AEPD (Spain) - EXP202100300
From GDPRhub
| AEPD (Spain) - TD-00245-2021 - R/00824/2021 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 16 GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | |
| Published: | 18.11.2021 |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | TD-00245-2021 - R/00824/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | Carmen Villarroel |
The Spanish DPA established that the parameters of a productivity calculation is not personal data and is therefore not subject to the right to rectification.
English Summary
Facts
A worker of a University filed a complaint against their employer with the Spanish DPA (AEPD). The data subject claimed that the controller had not answered a rectification request from Article 16 GDPR.
The data subject wanted the employer to rectify a productivity record deriving from the Pegasus application, alleging that the result was not adequate. This application took into account the degree of satisfaction of the users (foreseeably students). The worker alleged that the coefficients used by the formula that calculated the productivity were not disclosed, which led to a lack of transparency. Additionally, the worker alleged that the process was not objective, impartial and was discriminatory. The worker further argued that productivity must be considered personal data.
Holding
The AEPD, however, dissented and stated that what the data subject asked for was not included within the framework of data protection.
Therefore, Article 16 GDPR cannot be applied. Article 16 refers to inaccurate personal data, not to the rectification of processes within the workplace.
The AEPD stated that it is not within their functions to rectify parameters that may affect the economic outcome or performance of individuals, regardless the data subjects consider the formula is accurate, since they affect various individuals and are therefore not considered personal data.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/5
File No.: EXP202100300
RESOLUTION NO: R / 00824/2021
Considering the claim made on June 17, 2021 before this Agency by A.A.A. , (to
from now on the complaining party), against UNIVERSITAT POLITÈCNICA DE
VALÈNCIA, (from now on the claimed party), for not having been duly
your right to rectification has been taken care of.
The procedural actions provided for in Title VIII of the Law have been carried out.
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD), the following have been verified
FACTS
FIRST: The claimant exercised the right of rectification against the claimed with NIF
Q4618002B, without your request having received the legally established reply.
The complaining party provides various documentation related to the claim made
before this Agency and on the exercise of the right exercised.
SECOND: In accordance with article 65.4 of the LOPDGDD, which has provided for a
mechanism prior to the admission for processing of claims made before
the AEPD, consisting of transferring them to the Data Protection Delegates
designated by those responsible or in charge of the treatment, for the intended purposes
in article 37 of the aforementioned norm, or to these when they have not been designated,
transferred the claim to the claimed entity to proceed with its
analysis and respond to the complaining party and to this Agency within a period of
month.
The complained party considered that the
claims of the claimant since it does not consider it data protection.
THIRD: The result of the transfer procedure indicated in the previous Fact does not
allowed to understand satisfied the claims of the complaining party. On
Consequently, dated August 19, 2021, for the purposes provided in its article
64.2 of the LOPDGDD, the Director of the Spanish Agency for Data Protection
agreed to admit the submitted claim for processing and the parties were informed that the
maximum period to resolve this procedure, which is understood to have started
by means of said agreement of admission to processing, it will be of six months.
The aforementioned agreement granted the claimed entity a hearing procedure, to
that within a period of fifteen business days it present the allegations it deems
convenient. Said entity made, in summary, the following allegations:
That the requests presented by the claimant were dealt with in a timely manner.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/5
That said requests do not constitute any of the rights recognized in the Law
of Data Protection. Request the rectification of some mechanisms or modes, of the
process by which you obtain labor productivity.
That one of the requests is the modification of the evaluation system.
That at no time is article 22 infringed as mentioned by the claimant.
FOURTH: After examining the allegations presented by the defendant, they are the subject of
transfer to the complaining party, so that, within fifteen business days, it can formulate
allegations that it deems appropriate.
The complaining party in summary states:
That this claim is filed individually.
That the system used to calculate employee productivity (PEGASUS),
it is not suitable.
“… In no case can it be deduced from a low user satisfaction,
expressed
in the PEGASUS surveys, that the employee has not performed well
their duties, did not perform the work properly or did not
increased their productivity or improved their performance ... "
That there is no transparency because the coefficients used in the
productivity formula.
The complainant speaks of the lack of objectivity, impartiality and discrimination in
the application of productivity.
It ends, after a detailed account regarding the application of this model to
calculate productivity and its impact on workers by saying:
"... For all this, this data is being miscalculated and given that it is a
personal data, workers' rights would be violated, for
which the UPV must review completely with the utmost diligence ... "
FOUNDATIONS OF LAW
FIRST: The Director of the Spanish Agency for
Data Protection, in accordance with the provisions of section 2 of article 56 in
in relation to paragraph 1 f) of article 57, both of Regulation (EU) 2016/679 of the
European Parliament and of the Council of April 27, 2016 on the protection of
natural persons with regard to the processing of personal data and the free
circulation of these data (hereinafter, GDPR); and in article 47 of the LOPDGDD.
SECOND: In accordance with the provisions of article 55 of the RGPD, the Agency
Spanish Data Protection is competent to perform the functions that
are assigned to it in its article 57, among them, that of enforcing the Regulation and
promote the awareness of those responsible and those in charge of the treatment
about their obligations, as well as dealing with claims
submitted by an interested party and investigate the reason for them.
Correlatively, article 31 of the RGPD establishes the obligation of those responsible
and those in charge of the treatment to cooperate with the control authority that requests it in
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/5
the performance of their duties. In the event that they have designated a
data protection officer, article 39 of the RGPD attributes to him the function of
cooperate with said authority.
Similarly, the domestic legal system, in article 65.4 of the LOPDGDD, has
Provided a mechanism prior to the admission for processing of the claims that are
made before the Spanish Agency for Data Protection, which consists of giving
transfer of the same to the data protection delegates designated by the
responsible or in charge of the treatment, for the purposes provided in article 37 of
the aforementioned norm, or to them when they have not designated them, to proceed to the
analysis of said claims and to respond to them within a month.
In accordance with these regulations, prior to the admission for processing of the
claim that gives rise to the present procedure, it was transferred to the
responsible entity to proceed with its analysis, provide a response to this Agency
within a month and certify having provided the claimant with the proper response,
in the event of exercise of the rights regulated in articles 15 to 22 of the
GDPR.
The result of said transfer did not allow for the satisfaction of the claims of the
complaining party. Consequently, dated August 19, 2021, for the purposes
provided for in article 64.2 of the LOPDGDD, the Director of the Spanish Agency for
Data Protection agreed to admit the submitted claim for processing. Saying
The agreement of admission for processing determines the opening of the present
lack of attention to a request to exercise the rights established in the
Articles 15 to 22 of the RGPD, regulated in article 64.1 of the LOPDGDD, according to the
which:
"1. When the procedure refers exclusively to the lack of attention of a
request to exercise the rights established in articles 15 to 22 of the
Regulation (EU) 2016/679, will start by agreement of admission for processing, which will be
adopt in accordance with the provisions of the following article.
In this case, the term to resolve the procedure will be six months from
from the date the claimant was notified of the admission agreement to
Procedure. After this period, the interested party may consider their
claim".
The purging of administrative responsibilities in the framework of the
of a sanctioning procedure, whose exceptional nature implies that it is chosen,
whenever possible, due to the prevalence of alternative mechanisms that have
protection in current regulations.
It is the exclusive competence of this Agency to assess whether there are responsibilities
administrative procedures that must be purged in a sanctioning procedure and, in
Consequently, the decision on its opening, there being no obligation to initiate a
procedure before any request made by a third party. Such a decision must
be based on the existence of elements that justify said start of the activity
sanctioning, circumstances that do not concur in the present case, considering that
with this procedure, the guarantees and
Claimant's rights.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/5
THIRD: The rights of people in terms of data protection
Personal data are regulated in articles 15 to 22 of the RGPD and 13 to 18 of the
LOPDGDD. The rights of access, rectification, deletion,
opposition, right to limitation of treatment and right to portability.
The formal aspects related to the exercise of these rights are established in the
Articles 12 of the RGPD and 12 of the LOPDGDD.
It also takes into account what is expressed in Considering paragraphs 59 and following of the
GDPR.
In accordance with the provisions of these rules, the person responsible for the treatment
should arbitrate formulas and mechanisms to facilitate the interested party the exercise of their
rights, which will be free (without prejudice to the provisions of articles 12.5 and 15.3
of the RGPD), and is obliged to respond to requests made no later than a
month, unless you can show that you are unable to identify the
interested party, and to express their reasons in case they were not to attend said
application. The person responsible is responsible for the proof of compliance with the duty of
Respond to the request for the exercise of their rights made by the affected party.
The communication addressed to the interested party on the occasion of their request must
express themselves in a concise, transparent, intelligible and easily accessible way, with a
clear and simple language.
FOURTH: Article 16 of the RGPD, which regulates the right to rectify data
inaccurate personal statements, states the following:
"The interested party shall have the right to obtain without undue delay from the person responsible for the
treatment the rectification of inaccurate personal data that concerns you.
Taking into account the purposes of the treatment, the interested party will have the right to be
complete incomplete personal data, including through a
additional statement. "
FIFTH: In the case analyzed here, the complaining party exercised its right to
rectification arguing that the way of calculating productivity should be rectified
because it was, among other things, discriminatory.
In response to this request, the respondent party replied to the claimant saying that
what he requested was not included in the data protection regulations.
We will start by saying that the complaining party requests the right to rectification and
This claim will be limited solely and exclusively to this requested right.
As stated in article 16 of the RGPD, previously transcribed, the right of rectification
refers to inaccurate personal data not to the rectification of established processes
in a workplace. The claimant may not agree with the formula
applied but, it is not the function of this Agency to rectify established parameters that
affect the financial results of several people and, that cannot be
consider at no time a personal and individual data.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/5
Based on the foregoing, considering that the present procedure is intended to
object that the guarantees and rights of those affected are duly
restored, and given that a reasoned denial was answered, the claim
it is dismissive.
Considering the cited precepts and others of general application,
the Director of the Spanish Data Protection Agency RESOLVES:
FIRST: DISMISS the claim made by A.A.A. versus
UNIVERSITAT POLITÈCNICA DE VALÈNCIA.
SECOND: NOTIFY this resolution to A.A.A. and UNIVERSITAT
POLITÈCNICA DE VALÈNCIA.
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to
counting from the day after the notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.
1191-150321
Mar Spain Martí
Director of the Spanish Agency for Data Protection
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
