IP - 07121-1/2020/1043
From GDPRhub
| IP - 07121-1/2020/1043 | |
|---|---|
 | |
| Authority: | IP (Slovenia) |
| Jurisdiction: | Slovenia |
| Relevant Law: | Article 4(1) GDPR Article 6 GDPR |
| Type: | Advisory Opinion |
| Outcome: | n/a |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | 07121-1/2020/1043 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Slovenian |
| Original Source: | Informacijska Pooblaščenka (in SL) |
| Initial Contributor: | n/a |
The Slovenian DPA (IP) gave a non-binding opinion the question of a municipal council disclosing data subjects' handwritten signatures to a third party.
English Summary
Facts
A group of villagers addressed an objection to the local municipal council against the sale of some municipal land. When requested, the council refused to reveal the identities of the villagers and their signatures submitted with the objection.
Dispute
Are handwritten signatures personal data within the meaning of Article 4(1) GDPR? Is there a legal basis under Article 6 GDPR that would justify the disclosure of the signatures (and thus the identity) of the villages objecting to the sale of land to a third party?
Holding
In its Opinion, the IP affirmed that handwritten signatures are personal data, stating that "if an individual is identified or identifiable by his / her signature, it is definitely his / her personal data".
Regarding the legal basis question, the IP stated it was for the municipality as the controller to identity the appropriate legal basis for processing under Article 6, providing a legal basis applies in this case. However, the IP stated that it had insufficient facts to comment on the permissibility of processing this data any further.
Comment
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.
Date: 10.06.2020
Title: Disclosure of the identity of the complainants in the process of selling municipal land
Number: 07121-1 / 2020/1043
Subject matter: Municipalities, Legal basis, Obtaining OPs from collections
Legal act: Opinion
The Information Commissioner (hereinafter IP) received your letter by e-mail, in which you explain that a group of villagers addressed an objection to the municipality against the sale of municipal land, and the municipality does not want to reveal the identity of the villagers or their signatures. You have been sent an objection with deleted names, but you do not agree. You are asking us for our opinion on whether the handwritten signatures of the alleged group of villagers are really subject to personal data protection, or whether this is not the case, as they are not EMŠO numbers, residence addresses and other personal data.
On the basis of the information you have provided to us, hereinafter referred to as Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data Directive 95/46 / EC (hereinafter: the General Regulation), point 7 of the first paragraph of Article 49 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 94/07, official consolidated text, hereinafter ZVOP-1) and 2 Article of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, No. 113/05, hereinafter ZInfP), we provide our non-binding opinion regarding your question. At the same time, IP emphasizes that it cannot assess specific processing of personal data outside the inspection procedure.
We would like to explain to you at the outset that, in accordance with Article 4 (1) of the General Data Protection Regulation, the handwritten signatures of individuals are in any case personal data when it comes to information relating to an identified or identifiable individual; an identifiable individual is one who can be identified directly or indirectly, in particular by indicating an identifier such as name, identification number, location data, web identifier, or by indicating one or more factors specific to the physical, physiological, genetic , the mental, economic, cultural or social identity of that individual. This is true regardless of what you state in your message that it is not about EMŠO, information about the address of residence, etc. If an individual is identified or identifiable by his / her signature, it is definitely his / her personal data.
Furthermore, the question arises whether the municipality has a legal basis to disclose to you the signatures (and thus the identity) of individuals who have filed an objection against the sale of municipal land. The legal bases governing the lawful processing of personal data are set out in Article 6 of the General Regulation and are as follows:
the data subject has consented to the processing of his or her personal data for one or more specific purposes;
processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of measures at the request of such an individual before the conclusion of the contract;
processing is necessary to fulfill the legal obligation applicable to the controller;
processing is necessary to protect the vital interests of the data subject or other natural persons;
processing is necessary for the performance of a task in the public interest or in the exercise of public authority conferred on the controller;
processing is necessary for legitimate interests pursued by the controller or a third party, except where such interests are outweighed by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data, in particular where the data subject personal data relating to the child.
The controller of personal data (in your case the municipality) is the one who must identify the appropriate legal basis (if it exists) and is responsible if it processes (in this case transmits or discloses) the data of persons without a legal basis. Also important in your case is the question of the purpose of personal data processing, ie for what purposes you want to get acquainted with the above signatures. However, care must always be taken to respect the basic principles of personal data protection, such as:
purpose limitation principle: personal data must be collected for specified, explicit and lawful purposes and may not be further processed in a way incompatible with those purposes;
the principle of minimum data or the principle of proportionality: personal data must be relevant, relevant and limited to what is necessary for the purposes for which they are processed.
IP emphasizes that it cannot assess the specific processing of personal data outside the inspection procedure, so we certainly cannot comment on the question of whether the municipality may provide you with the desired signatures of individuals or not. The reason for this is, among other things, that we do not have all the relevant documentation, circumstances and legal bases of a specific case, which could lead to a completely wrong position. The assessment of the legality of individual processing or compliance with the implementation of legislation in the field of personal data protection is performed in the inspection procedure, in which all safeguards and procedural rights of the participants in the procedure are also provided. The non-binding opinions of the IP are therefore not intended to assess the legality of individual processing and actions of specific controllers, but to provide principled and general views on the interpretation of the provisions of laws relating to the protection of personal data.
As stated, IP does not know all the details of the case, including whether there is any (procedural) legislation under which they would have the right to obtain personal data of objectors in the process of selling municipal land. If such legislation exists (perhaps environmental, administrative-procedural, etc.), the municipality would also have an appropriate legal basis for the processing (ie transmission) of personal data.
Best regards.
Mojca Prelesnik, B.Sc.
Information Commissioner
Prepared by:
mag. Polona Merc, Univ. dipl. right,
IP data protection consultant
