electronic files and access to them by the members of the body
collegiate.”
Resolution (File RCO-2020/088)
Page 27 of 34 Document suitable for publication on the Portal of Cwww.ctpdandalucia.esamparo of said law [40/2015], the sessions of the collegiate bodies could be recorded and therefore
analogy of functioning of the teaching coordination bodies…”.
On the other hand, it would not be appropriate to argue the content of article 20 LRJSP, regarding
the requirements to constitute collegiate bodies, as they do not have a basic nature and are of
application exclusively to the General Administration of the State and the state public sector, such
as established in the fourteenth final provision 2. a) of the aforementioned law.
Without prejudice to the above, it cannot be ignored that article 92 of Decree 327/2020
consecrates a plural composition of each didactic coordination department by being
made up of all the teachers who teach the teachings entrusted to them,
and that article 94 attributes to the heads of the departments, among others, the powers
to convene and preside over department meetings and take minutes thereof.
On such a normative basis, it can be concluded that the aforementioned coordination departments
didactics, when they meet in sessions to exercise the powers that the regulations
recognizes them, they are governed in terms of their operation, with an analogical character, by the
standards established for collegiate bodies.
Note that the modification carried out in the
Chapter I, section 2 of the Regulations for the Organization and Operation of the center against
that this sanctioning procedure is followed, which begins by indicating: “The operation
of the teaching coordination bodies of the [educational center] (Departments, educational teams,
etc.), by analogy it will be equal to the operation of a collegiate body.”
In any case, and with this we begin to fully analyze the content of the allegation that
aims to conclude with the legality of the data processing involved in the recording of the audio of
certain sessions of the teaching department of [name of department], must
It means that although article 15 LRJSP, of a basic nature, establishes the obligation of
drawing up a minute of each session held by a collegiate body, article 18 of the
The aforementioned rule does not stipulate said obligation regarding the recording of such sessions by indicating
simply that “they may be recorded”, also optionally admitting that the
file resulting from the recording, along with the certification issued by the Secretary of the
Resolution (File RCO-2020/088)
Page 28 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.esauthenticity and integrity thereof, accompany the minutes of the sessions, without the need to
record the main points of the deliberations.
Consequently, we are not in the situation that concerns us before a treatment of
data that is necessary for compliance with a legal obligation applicable to the person responsible
of the treatment that could determine its legality in accordance with the provisions of article 6.1.e)
RGPD, since, as just noted, the law provides for the possibility of recording sessions
but it does not impose it, so a favorable decision in this regard should be adopted,
like any other collegiate agreement, by majority vote of the corresponding body
(article 17.5 LRJSP) or be incorporated, where appropriate, in the internal regime regulations of the
body, actions that, according to what was reported during the procedure, had not been
produced at the time of holding the department sessions during the months
of [mm] and [mm] of 2020.
Nor can data processing be covered in the case of article 6.1.e) of the
RGPD regarding the fulfillment of a mission carried out in the public interest or in the exercise of
public powers conferred on the data controller. The powers in the field of
educational public service attributed to the didactic coordination departments
require the recording of the sessions for their exercise, which could constitute at least
I add an “additional guarantee” in the expression of the claimed party, in such a way that, as
indicates the Spanish Data Protection Agency in its report 2018-0175 “if a certain
treatment is not 'necessary' for the fulfillment of the mission carried out in the public interest or in the
exercise of public powers conferred by the ordinance, such treatment would not only lack
sufficient legitimizing legal basis provided for in section e), but would also infringe the
principle of data minimization contained in article 5.1. c) of the RGPD…”.
Regarding the review that appears in the allegations about the pandemic framework in which
the actions took place and the mention of the instructions of the Vice-Ministry of
Education and Sports, related to the organization of educational centers motivated by the crisis
health of COVID-19, it should be noted on the one hand that they do not contemplate the
requirement to record sessions, and, on the other hand, which is not discussed in this procedure
the opportunity or convenience of holding meetings via videoconference,
Resolution (File RCO-2020/088)
Page 29 of 34 Document suitable for publication on the Portal of the Cwww.ctpdandalucia.essino the adequacy and compliance of the treatment inherent to the recording of the same to the
data protection regulations.
Finally, it must be clarified about the purpose that the document of allegations attributes to the
recording of the sessions, consisting of exclusive consultation of the matters incorporated in
the agenda of the meetings, that the information that the member or member of a
body that acts in a collegiate manner must have at its disposal is guaranteed by the
right to have the minutes sent to them through electronic means so that they can
express by the same means their agreement or objections to the text for the purposes of its
approval (article 18.2 LRJSP).
Consequently, from all of the above it is evident that the claimed entity has carried out a
illicit processing of personal data, consisting of audio recording of the sessions of the
Teaching department of [name of department] corresponding to the months of [mm] and
[mm] of 2020, by not complying with the aforementioned treatment with any of the conditions established in
article 6.1 GDPR.
On the other hand, regarding the allegation regarding the duty of information to people
members of the department about the recording of a certain session, there is
accredited, as the members of the department themselves have certified, that the body
claimed before the telematic session held on [dd/mm/yy], informed them that the aforementioned
session and the subsequent ones were going to be recorded. Notwithstanding the above, you must specify this
body that, based on the data in the file, it has been verified that the body
claimed since [dd/mm/yy] audio recorded meetings of the Department of [name of
department], however, the testimonial statements provided correspond to the
[dd/mm/yy]; It is then evident that there were meetings held in [dd/mm/yy] and
[dd/mm/yy], of which there is no evidence that it was reported that these were going to be
recorded.
On the other hand, this Council must point out that at the meeting held on [dd/mm/yy],
informed those attending the meeting of the identity and address of the person responsible for the treatment,
as well as the purpose for which the personal data were going to be processed but not the rest of the
the extremes required by article 13 RGPD, including those related to the time of
Resolution (File RCO-2020/088)
Page 30 of 34 Document suitable to be published on the Portal of www.ctpdandalucia.esconservation thereof, who is responsible for its deletion or if it is going to be
automate. Nor has it been accredited, despite having been required by this
Council, that the Institute inform the professors attending the
the recorded sessions of all the requirements demanded by article 13 GDPR on the
processing of your personal data.
Finally, regarding the classification of the infraction, the body complained of understands that,
difference from what is indicated in the Startup Agreement, the infringement due to the lack of the duty to
information required in article 13 RGPD, by virtue of article 74.a) LOPDGDD, must be
consider mild and not very serious (article 72.1.h LOPDGDD), however, as has already been pointed out
previously this organism, at least from [dd/mm/yy] to [dd/mm/yy] has not been
proven that the claimed body reported on any of the requirements demanded by the
Article 13 GDPR, so the classification of the infraction must be maintained.
In accordance with all the above, this Council understands that the allegations presented are not
distort the essential content of the infringement that is declared committed nor do they constitute cause for
sufficient justification or exculpation.
Fifth. Failure to comply with "the basic principles for treatment, including the conditions
for consent under articles 5, 6, 7 and 9" of the GDPR is considered an infringement
to the personal data protection regulations in article 83.5.a) RGPD; the facts
attributable to the claimed body are also considered, for the purposes of prescription,
as a very serious violation in article 72.1.b) LOPDGDD:
“b) The processing of personal data without any of the conditions of legality of the
treatment established in article 6 of Regulation (EU) 2016/679”.
On the other hand, failure to comply with "the rights of the interested parties under articles 12 to
22" of the RGPD is considered a violation of personal data protection regulations
in article 83.5.b) RGPD; the facts attributable to the claimed body are equally
considered, for the purposes of prescription, as a very serious infraction in article 72.1.h)
LOPDGDD:
Resolution (File RCO-2020/088)
Page 31 of 34 Document suitable for publication on the Portal www.ctpdandalucia.es "h) The omission of the duty to inform the affected party about the processing of their data
personal in accordance with the provisions of articles 13 and 14 of Regulation (EU) 2016/679 and
12 of this organic law".
In the present case, the offending circumstances provided for in articles 83.5.a) and
83.5.b) RGPD transcribed.
Sixth. Article 58.2 GDPR provides that:
“Each supervisory authority will have all of the following corrective powers indicated
next:
[...]
b) send a warning to any person responsible or in charge of processing when the
processing operations have infringed the provisions of this Regulation;
[...]
d) order the person responsible or in charge of the treatment that the treatment operations
comply with the provisions of this Regulation, where applicable, in a manner
certain way and within a specified period;
[…]”.
On the other hand, article 77 LOPDGDD establishes the sanctioning regime applicable to
certain categories of data controllers or processors; in particular, in his
section 1.d) includes "Public bodies and public law entities linked or
dependent on Public Administrations.” In the aforementioned article, in section 2, it is
notes that:
"When those responsible or in charge listed in section 1 commit any of
the infractions referred to in articles 72 to 74 of this organic law, the authority
of data protection that is competent will issue a resolution sanctioning them.
with warning. The resolution will also establish the measures to be adopted
so that the conduct ceases or the effects of the infraction that has been committed are corrected."
Thus, in accordance with article 77.2 LOPDGDD, the sanction that must be imposed on the person responsible
of treatment is warning.
Resolution (File RCO-2020/088)
Page 32 of 34 Document suitable for publication on the Con Portalwww.ctpdandalucia.esAs an additional measure, the [educational center] is urged to inform the members of the
Department of [name of department], of all the extremes required by article 13
GDPR, within one month.
Seventh. In relation to the notification of the resolution of the sanctioning procedure, the
Article 77.2 LOPDGDD provides that "[t]he resolution will be notified to the person responsible or in charge of the
treatment, to the body on which it depends hierarchically, if applicable, and to those affected who had
the status of interested party, if applicable".
Furthermore, article 77.4 LOPDGDD states that "[t]he
data protection the resolutions that fall in relation to the measures and actions to which
the previous sections refer to", and 77.56 LOPDGDD, which "[s]hall be communicated to the Ombudsman of the
People or, where appropriate, to the analogous institutions of the autonomous communities the actions
carried out and the resolutions issued under this article".
Eighth. Presidential Decree 10/2022, of July 25, on restructuring of
Ministries, modified by Presidential Decree 13/2022, of August 8, creates the
Ministry of Educational Development and Vocational Training, to which they correspond, according to the
Article 4 of the aforementioned standard, “the powers currently attributed to the
Ministry of Education and Sports, except for competitions in sports.”
By virtue of all the above and in accordance with the applicable legislation, the Director of the Council
of Transparency and Data Protection of Andalusia
SOLVE
First. Send a WARNING to the [educational center (Department of Educational Development and
Vocational Training), with NIF S4111001F, for violations of articles 6 and 13 RGPD,
typified in articles 83.5.a) and 83.5.b) RGPD.
Second. As an additional measure, urge the [educational center, that within one month from
Resolution (File RCO-2020/088)
Page 33 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.es the notification of this resolution, the members of the Department of
[department name] of all the extremes required by article 13 GDPR. Of the
Actions carried out must be reported to the Council within the same period.
Third. That this resolution be notified to the offending body.
Room. That this resolution be communicated to the Andalusian Ombudsman,
in accordance with the provisions of article 77.5 LOPDGDD.
In accordance with the provisions of article 50 LOPDGDD, this Resolution will be made
public, dissociating the corresponding data, once it has been notified to the
interested.
Against this Resolution, which puts an end to the administrative route, an appeal can be filed
optional replacement before this Council, within a period of one month, or directly file
contentious-administrative appeal before the Contentious-Administrative Jurisdiction within the term
of two months, in both cases counting from the day following the day of its notification,
in accordance with the provisions of articles 30.4, 123 and 124 of Law 39/2015, of 1
October, of the Common Administrative Procedure of Public Administrations and in the
articles 8.3, 14.1 and 46.1 of Law 29/1998, of July 13, regulating the Jurisdiction
Contentious-administrative.
In accordance with the provisions of art. 90.3.a) LPACAP, the
firm resolution through administrative channels if the interested party expresses before this Council his
intention to file a contentious-administrative appeal and transfers to it, once
filed, the documentation that proves its presentation. If the Council did not have
knowledge of the filing of the contentious-administrative appeal within the period
corresponding or in said appeal the precautionary suspension of the resolution is not requested,
would end the aforementioned suspension.
THE DIRECTOR OF THE TRANSPARENCY COUNCIL
AND DATA PROTECTION OF ANDALUSIA
Jesus Jimenez Lopez
Resolution (File RCO-2020/088)
Page 34 of 34 Document suitable for publication on the Portal of www.ctpdandalucia.es
