AEPD (Spain) - TD/00318/2019
From GDPRhub
| AEPD - TD/00318/2019 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 12 GDPR Article 15 GDPR LOPDGDD Article 13 LOPDGDD Article 64(1) |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | n/a |
| Published: | 7. 2. 2020 |
| Fine: | n/a |
| Parties: | Anonymous Vs. Directorate General of the Police |
| National Case Number/Name: | TD/00318/2019 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | n/a |
The AEPD found that the Directorate General of the Police failed to comply with their duties under GDPR by requiring a legitimate interest for granting an access request, and by not responding to an access request, thus denying the data subject its rights. The AEPD did not comment on the merit of the request itself.
English Summary
Facts
The data subject requested access to photographs and fingerprints. A total of seven request were sent, none of them including the information requested, thus being incomplete. The last request was not answered. The Directorate General of the Police did not reply when the AEPD sent the claim to them. As such, the complaint was decided on the basis of the claim and documentation provided by the complainant.
Holding
The AEPD instructed the Directorate General of the Police to respond to the access request within ten days following the notification of the decision. The AEPD noted that a failure to comply within ten days would be considered a violation pursuant to Article 72(1)(m) of the LOPDGDD, which would be sanctioned according to Article 58(2) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the **Spanish** original. Please refer to the **Spanish** original for more details.
• File Nº: TD / 00318/2019 1037-100919 RESOLUTION Nº: R / 00062/2020 Having regard to the claim made on June 9, 2019 before this Agency by D. AAA , against DIRECTORATE GENERAL OF THE POLICE, for not having been duly attended to your right of access. Performed the procedural actions provided for in Title VIII of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD), the following have been found ACTS FIRST: D. AAA (hereinafter, the complaining party) exercised the right of access in front of the POLICE GENERAL DIRECTORATE with NIF S2816015H (hereinafter, the claimed one), without your request having received the answer legally established. The complaining party provides various documentation related to the claim raised before this Agency and on the exercise of the right exercised and notes that, the The subject of the complaint is due to incomplete responses to repeated requests of access to personal data addressed to the claimed: The complaining party requests access to photographs and fingerprints of their person stored, as directed by the Local Police Brigade Scientist at the *** LOCALITY Police Station.1 , in the file PERPOL / PEOPLE, and referred to a police action. In each of the seven access requests submitted it has gone offering more information, but none of them has been granted access to these photographs and fingerprints. The last of the seven requests has not been answered, and the previous one was denied, in the absence of crediting a legitimate interest for that purpose, for having exercised the right in the previous twelve months. The complaining party emphasizes photographs and fingerprints or reviews. other type, without obtaining the mentioned information in any of the answers. SECOND : In accordance with the functions provided for in Regulation (EU) 2016/679, of April 27, 2016, General of Data Protection (GDPR), particularly those that respond to the principles of transparency and accountability proactive by the person responsible for the treatment, you have been required to inform 2/7 this Agency of the actions that have been carried out to address the claim raised. Without receiving an answer: On July 24, 2019, this Agency through the Service Support of Electronic Notifications and Enabled Address (Notified @ platform), made available to the complainant the claim presented by the party claimant, so that they proceed to their analysis and respond to the claiming party This Agency is already available within one month, as well as the relevant documentation vacancy related to the procedures carried out to facilitate the right exercised or motivated denial. And on August 4, 2019 the Notify @ system proceeds to rejection Automatic notification for ten calendar days after the provision of the notification without accessing its content. Since the aforementioned notification was not accessed, exceptionally, It was sent by mail, which was received on 09/10/2019, without have received written in this Agency allegations. THIRD: On October 16, 2019, in accordance with article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights and for the purposes set forth in article 64.2, the Director of the Spanish Agency for Data Protection agreed to admit the claim submitted by the complaining party against the claimed and agreed to give transfer of the claim, so that within fifteen business days submit the allegations it deems appropriate and the parties are informed that the maximum for Solve the procedure will be six months, without receiving an answer: On November 12, 2019, this Agency through the Support of the Electronic Notification Service and Enabled Address (platform Notified), proceeded to transfer the facts object of the claim, so that Within fifteen business days, submit the allegations you consider convenient. And on November 23, 2019 the Notify @ system proceeds to rejection Automatic notification for ten calendar days after the provision of the notification without accessing its content. Since the aforementioned notification was not accessed, it was sent by postal mail, which was received on December 4, 2019, without having received in This Agency written allegations. RIGHTS OF LAW FIRST: It is competent to resolve the Director of the Spanish Agency of Data Protection, in accordance with the provisions of section 2 of article 56 in in relation to Article 57 (1) f), both of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and free circulation of this data (hereinafter GDPR); and in article 47 of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). SECOND: Article 64.1 of the LOPDGDD provides the following: "one. When the procedure refers exclusively to the lack of attention of a request to exercise the rights established in articles 15 to 22 of the Regulation (EU) 2016/679, will be initiated by an admission agreement for processing, which will be shall adopt in accordance with the provisions of the following article. In this case, the period to resolve the procedure will be six months to count. from the date the claimant agreement had been notified admission to process. After this period, the interested party may consider Dear your claim. ” THIRD: Article 12 of Regulation (EU) 2016/679 of April 27, 2016, General Data Protection (GDPR), provides that: "one. The person responsible for the treatment will take appropriate measures to facilitate to the interested party all information indicated in articles 13 and 14, as well as any communication under articles 15 to 22 and 34 regarding treatment, in the form concise, transparent, intelligible and easily accessible, with clear and simple language, in particular any information specifically directed to a child. Information will be provided in writing or by other means, including, if appropriate, by means electronic When requested by the interested party, the information may be provided verbally whenever the identity of the interested party is demonstrated by other means. 2. The person responsible for the processing will facilitate the interested party the exercise of their rights under articles 15 to 22. In the cases referred to in article 11, section 2, the person in charge will not refuse to act at the request of the interested party for the purpose to exercise your rights under articles 15 to 22, unless you can prove that is not in a position to identify the interested party. 3. The data controller will provide the interested party with information regarding their actions based on an application under articles 15 to 22, and, in In any case, within one month of receiving the request. Saying term may be extended another two months if necessary, taking into account the complexity and the number of requests. The person responsible will inform the interested party of any of said extensions within one month of receipt of the request, indicating the reasons for the delay. When the interested party presents the request by electronic means, the information will be provided electronically when possible, unless the interested party requests that it be provided otherwise. 4. If the person responsible for the treatment does not process the request of the interested party, will inform without delay, and at the latest one month after receiving the request, the reasons for its non-performance and the possibility of presenting a claim before a supervisory authority and to bring legal actions. 5. The information provided under articles 13 and 14 as well as all communication and any action carried out under articles 15 to 22 and 34 They will be free of charge. When the requests are manifestly unfounded or excessive, especially due to its repetitive nature, the person in charge of Treatment may: a) charge a reasonable fee based on the administrative costs incurred to facilitate the information or communication or perform the requested action, or b) refuse to act on the request. The person responsible for the treatment will bear the burden of demonstrating the character manifestly unfounded or excessive request. 6. Without prejudice to the provisions of article 11, when the person responsible for treatment have reasonable doubts regarding the identity of the natural person When the application referred to in articles 15 to 21 is submitted, you may request that provide the additional information necessary to confirm the identity of the interested party. 7. Information to be provided to interested parties under the articles 13 and 14 may be transmitted in combination with standardized icons that allow provide an easily visible, intelligible and clearly readable form an adequate overview of the planned treatment. The icons presented in format electronic will be readable mechanically. 8. The Commission shall be empowered to adopt delegated acts in accordance with Article 92 in order to specify the information to be submitted through icons and procedures to provide standardized icons. ” FOURTH: Article 15 of the GDPR provides that: "one. The interested party will have the right to obtain from the controller confirmation of whether or not personal data concerning you is being processed and, in such case, right of access to personal data and the following information: a) the purposes of the treatment; b) the categories of personal data in question; c) recipients or categories of recipients to whom they communicated or personal data will be communicated, in particular recipients in third parties or international organizations; d) if possible, the expected term of conservation of personal data or, of if not possible, the criteria used to determine this term; e) the existence of the right to request rectification or deletion from the responsible party of personal data or the limitation of the processing of personal data related to interested, or oppose such treatment; f) the right to file a claim with a supervisory authority; g) when personal data has not been obtained from the interested party, any information available on its origin; h) the existence of automated decisions, including profiling, to referred to in article 22, paragraphs 1 and 4, and, at least in such cases, information significant on the logic applied, as well as the importance and consequences provided for said treatment for the interested party. 2. When personal data is transferred to a third country or to an organization international, the interested party will have the right to be informed of the guarantees appropriate under article 46 regarding the transfer. 3. The controller will provide a copy of the personal data object of treatment The person in charge may receive for any other requested copy for the interested party a reasonable fee based on administrative costs. When he interested submit the application electronically, and unless it requests otherwise provided, the information will be provided in an electronic format of Common use. 4. The right to obtain a copy mentioned in section 3 shall not affect negatively to the rights and freedoms of others. ” FIFTH: Article 13 of the LOPDGDD determines the following: "one. The access right of the affected party will be exercised in accordance with the provisions in Article 15 of Regulation (EU) 2016/679. When the person responsible processes a large amount of data related to the affected party and this exercises your right of access without specifying whether it refers to all or a party of the data, the person in charge may request, before providing the information, that the affected specify the data or treatment activities to which the request. 2. The right of access shall be deemed granted if the person responsible for the treatment provide the affected with a remote, direct and secure data access system personnel that permanently guarantee access to its entirety. To such effects, the communication by the person responsible to the affected one of the way in which this may access to this system will be enough to consider the request to exercise the right. However, the interested party may request information from the person responsible for the extremes provided for in Article 15.1 of Regulation (EU) 2016/679 that are not included in the remote access system. 3. For the purposes set out in Article 12.5 of Regulation (EU) 2016/679, may consider the exercise of the right of access repetitive on more than one occasion for a period of six months, unless there is legitimate cause for it. 4. When the affected person chooses a different means than the one offered to him that supposes a disproportionate cost, the request will be considered excessive, so that Affected will assume the excess costs that your choice involves. In this case, just the satisfaction of the right of access without the undue delay. ” SIXTH: Before entering the merits of the issues raised, it should be noted that the present procedure is instructed as a result of the denial of any of the rights regulated by the data protection regulations (access, rectification, deletion, limitation, portability and opposition) and is intended to be adopt the corresponding measures so that the guarantees and rights of the affected party are properly restored. Therefore, in the present case, they will only be analyzed and assessed those issues raised by the complaining party that remain included within the object of the aforementioned claims procedure regarding Data Protection. In addition, the right of access, in particular, offers the possibility of obtaining a copy of the personal data that concerns you and that are being subject to treatment, as well as information, in particular, about the purposes of the treatment, data categories, recipients, the expected period of conservation, the possibility to exercise other rights, the information available on the origin of the data (if these have not been obtained directly from the complaining party) or the existence of automated decisions, including profiling. That said, in the case analyzed here, the complaining party exercised in repeatedly his right of access, and that, after the deadline In accordance with the rules mentioned above, your request did not get the answer legally enforceable, given that of the documentation provided by the complaining party, it follows that, the access granted is incomplete, as the photographs and fingerprints or motivated denial. This circumstance has not been refuted by the claim and although this Agency transferred the claim filed in the manner provided for in paragraph 1 of article 39 of the GDPR, by means of writings through the Service Support of Electronic Notifications and E-mail Address Enabled and by postal mail, exceeded, in excess of the period indicated without receiving an answer; therefore, it must be taken for not fulfilling the requirement, estimating, consequently that the claimed opts for not objecting to the claim of the complaining party, so that this Agency proceeds to issue an opinion on the basis of the claim and documentation Attached by the complaining party. As for the substance, the request for access to personal data that is formulate obliges the person responsible for the treatment in question to give an express response, in In any case, using any means attesting to the duty of response, even in those cases in which it did not meet the requirements, in whose In case the recipient of this is also obliged to require the correction of the deficiencies observed or otherwise, motivate the refusal to address it. On the other hand, this Agency, in accordance with the functions provided in the Regulation (EU) 2016/679, of April 27, 2016, General of Data Protection (GDPR), particularly those that respond to respect, by the person responsible for treatment, of the principles of transparency and proactive responsibility, has been required to this, report the actions that have been carried out to attend the claim raised by the complaining party, without receiving a response from that institution Therefore, combining the information in the file with the regulations referred to in the preceding sections, it is appropriate to estimate the claim, at not record that the right of access exercised or its motivated refusal Having regard to the aforementioned precepts and others of general application, the Director of the Spanish Agency for Data Protection RESOLVES: FIRST: ESTIMATE the claim made by D. AAA and urge DIRECTORATE GENERAL OF THE POLICE with NIF S2816015H, so that, within ten days following the notification of this resolution, refer to the party complainant certification stating that he has fully attended the right of access exercised by the latter or denied motivatedly indicating the causes for which it is not appropriate to attend your request. The actions performed as Consequence of this Resolution must be communicated to this Agency at identical term. Failure to comply with this resolution could entail the commission of the violation considered in article 72.1.m) of the LOPDGDD, which will be sanctioned, of according to art. 58.2 of the GDPR.
