AEPD (Spain) - PS/00245/2019
| AEPD - PS-00245-2019 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(a) GDPR Article 9(1) GDPR Article 13 GDPR Article 83(5)(a) GDPR Article 83(5)(b) GDPR Article 77 LOPDDGG |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 29.10.2020 |
| Published: | |
| Fine: | None |
| Parties: | Departamento de Educación del Gobierno de Navarra |
| National Case Number/Name: | PS-00245-2019 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Spanish |
| Original Source: | AEDP (in ES) |
| Initial Contributor: | Francesc Julve Falcó |
The Spanish DPA has imposed three different warning sanctions on the Department of Education of the Government of Navarra for infringements of various articles of the GDPR on the processing of data from surveys answered by schoolchildren.
English Summary
Facts
On 25 February 2019, an individual filed a complaint with the AEDP against the Department of Education of the Government of Navarra regarding a survey conducted by his son in class, asking him about intimate, family, and personal issues.
The respondent stated that the purpose of the surveys was to guide and inform schools and families about the level of education acquired by the schoolchildren. Together with these surveys, context questionnaires were provided to obtain information on the socio-economic and cultural conditions of the schools in order to contextualize the results obtained.
The respondent also explained in detail the respective organic laws that justified the collection of these personal data of the students, in order to know better the conditions of the students. At the same time, it also described the security and confidentiality measures that were being followed to protect this information.
The Department of Education of the Government of Navarra replied to the decision to initiate the procedure, agreeing with the allegations of infringement of Articles 5(1)(a) GDPR and 13 GDPR. On the other hand, they disagreed with the infringement of Article 5(1)(a) GDPR in relation to Article 9(1) GDPR with regard to the question of the gender identity of pupils.
Dispute
Should government surveys of underage students do comply with the principles of transparency, lawfulness, and fairness, respecting Articles 5 (1) (a), 9 (1), and 13 GDPR?
Holding
The Spanish DPA confirmed that the defendant collected specific personal data that was not necessary for the purpose in question. Therefore, if they could have achieved the same purpose without processing those data, there is no legal basis for processing them.
Consequently, the infringement of Article 5(1)(a) GDPR in relation to Article 9(1) GDPR is established. Article 13 GDPR is also considered to have been infringed as regards the information to be provided when personal data are obtained from the data subject.
The Spanish legal system has chosen not to penalize public bodies with a fine, as indicated in Article 77(1)(c) LOPDDGG, and paragraphs 2, 4, 5, and 6 of the same article.
In view of the above, the Director of the Spanish Data Protection Agency decided to impose three different warning sanctions: one for infringement of Article 5(1)(a) GDPR, another for infringement of the same Article 5(1)(a) GDPR in relation to Article 9(1) GDPR, and a third warning sanction for infringement of Article 13 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
