AEPD (Spain) - PS/00012/2019
From GDPRhub
| AEPD (Spain) - PS/00012/2019 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(f) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 03.02.2020 |
| Fine: | None |
| Parties: | City Council of Vigo |
| National Case Number/Name: | PS/00012/2019 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | n/a |
The AEPD confirmed that publishing personal data in relation to public employment was a breach of the principle of integrity and confidentiality.
English Summary
Facts
Seven citizens submitted a complaint before the AEPD against the city council of Vigo for disclosing their personal data in relation to public employment.
Dispute
Does publishing the personal data regarding the eligibility of public employment of a data subject, on a public bulletin, constitute a breach of the GDPR when it is posted to fulfil the duty of transparency to public information?
Holding
After weighing national law regarding transparency of public information the AEDP found that the published information in question was not part of the information required to be published by law. As such,disclosing the personal data constituted a breach of the principle of integrity and confidentiality pursuant to Article 5(1)(f).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the original. Please refer to the Spanish original for more details.
Procedure No.: PS/00012/2019
938-051119
RESOLUTION OF SANCTIONING PROCEDURE
From the procedure instructed by the Spanish Data Protection Agency and based on the following
BACKGROUND
FIRST: A.A.A. and six other complainants listed in ANNEX 1 (hereinafter, the complainants) on 24/07/2018 filed a complaint with the Spanish Data Protection Agency against the CITY COUNCIL OF VIGO for displaying on its electronic headquarters, freely accessible to anyone, minutes of the Local Government Board dated XX/XX/XXXX and YY/YY/YYYY containing resolutions with personal data.
The publications refer in the section on "permanent but not fixed staff" to judicial decisions pending inclusion in public employment offers, with their full names.
It is also noted that the Administration did not inform them of the published file, and that on 12/04/2018, they requested access to the documentation of the related files, which was denied indicating that it falls within the scope of personal data, specifying that they filed an appeal for reconsideration which was dismissed, considering that "they have not been provided access to such files to ensure data protection."
It provides:
1) Copy of the minutes of the Local Government Board dated YY/YY/YYYY (pages 5 to 75 of their complaint which has 242 in an electronic PDF file). Among other things, the following personal data appear:
- identified as 9 (155) - Proposal of the Local Government Board, dismissing the appeal for reconsideration filed against the resolution of the local government board dated 28/12/2007 approving the Public Employment Offer for 2017, file ZZZZZ/220.
After presenting the background, it discusses the regularization of all indefinite labor staff contemplating in the employment offers of each year the necessary positions for this purpose. It mentions the personnel pending to be included in such employment offers, by name and surname and the Center where the creation of the position is proposed.
It refers to the publication in the Official Provincial Gazette of the offered positions (without personal data).
It mentions the people who file the appeal for reconsideration, 8 people identified by name and surname, assesses the allegations made and DISMISSES the claims of the appellants indicating that notification be given to the appellants among whom the complainants are listed.
- identified as 10 (156) same as the previous, referring to file RRRRR/220 (47 of 242) similar to the previous one.
2. Minutes of the Local Government Board dated XX/XX/XXXX (pages 76 et seq.) regarding the public employment offer for 2017, file TTTTT/220, include the name, surname, category, workplace, and date of employees who left in 2016, including police, due to absolute disability or voluntary or compulsory retirement. There is also a list of indefinite but non-permanent staff, page 125 - which coincides with that of the minutes identified as 9 (155) - with judicial decisions pending inclusion in the Public Employment Offers, broken down by centers, categories, and names, including those of the complainants.
In the same document, the agreement to approve the Public Employment Offer for 2017 to be published in the Official Provincial Gazette, which includes vacant positions, is proposed.
3. Copy of a written request to the defendant for a copy of the documentation of files SSSSS and VVVVV/220 under Article 53 of Law 39/2015, and a copy of the resolution of the City Council, and a copy of the appeal for reconsideration, which was dismissed on 9/07/2018 (page 220 of 242).
SECOND: In light of the facts and documents provided by the complainant, the respondent was sent a copy of the complaint through the AEPD (Spanish Data Protection Agency), requesting:
1. A copy of the communications and the decision taken that was sent to the complainant regarding the transfer of this complaint.
2. A report on the causes that have led to the incident that originated the complaint.
3. A report on the measures taken to prevent similar incidents from occurring.
On 9/11/2018, the respondent stated:
a) The complainants are part of the Vigo City Council staff due to a court ruling that classified them as indefinite labor personnel and required the administration to regularize their situation. In the process of preparing and managing the public employment offer of the city council, all personnel included in this situation are listed, and the need to make their regularization effective by judicial mandate is addressed. In this process, the complainants made allegations requesting an employment consolidation process.
b) The request for access to public information is not related to data protection.
c) It acknowledges that the minutes of the Local Government Board are published on the electronic headquarters of the City Council, and regarding the justification for the public access exposure of the content of the resolutions included in the Local Government Board, it states that the complainants already provide their services for the City Council, and the job position and category are part of the service relationship they maintain as employees, which are not especially protected data; the names and surnames are necessary for the publicity and notification of the agreement.
d) The processing was appropriate to the determined, explicit, and legitimate purpose, such as the publication of a Public Employment Offer and the allegations to it. The local law provides for the publicity of the minutes, specifically, articles 70.2 of the LBRL and 229 of the ROF indicate that the agreements recorded in the minutes of the Local Government Board will be published and notified according to the law. The non-public nature of the session with its development and debate does not imply any obstacle in the dissemination of its agreements, prevailing the right of citizens to information as captured in Article 105 of the Spanish Constitution (CE).
e) The Transparency Law reinforces this right by instituting active publicity as a proactive way for the administration to guarantee transparency and dissemination to increase participation in public affairs.
f) The data was published in accordance with Article 6.2 of the LOPD, in the exercise of its functions.
g) The exposure of the data in the minutes allowed the presentation of allegations by as many people as wished to do so.
h) The management of the regularization of the sentences of fixed indefinite through the public employment offer affects not only them but may affect third parties with legitimate interests that could be impacted, referring as a support point to Article 45 of Law 39/2015 LPCAP.
i) Understands that the GDPR was not applicable to the data exposed before its entry into force.
j) Provides a copy of the response sent to the complainant with the same content of the statements made before the AEPD and receipts of acknowledgment.
THIRD: On May 27, 2019, the director of the AEPD agreed:
“TO INITIATE A SANCTIONING PROCEDURE OF WARNING against
the CITY COUNCIL OF VIGO, with tax ID P3605700H, for the
alleged violation of article 5.1.f) of the GDPR, in
accordance with article 83.5 a) of the GDPR.”
FOURTH: On June 12, 2019, allegations were received in which it was reiterated that the guarantee of transparency and publicity of the competitive bidding process should prevail over the principle of data protection, as determined in the report of the Legal Office of the AEPD number 385/2015 concerning a query about opposition to the publication in official bulletins of data in selective processes.
FIFTH: The content of the report from the Legal Office of the AEPD number 358/2015 is incorporated into the procedure, it reads:
N/REF: 359710/2015
Having examined your request for a report, sent to this Legal Office, concerning the query posed by the GENERAL SUB-DIRECTORATE FOR HUMAN RESOURCES PLANNING AND PAYROLL OF THE MINISTRY OF FINANCE AND PUBLIC ADMINISTRATIONS, it is my duty to inform you of the following:
The query asks whether, in accordance with Organic Law 15/1999 of December 13, on the Protection of Personal Data, the right of opposition recognized in article 17 of this law can be exercised to the publication of the names and surnames of candidates in a selective process for entry into a Public Administration Body, based on the fact that participation in it may lead to reprisals by the current employer of the applicants.
The issue raised has been the subject of study in a report by this Agency dated July 21, 2012, whose conclusions may be applicable to the current case, so it is transcribed as follows:
“The current query raises the question of what the stance of this Agency is regarding a candidate's request from a selective procedure that their name be excluded from the lists of admitted and excluded candidates, and from the merit valuation of said procedure, published on the electronic headquarters of the consulting organization.
The query refers to personal data within the framework of a “public employment procedure.” It does not specify, therefore, whether it pertains to procedures affecting civil servants or labor staff, nor does it determine whether it is questioning procedures for accessing public employment or internal promotion. In any case, it does indicate that “the information includes lists of admitted, excluded, and merit valuations with identification of the candidates”. It is understood, therefore, that the lists of admitted, excluded, and merit valuation include the names and surnames of the candidates, not knowing if other information appears.
We consider, firstly, that the lists referred to in the query undoubtedly include personal data, as they relate to the name and surnames, possibly the ID or personal registration number, as well as the circumstance of participating in a selective public employment procedure, whether or not admitted, as well as the results of the different phases of the selective process including the merit valuation of the contest phase if there were any. Predictably they will also refer to the definitive results of the selective procedure. These are, therefore, data that fall within the definition of personal data enshrined in art. 3.a) LOPD as “any information concerning identified or identifiable physical persons”.
The question is whether the right of opposition of the affected person can be addressed. The right of opposition arises from article 6.4 LOPD which establishes: “In cases where the consent of the affected person is not necessary for the processing of personal data, and always that a law does not dispose otherwise, he may oppose the processing when there are well-founded and legitimate reasons related to a specific personal situation. In such a case, the person responsible for the file will exclude from the processing the data related to the affected person.”
Article 6.4 LOPD is developed by articles 34 to 36 RDLOPD. Art. 34 RDLOPD defines the right of opposition in the following terms:
“The right of opposition is the right of the affected person that the processing of their personal data is not carried out or is ceased in the following cases:
a) When their consent is not necessary for the processing, as a result of the existence of a legitimate and well-founded reason, referred to their specific personal situation, that justifies it, provided that a Law does not dispose otherwise.
b) When it concerns files aimed at carrying out advertising and commercial prospecting activities, under the terms provided in article 51 of this Regulation, regardless of the company responsible for its creation.
c) When the processing is for the purpose of making a decision referring to the affected person and based solely on an automated processing of their personal data, under the terms provided in article 36 of this Regulation”.
Considering that paragraphs b) and c) of this article are totally unrelated to the case posed, we will delve into the study of the first case.
Additionally, we want to specify that the right of opposition must be exercised in the terms of article 35 RDLOPD, through a request addressed to the person responsible for the processing, stating the well-founded and legitimate reasons related to the specific personal situation, and the request must be resolved within ten days; after this period without an express response to the request, protection can be sought before this Agency under the terms of art. 18 LOPD.
II
In this regard, it is necessary to assess whether all the requirements are met to address the exercise of the right to oppose data processing. Firstly, we begin by stating that the publication of lists of admitted and excluded candidates, and the evaluation of merits constitutes a true transfer, in accordance with the definition of article 3.i) LOPD as "any disclosure of data made to a person other than the interested party". This transfer is encompassed within the concept of data processing in accordance with article 3.c) LOPD and article 5.1.t) of the LOPD Development Regulation approved by Royal Decree 1720/2007 of December 21 (RDLOPD).
For article 6.4 LOPD and article 34.a) RDLOPD to be applicable, it is necessary, firstly, that there be a legitimate and well-founded reason, related to the specific personal situation of the affected party. Therefore, this is an eminently casuistic element, as this Agency has maintained, like in the report of September 18, 2006, which must be studied in each specific case, without an abstract answer being possible. The query mentions that the interested party could see their future career damaged by the publications in question. Therefore, it will have to be analyzed what their profession is and whether it is possible for the alleged damages to occur. In this regard, this Agency does not have sufficient data to weigh the specific situation under review.
However, secondly, it is required that a law does not stipulate otherwise. The matter of selective procedures is governed by the principles of transparency and publicity. Starting with article 103 of the Spanish Constitution, article 55 of the Basic Statute of Public Employees approved by Law 7/2007 of April 12 states in its second paragraph: "2. The Public Administrations, entities, and bodies referred to in article 2 of this Statute will select their civil servant and labor staff through procedures in which the constitutional principles previously expressed are guaranteed, as well as the following principles established:
a) Publicity of the calls and their bases.
b) Transparency.
c) Impartiality and professionalism of the members of the selection bodies.
d) Independence and technical discretion in the actions of the selection bodies.
e) Adequacy between the content of the selective processes and the functions or tasks to be developed.
f) Agility, without prejudice to objectivity, in the selection processes."
In matters of job placement, article 78 of the EBEP also enshrines the principle of publicity in the following terms: "1. The Public Administrations will provide job positions through procedures based on the principles of equality, merit, capability, and publicity."
In its development, Royal Decree 364/1995 of April 10, on the Entry of Personnel into the service of the AGE, provision of job positions, and professional promotion, states in its article 5 the application of the principle of publicity; and thus applies it throughout its articles, such as art. 15 regarding the publication of the calls for civil servant entries and their bases in the BOE, as well as art. 20 regarding the publication in the BOE of the resolution approving the list of admitted and excluded applicants and indicating the place where the official lists will be displayed. In this regard, art. 20.2 stipulates: "2. When the selective procedure allows, the public display of the list of admitted applicants is not mandatory, it should be specified in the corresponding call. In these cases, the resolution, which must be published in the 'Official State Gazette', must include the place and date of the start of the exercises, as well as the list of excluded applicants with the reasons and the period for correcting defects."
Article 22 also refers to the publication of the list of approved applicants.
In terms of professional promotion procedures, the principle of publicity is also enshrined for both the call and the resolution, in article 38 of RD 364/1995, as well as specified in articles 42 and 52 of the same Regulation.
Additionally, as the query was posed by a State Agency, we want to highlight that these principles, including that of publicity, are fully applicable to the job placement procedures of these agencies, in accordance with article 20 of the Law 28/2006 of July 18 of State Agencies. Furthermore, article 19 of the same law states in its paragraph 1: "The selection of personnel referred to in article 18.1.c) is carried out through public call and according to the principles of equality, merit, and capability, as well as access to public employment for people with disabilities." These principles are also applicable to labor staff according to art. 19.2 of the same Law.
Thus, in selective procedures, the principle of publicity and transparency becomes essential as a guarantor of the principle of equality. The National Court has weighed the principle of publicity against the protection of personal data, concluding that during the processing of the selective process, the former must prevail. Thus, in the recent judgment of April 26, 2012, of the First Section of the Administrative Chamber of the National Court, which in turn cites the judgment in the appeal 215/2010, it stated (emphasis ours): "Therefore, one of the exceptions to the requirement of consent for data processing is the collision with general interests or with other rights of superior value that cause the protection of data to decline in favor of that other interest.
In the present case, being a competitive concurrency procedure, we must attend to what article 103 of the Constitution states when it affirms that the Public Administration serves with objectivity the general interests and acts according to the principles of effectiveness, hierarchy, decentralization, deconcentration, and coordination, with full submission to the Law and to the Right. (paragraph 1) and when it states in paragraph 3 that "The Law will regulate the statute of public officials, the access to public function according to the principles of merit and capacity ..." (all this in relation to what is provided in article 23 C.E. which we will refer to later.
Obviously, the guarantees required by the processing of personal data cannot serve to cloud or annul these general requirements that mandate that the processes be conducted meeting minimum requirements of transparency and publicity. The superiority of these other values advises that in this case it is understood that the consent of the interested party for the processing of the data of the note consisting of its communication by the now appellant union was not required.
From this perspective, we must conclude that the consent of those who participate in a competitive concurrency procedure for the processing of the grades obtained in such procedure is not required, as a guarantee and requirement of the other participants to ensure the cleanliness and impartiality of the procedure in which they participate. (...)
It is true that Organic Law 15/1999 does not expressly include exemptions or exceptions to the regime of personal data processing contained therein based on the guarantees of transparency of competitive processes, so it will be necessary to weigh the conflicting interests to determine which one should prevail. After this assessment, and considering the circumstances that concur here, it is clear for this Court that the guarantee of publicity and transparency of the competitive process must prevail over the right to data protection. (It is not uncommon for this Chamber to carry out this type of weighing or assessments; just refer to the judgment of the appeal 331/205; DF 2/2010 or 862/2009).
Therefore, the assessment of the appeal and the annulment of the contested resolution will be appropriate based on the prevalence of the general interest considering that, as is natural, only such use will be protected within the purposes related to the same competitive concurrency procedure in application of the limits indicated in article 4 of the LOPD (...)."
All this, of course, as long as the data being published is not excessive, since art. 4 LOPD states in its first section that "personal data may only be collected for processing, as well as subjected to such processing, when they are adequate, pertinent, and not excessive in relation to the scope and the specific, explicit, and legitimate purposes for which they have been obtained." In this regard, the right to oppose could never be exercised regarding personal data that is necessary for the fulfillment of the principle of publicity and transparency of the selective process. For this, it would be necessary to examine by the consulting entity which data is being published and to what extent they are necessary for the fulfillment of these principles. Since this Agency is unaware at this point of specific data, it cannot pronounce. But in any case, we consider that to fulfill the principle of publicity, it must identify the interested party, as well as the circumstance of being admitted or not in the call; where applicable, the cause of exclusion; as well as offering the data of the merit evaluation. As for the individualized evaluation of each merit, it is also a matter subject to extensive casuistry.
But, thirdly, it might be that the basic premise of the right to oppose that the consent is not necessary for the processing of personal data is also not met. The bases of the call for the selective procedure in question should be examined, but if they contain the way in which the publication of the different phases of the call will be carried out - indicating, for example, the publication of all of them on the electronic headquarters, without prejudice that, when the regulations provide for it, they must also be published in the BOE - it can be understood that the interested party is implicitly granting their consent for such publication, and therefore for such transfer.
That is, the processing of these personal data is based on the consent of the affected party, who has submitted an application to participate in the selective procedure in question, including their personal data; and participation implies acceptance of the bases of the call, which become law for the selective procedure. Therefore, the transfer that implies the publication of the data may be protected by the bases of the call of the selective procedure itself in relation to article 59.6.b) of Law 30/1992. Thus, this Agency has been pronouncing, as in reports of April 18, 2011, which in turn cites that of April 9, 2008. In this second one we stated:
"However, the communication of data posed, contained in the notification of the resolution of the procedure of admitted applicants, must be considered as a transfer of personal data, since article 3 i) of the Organic Law defines it as 'any disclosure of data made to a person other than the interested party.' If what is intended is the publication of the aforementioned lists on notice boards of the dependencies of ..., it constitutes a transfer of personal data, defined in article 3 i) of Organic Law 15/1999, as 'Any disclosure of data made to a person other than the interested party.'
Regarding the transfer of data, article 11.1 of the Law states that 'personal data subject to processing may only be communicated to a third party for the fulfillment of purposes directly related to the legitimate functions of the transferor and transferee with the prior consent of the interested party.' This consent will only be exempted in the cases contemplated in article 11.2, whose section a) foresees the possible non-consensual transfer of the data when a norm with the rank of Law so stipulates.
In the case at hand, if the bases of the call for admission in ..., foresee the publication of the lists of admitted and excluded applicants, including the causes of exclusion, the participants in them will have given their prior consent to the aforementioned transfer of their data when they accepted the bases and made their application to participate in them. In that case, consent could be understood as implicitly granted with the acceptance of the bases of the call and the publication of the referred data as reflected in the same call would be correct.
However, what has been stated above must be connected with the obligation to notify the interested parties of the administrative resolutions that affect their rights and interests, established by article 58 of Law 30/1992, of November 26, of the Legal Regime of Public Administrations and Common Administrative Procedure.
In said precept and in the following article (article 59) the cases in which such notification will occur differently from personal notification are strictly regulated, either through the publication of the resolutions, or through their publication on the bulletin board or announcements. Therefore, it is appropriate to analyze whether, according to Organic Law 15/1999, the provision contained in article 59.- 6 of Law 30/1992, of November 26, can be considered an enabling norm for the transfer, through publication, of the personal data referred to by the consulting Corporation in its letter.
According to the aforementioned precept, referred to the "Practice of notification":
"Article 59. Practice of notification. (...)6. Publication, in the terms of the following article, will replace notification having the same effects in the following cases:
a) When the act is intended for an indeterminate plurality of people or when the Administration considers that the notification made to a single interested party is insufficient to guarantee notification to all, being, in the latter case, additional to the notification made. b) When it concerns acts that are part of a selective procedure or competitive concurrency of any kind. In this case, the call for the procedure must indicate the bulletin board or media where the successive publications will be made, lacking validity those that are carried out in different places."
However, Law 30/1992 itself, of 11/26, in its article 61, relating to the "Indication of notifications and publications", provides that: "If the competent body appreciates that notification by means of announcements or the publication of an act injures rights or legitimate interests, it will be limited to publishing in the corresponding official journal a brief indication of the content of the act and the place where the interested parties may appear, within the established period, to know the full content of the mentioned act and record of such knowledge."
In conclusion, the publication of the causes of exclusion will be adequate to Organic Law 15/1999, yes in the bases of the call it had been established how the admitted and excluded would be made public, referring to the causes of exclusion. However, if the consulting body considers that the publication of the causes of exclusion injures rights and legitimate interests, it may opt to apply the provisions of article 61 of Law 30/1992, previously transcribed."
Therefore, if in the selective procedures it is understood that consent has been given, even if implicitly, for the processing of personal data, the application of article 6.4 LOPD will not be appropriate.
III
From the previous section of this report, it follows that as long as publicity is necessary for the correct development of the selective process, it must be maintained, and the exercise of the right to oppose based on article 6.4 LOPD cannot be considered for the reasons previously expressed. That is, at this point, there is a law that, by enshrining the principle of publicity, expressly provides for the processing of personal data, and processing cannot be ceased to achieve the successful completion of the selective process. Implicit consent for data processing is understood to be granted by the publication in the selective procedure.
However, the law does not specify, to ensure compliance with the principle of publicity, any specific means, merely pointing out cases where publication will be made in the BOE (mainly, call with the bases, list of excluded and the cause of exclusion, list of approved and appointment in the selective entry procedure; and call and resolution for job provision procedures). Therefore, there may be cases where the form of publication chosen may be considered excessive. Thus, we can distinguish two scenarios:
a) Phases of the call where legislation foresees some form of specific publication. We have already indicated specific cases where the regulations foresee publication in the Official State Gazette. That is, in these cases, the regulations themselves foresee phases of the selective procedures that must necessarily be published in a certain medium. If, for example, the call, the bases, the list of excluded, and the list of approved are published in the BOE, there will be no obstacle to their publication on the website of the calling body, since they already enjoy superior publicity.
b) Phases of the call where the legislation does not expressly foresee publication in any specific medium. For example, the evaluation of merits. In this case, Article 59.6 of the Law 30/1992 of November 26 on the Legal Regime of Public Administrations and Common Administrative Procedure applies: "Publication, in the terms of the following article, will replace notification having the same effects in the following cases: (...) b) When it concerns acts that are part of a selective procedure or competitive concurrency of any kind. In this case, the call for the procedure must indicate the bulletin board or media where the successive publications will be made, lacking validity those that are carried out in different places."
That is, it is expressly anticipated that it is the call of the procedure that will indicate the medium of communication that will be used. Moreover, in this case, publication on the electronic headquarters is permissible, either replacing or complementing the publication on bulletin boards, as Article 12 of the Law 11/2007 of June 22 on Electronic Access of Citizens to Public Services states: "The publication of acts and communications that, by legal or regulatory provision, must be published on a bulletin board or edicts may be substituted or complemented by their publication on the electronic headquarters of the corresponding organism."
However, the availability and accessibility of the electronic headquarters referred to in Article 10.3 of the mentioned Law 11/2007 does not imply that it is permissible to universally allow the indexing of all personal data by search engines.
In its Report of April 4, 2008, the Article 29 Working Party of Directive 95/46/EC of October 25, 1995, of the European Parliament and of the Council, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, analyzed the legal situation in relation to personal data protection and Internet search engines, concluding that the period of retention of personal data by such search engines should not generally exceed six months.
Furthermore, in a report from this Agency dated November 5, 2010, it was indicated that the possibility of limiting the indexing by search engines of personal data exists, since publicity "does not prevent the system [from] establishing mechanisms to avoid or hinder indiscriminate access to information for purposes other than by the interested party knowing of the notification made through the edictal board."
Thus, the possibility of prohibiting the indexing of information contained on the electronic headquarters relating to personal data by search engines could be considered. In this way, only those who directly access the bulletin board or the electronic headquarters will know of the information contained therein, without a simple search of the data through a search engine being sufficient to access the content of the personal data of those affected. And this does not imply that the electronic headquarters is not available or accessible, since we are merely indicating that the non-indexing by search engines can be considered, regardless of whether the data do appear published on the electronic headquarters that will act as a bulletin board. That is, we are referring to the use of technical and computer tools of the "no robot" type or any other type of technical and computer measures that are suitable to prevent such indexing of content with personal data. In this regard, this Agency has already expressed itself, as in the reports of October 28 and November 5, 2010, and February 17, 2011. In the second of them, we indicate: "Consequently, the exercise of the right to oppose obliges the Administration acting to carry out an assessment of the personal situation of the affected individual, considering whether it is appropriate to except such processing. While generally, the right to oppose will not exclude the publication of the act if it is legally required, this Agency has been pointing out, as a solution in those cases where the right to oppose is exercised against the publication of an act in the Official State Gazette, the adoption of technological measures to prevent indexing by search services."
IV
Thirdly, the query raises whether the potential acceptance of the right to oppose could be resolved by publishing the candidates' DNI (National Identity Document). On one hand, we have already stated that the right to oppose cannot be accepted in favor of the publicity and transparency of selective processes and that consent for data processing has been given, albeit implicitly. Furthermore, what would be sought by accepting the right to oppose would be the suppression of the identity data. The identity data, whether through the name and surname or through the DNI, will always be essential to determine which candidate certain parameters refer to (admission or not in the procedure, results, etc.), so it can never be considered excessive data. And if the form of publication chosen was incorrect, all improperly published data should be removed, not just the identification of the interested party.
On the other hand, we consider whether, generally, it is feasible to replace the name and surname with the DNI in the different phases of the selective process that are going to be published.
Generally, the name and surname can be replaced by the DNI since it alone has sufficient value to accredit the identity of the persons. This issue was already addressed in a report dated June 30, 2009, in the following terms: "...the [principle] of proportionality, set out in Article 4.1 of the Organic Law, is particularly relevant, according to which 'Personal data may only be collected for processing, as well as subjected to such processing, when they are adequate, pertinent and not excessive in relation to the scope and the determined, explicit, and legitimate purposes for which they have been obtained.'"
From the application of this principle, it follows that the publicity of the information just mentioned should extend only to the data necessary to ensure transparency in the selective process, without including those that could be excessive for achieving such a purpose.
Article 1 of Royal Decree 1553/2005, of 12/23, after stating in its section 1 that "the National Identity Document is a personal and non-transferable document issued by the Ministry of the Interior that enjoys the protection granted to public and official documents by the laws. Its holder is obliged to the custody and conservation of the same," adds in its section 2 that "said Document has sufficient value, by itself, to accredit the identity and personal data of its holder that are recorded therein, as well as the Spanish nationality of the same."
Consequently, the indication of the national identity document number alone sufficiently identifies its holder, without the need to indicate the personal data contained therein, such as name and surname, so the use of said number in the publication made by the consulting party on its website would be respectful with what is established in Organic Law 15/1999, to which Royal Decree 248/2009 refers.
In any case, it must be indicated, following what has been established in this matter by the Administrative Litigation Chamber of the National Court, that this does not mean that such publication does not contain personal data, given that the document number, given its character as a unique identifier of the interested party, has such a character, but that by including said number without indication of the name and surname of its holder, appropriate compliance is being given to the principle of proportionality and to the submission to Organic Law 15/1999 of the publicity carried out, which is protected under Article 11.2 a) of Organic Law 15/1999, in connection with Article 55.2 of the Basic Statute of Public Employees and the regulatory norms governing selection processes.
Therefore, it would be possible to accommodate the request of the candidate who only wants to see their DNI number published.
ChatGPT
SIXTH: On December 17, 2019, a resolution proposal was issued, which states:
“That by the Director of the Spanish Data Protection Agency, a warning sanction be imposed on the CITY COUNCIL OF VIGO, with NIF P3605700H, for an infringement of article 5.1.f) of the GDPR, in accordance with article 83.5 A) and 58.2.b) of the GDPR.
REPORT on the measures taken to adapt the data processing contained in the minutes of the Local Government Board, in order to not re-infringe article 5.1.f) of the GDPR, as per article 58.2.c) of the GDPR.”
On January 8, 2020, allegations to the proposal were received which summarize as follows:
- A copy of Instruction 1/2020, on data protection in files for approval by the Local Government Board, was provided. It refers to the principle of transparency and the right to data protection which must be aligned with data minimization to what is adequate and pertinent. The instructions state that “The agreement proposals, from the various municipal areas and services, submitted for the adoption of agreements by the Local Government Board must guarantee the proper protection of personal data, considering the high degree of publicity to which these agreements are subjected, adjusting their drafting to the principle of privacy by design and by default, as prescribed by the GDPR, reducing the volume of information collected.”...“To this end, the agreement proposals sent to the Local Government Board will only require the minimum data collection and processing action possible, thus, avoiding the processing of data that is not necessary for the purposes pursued in the processing1 or through the application of anonymization or dissociation techniques, limiting possible impacts on privacy.” “Doubts concerning this matter should be resolved by consulting with the Data Protection Officer of the City Council of Vigo and in accordance with the 'privacy by design guide' developed by the Spanish Data Protection Agency.”
- “The Data Protection Officer's service will monitor and supervise the implementation of the specific measures outlined and a specific audit report on areas for improvement.”
- “The instruction has been disseminated to the staff of the City Council and has been posted on the transparency portal.”
- Two modules on transparency and data protection were taught, with the program and university professors in November 2019 provided.
- They acted in good faith believing that they were acting correctly in the interest of transparency and publicity.
- A report from the DPD dated January 2, 2020, is included, which states that in the matter of job placement, Article 78 of the EBEP enshrines the “principles of equality, merit, capability, and publicity”. The Regulation of Entry of personnel into the service of the AGE states in its Article 5 the application of the principle of publicity, and Article 15 regarding the publication of the call for entry. It was understood that the consent of those affected was not necessary for processing their data as all these applicable regulations exist in these processes.
PROVEN FACTS
1) On the electronic headquarters of the VIGO CITY COUNCIL, which is freely accessible to anyone, it is possible to access, print, or save the minutes of the Local Government Board from XX/XX/XXXX and YY/YY/YYYY. These minutes reference in the section on “permanent but not fixed staff” pending judicial decisions that need to be included in public employment offers, with full names and surnames provided.
The complainants submitted a copy of the Local Government Board minutes dated YY/YY/YYYY (pages 5 to 75 of their complaint consisting of 242 pages in an electronic PDF file). These minutes include, among other things, personal data:
- Identified as 9 (155) - Proposal from the Local Government Board, rejecting the appeal for reconsideration filed against the local government board’s decision from XX/XX/XXXX which approved the Public Employment Offer of 2017, file ZZZZZ/220. After presenting the background, it mentions the regularization of all indefinite labor staff, including in the yearly employment offers the necessary positions for this purpose. It mentions the staff pending to be included in such employment offers, by name and surname and the Center where the creation of the position is proposed.
- It refers to the publication in the BOP of the offered positions (without personal data). It mentions the people who filed the appeal for reconsideration, 8 people identified by names and surnames, assesses the allegations made and DISMISSES the claims of the appellants indicating that notification be given to the appellants among whom the complainants are listed.
- Identified as 10 (156) similar to the previous, referring to file RRRRR/220 (47 of 242) similar to the previous one.
- Minutes of the Local Government Board from XX/XX/XXXX (pages 76 and following) in which, regarding the public employment offer 2017, file TTTTT/220, the names and surnames of employees who resigned in 2016 including their names and surnames, category, workplace, and date, including police, reasons being absolute disability or voluntary or forced retirement, and a list of non-fixed indefinite staff, folio 125 - which matches the act identified as 9 (155) - with pending judicial decisions to be included in the public employment offers with a breakdown by centers, categories, and names and surnames including those of the complainants. In the same, the agreement to approve the OEP for 2017 to be published in the BOP which includes vacant positions was proposed.
The complainants provided copies of the minutes in which the first approved the public employment offer for 2017 and their data appear, and in the second, their data are again contained concerning an appeal for reconsideration that was filed by 8 affected parties.
Additionally, they contain individuals with their names and surnames, categories, who resigned during 2017 with their category and cause of forced retirement, voluntary retirement, or incapacity.
2) The defendant stated that the complainants are part of the staff of the Vigo City Council due to a court ruling that classified them as indefinite labor staff and compelled the administration to regularize the situation. “In preparing and managing the public employment offer of the city council, all staff included in that situation and the need to make their regularization effective by judicial mandate are related. “In that process, the complainants made allegations requesting a consolidation of employment process.”
3) The defendant acknowledges that the minutes of the Local Government Boards are published on the electronic headquarters of the City Council, and regarding the justification for public access to the content of the resolutions included in the Local Government Boards, it indicates that the complainants already provide their services for the City Council, and the job position and its category are part of the service relationship they maintain as employees, and the names and surnames are necessary for the publicity and notification of the agreement and for transparency.
LEGAL GROUNDS
I
Under the powers recognized by article 58.2 of the GDPR to each supervisory authority, and as established in articles 47 and 48.1 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to resolve this procedure.
II
Regarding the disclosure of data derived from judgments, the principle of public access to judicial proceedings, constitutionalized by article 120.1 CE, is taken as a basis, and referenced in various precepts of the Organic Law of the Judicial Power (articles 232, 234, 235, and 266.1). Article 232 LOPJ states, "1. Judicial proceedings shall be public, with the exceptions established by procedural laws. 2. Exceptionally, for reasons of public order and protection of rights and freedoms, Judges and Courts may, by reasoned resolution, limit the scope of publicity and decree the secrecy of all or part of the proceedings."
Article 234 LOPJ mandates, "The Secretaries and competent personnel of the Courts and Tribunals will provide interested parties with any information they request about the status of judicial proceedings, which they may examine and know, unless they have been declared secret in accordance with the law. In the same cases, the certificates requested will be issued, stating their recipient, except in cases otherwise provided by law."
Article 235 LOPJ refers to the access by interested parties to the books, archives, and judicial records that do not have a reserved character, and article 266 indicates that any interested party will be allowed access to the text of the judgment.
The Supreme Court ruling of March 3, 1995, appeal 1218/1991, states regarding the publicity of judicial proceedings, "...the right and corresponding duty of knowledge and access to the text of judicial resolutions is graduated according to three different spheres of impact, each governed by different criteria, namely: a) one of maximum breadth or of generalized impact, which includes the public or citizens in general, without specific qualification and corresponding to the publicity of judicial proceedings developed in all kinds of processes, allowing them to attend the practice of diligences that must take place 'in public hearing', except for the declaration of reservation that the judicial body may reasonedly agree upon, principle of publicity constitutionalized in art. 120.1 of the Fundamental Norm and included in art. 232.1 of the Organic Law.
b) at the opposite extreme, of maximum restriction of the knowledge scope of judicial decisions, are the acts of notification and communication thereof, directed only to those who hold the condition of a procedural party by virtue of procedural laws, and which in terms of judgments determine the right and corresponding duty of Judges and Courts to their knowledge through the instrumental act of notification, as prescribed by art. 270 LOPJ.
c) occupying an intermediate position that places the issue in a more imprecise realm, are the procedural actions already concluded, including the judgments, integrated into books, archives, or judicial records, and regarding which, on one hand, art. 235 LOPJ determines that: 'interested parties shall have access to the books, archives, and judicial records that do not have a reserved character, through the forms of exhibition, testimony, or certification established by the Law.'
Regarding the qualification of 'interested party' for the aforementioned effects, it is specified in the mentioned ruling that 'the legitimate interest that is required in the case can only be recognized in someone, whether a physical or legal person, who demonstrates and accredits, at least prima facie, before the judicial body, a connection of a concrete and singular nature either with the object of the process itself and, therefore, of the judgment that finalized it at the instance, or with one of the procedural acts through which it has developed and that are documented in the records, a connection that, on the other hand, is subject to two conditions: a) that it does not affect the fundamental rights of the procedural parties or of those who have somehow intervened in the process, to essentially safeguard the right to privacy and personal and family intimacy, honor, and the right to one's own image that could potentially affect those people; and b) that if the information is used, as a mediating activity, to satisfy rights or interests of third parties, and consequently acquires, as is the case, an aspect of globality or generality not related to a specific process, such interest is maintained within the realm of the legal system and its appliers, generally, because otherwise it would be tantamount to making the judicial body a participant or collaborator in tasks or activities that, however lawful they may be, exceed its jurisdictional function'."
The doctrine established in that ruling has been reiterated in the Supreme Court rulings of May 22, 1996, and April 6, 2001, appeal 9448/1996. Also, the National Court of Appeals (1st) on November 29, 2001, appeal 531/2000 echoes the doctrine set by the aforementioned Supreme Court ruling of March 3, 1995, and notes that "the data contained in the books and judicial records are not available to the public entirely freely and indiscriminately since access to them is regulated and to a certain extent restricted. On one hand, by the appeal that the aforementioned articles 235 and 2666.1 of the Organic Law of the Judicial Power make to the condition of 'interested', the meaning and scope of which we already know the jurisprudential interpretation. On the other hand, because access to such books and archives is mediated by the necessary intervention of the Judicial Secretary and the mandatory compliance with the application and authorization procedure regulated in articles 1 to 5 of Regulation 5/1995, of June 7, of the General Council of the Judiciary, on accessory aspects of judicial proceedings."
This means, and for our current interest, that the publicity of judicial proceedings does not imply that the data contained in a judicial procedure in the execution phase can be examined and made available to the general public in a completely free and indiscriminate manner. Instead, such publicity is restricted except for those proceedings that are held in public hearings and are accessible to those with "interested party" status, as appealed by Article 234 LOPJ. This concept of an interested party does not necessarily coincide with that of a party to the proceedings and has been defined by jurisprudence in the manner previously described.
In concluding the examination of the jurisprudence and regulations on this matter, it should be noted that the jurisprudential criterion presented is consistent with the position maintained by the Civil Chamber of the Supreme Court in weighing the publicity of the judgments against the right to honor, establishing in its ruling of December 22, 2008, the following:
"The publicity of the judgments constitutes a guarantee instrument of the independence of the courts and their action according to the law, as these principles are reinforced by the knowledge of the courts' actions by the citizens, and should be considered closely linked to the protection of the fundamental rights inherent to the exercise of jurisdictional authority by judges and courts.
This publicity can only be restricted or limited, according to what is established by law, when it could undermine a fundamental right of the affected citizens or a constitutionally protected asset, especially when the knowledge of private data contained in the judgment could lead to the disclosure of aspects of privacy that should be protected, provided that this disclosure is not covered by the right to information in the framework of free public communication typical of a democratic society.
Indeed, according to the STC 57/2004, of April 19, FJ 5 (in the same sense, regarding the publication of the rulings of the Constitutional Court, ATC 516/2004, of December 20, FJ 1, and STC 114/2006, FJ 7), the principles of balance and proportionality may lead to the conclusion that other fundamental rights or constitutionally protected assets should have precedence over the publicity of judicial resolutions.
This principle is applied by Article 266.1 II LOPJ, introduced by LO 19/2003, of December 23, which states that '[a]ccess to the text of the judgments, or to certain aspects of them, may be restricted when it could affect the right to privacy, the rights of persons requiring special protection, or the guarantee of anonymity of victims or affected parties, when appropriate, as well as, in general, to prevent judgments from being used for purposes contrary to the laws.'
When the publication of a judicial resolution can affect the honor of the person who has obtained an unfavorable result in the process, it is necessary to determine if the exception established by the LPDH in the sense of considering non-existent the violation of the protected scope of this right when it is the product of the exercise of a right recognized by the legal system (Article 2.2 LPDH: 'No infringement of the protected scope will be deemed to exist when it is expressly authorized by law') is present.
The contrast between the right to honor and the right to disclose the content of the sentence, which results from the principle of publicity, must lead to a balance in which, first, the fulfillment of the institutional purposes pursued by the principle of publicity is considered. This aspect, in turn, requires considering the manner in which the publication has occurred, taking into account whether it is a neutral communication of the content of the sentence or whether elements are added or removed that may distort the objective knowledge of what the court has resolved to turn the publication of the ruling into a procedure suitable for undermining the honor of the affected person, beyond what objectively implies in the field of reputation the failure of an action or opposition maintained before the courts of justice.
Thus, it is clear that the principle of publicity of the judgments contemplated in our LOPJ is not absolute but finds limits, either by referring to those who hold the status of interested parties or by the prevalence of other rights or assets that enjoy constitutional protection, such as the right to data protection, and in the context of resolving a motion for reconsideration, it is not appropriate nor proportional to expose the same and disclose the judgments and the status of the claimants.
Finally, it is appropriate to specify that the constitutional doctrine contained in the STC 114/2006, of 5/04, does nothing but corroborate what has been exposed so far, since in it the Constitutional Court limits itself to extract from a joint reading of Articles 120 and 164.1 CE and Articles 86.2 and 99.2 LOTC -in its wording prior to the reform operated by the Organic Law 6/2007, of 24/05-, in relation to Articles 9.1 CE and 5.1 LOPJ, a constitutional requirement of maximum dissemination and publicity of the complete content of the jurisdictional resolutions of that Tribunal, which concretizes, on the one hand, in the formal obligation to publish such resolutions in the Official Gazette, and on the other, in the obligation to ensure the greatest accessibility and public dissemination of their content, regardless of their nature and the process in which they are issued; and, furthermore, in that the publicity and dissemination must affect the complete resolution.
It is significant that for this the Constitutional Court relies especially on Article 164.1 CE, which it claims establishes, beyond even the general principle of publicity of judicial proceedings and their resolutions under Article 120 CE, a specific constitutional requirement of maximum dissemination and publicity of the jurisdictional resolutions of this Court.
Moreover, it highlights the nuances that differentiate the principle of publicity of the sentences of the Constitutional Court from that of the sentences of the Judicial Power, by limiting the applicability to the former of the regime established by the LOPJ, stating the following:
'It is evident that the very possibility, provided for in Article 266.1 LOPJ, of completely restricting access to the text of a Sentence could be problematic, in relation to the constitutional sentences, due to the obligation of their formal publication in the Official Gazette, provided for both in Article 164.1 CE and in Article 86.2 LOTC, and that, even, the possibility of omitting the identification of the parties involved in the process may be, as a rule, much more exceptional in constitutional processes than in judicial processes, due to the material obligation, derived from Articles 164.1 CE and 99.2 LOTC, to guarantee the maximum dissemination of the jurisdictional resolutions of this Court; Article 266.1 LOPJ in conjunction with the aforementioned Article 6.4 LOPD, in any case, can serve as a reference element both in terms of establishing the need for the decision on the restriction of the publicity of the parties involved in the constitutional process to be made by making an individualized balance of the constitutional interests concurrent in the case with those with which the principle of publicity may come into conflict, as well as in terms of highlighting which interests may be prevalent, particularly the right to privacy, the rights of those who require special protection, the guarantee of anonymity, where appropriate, of the victims and the aggrieved, and the prevention of such data being used for purposes contrary to the Laws. In any case, it must be emphasized that the literal wording of Article 266.1 LOPJ does not imply a limitation of the fundamental rights and constitutional guarantees with which the constitutional principle of maximum dissemination of the jurisdictional resolutions of the Constitutional Court may eventually come into conflict, since any fundamental right or constitutional guarantee is susceptible to being weighed against the possibility of making exceptions to said principle, including, of course, the fundamental right provided for in Article 18.4 CE in the terms and with the breadth and autonomy that has been recognized by this Court in the STC 292/2000, of November 30, in its legal grounds 5 and 6'.
Therefore, there is no right of the citizen to be handed the sentence that relates to employees with the municipality, nor is it part of the right to transparency. It is different if the citizen can know such a sentence without personal data or anonymized as it is not necessary to know the identity of the employees to understand the thesis of the Court and the way of acting of the claimed, or the cost of the measure.
If the sentence is not handed over, and an extract of the Local Government Board is made available to third parties with, among others but not only, data of the claimants, relating such sentences, it is being disclosed in a way not authorized by the regulation, when by the content of the extract it must be subject to the general principles of administrative documentation management of the affairs.
III
Regarding requests for access to files and their potential denial, this matter does not pertain to data protection. Article 105 b) of the Constitution states:
“The law shall regulate:
…
The access of citizens to administrative archives and records, except in matters affecting the security and defense of the State, the investigation of crimes, and the privacy of individuals.”
Law 39/2015 in its Article 13, “Rights of individuals in their relations with Public Administrations,” states:
“Those who, in accordance with Article 3, have the capacity to act before Public Administrations, hold, in their relations with them, the following rights:
d) Access to public information, archives, and records, in accordance with the provisions of Law 19/2013, of December 9, on transparency, access to public information and good governance, and the rest of the Legal System.
These rights are understood without prejudice to those recognized in Article 53 concerning the interested parties in the administrative procedure.”
This right of access regulated in Law 39 is different from that regulated in data protection, specifically in Article 15.1, which governs the right of the interested party to request and obtain free information about their personal data undergoing processing, the origin of such data, as well as the communications made or planned to be made with them. This right is a very personal right, consisting of control over one's own data, whereas through the aforementioned right of access, one can access not only their own data but also that of third parties.
The control over the exercise of this right of access under Law 39 does not correspond to the Spanish Data Protection Agency (AEPD), as determined in the case involving the competences of the Basque Data Protection Agency, referred to by the High Court of Justice of the Basque Country, in its ruling of July 8, 2009:
“The behaviors described by the plaintiff do not correspond to any exercise of that fundamental right but to the exercise of the right of access to archives and records, regulated in Law 30/1992, specifically in 35 a) or 37.2. That is, it refers to the right to access documentation contained in a specific procedure, which does not fall within the scope of action of the Agency.”
In the process of competitive bidding, the access of participating individuals to the data of the rest of the applications would not violate personal data protection regulations provided that the knowledge of such data is necessary for the control of the correct selection process.
However, what would not be justified, from a data protection perspective, is the provision of information about data of participants in the selection process that could affect their privacy and that lack relevance to the purpose.
In this case, what is described does not correspond to any call for a selection process, but rather to the upcoming publication of the public employment offer. This offer must be publicly known, but by definition, it concerns vacancies. Its regularization is an internal matter for which it is not necessary to expose the data of individuals who have obtained the status of permanent employees through legal ruling.
IV
The Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (LPACAP), outlines in Article 40.5:
"Public Administrations may adopt the measures they consider necessary to protect the personal data contained in resolutions and administrative acts, when these are intended for more than one interested party."
Article 45 of the same law states:
"1. Administrative acts shall be published when so established by the regulations governing each procedure or when deemed advisable due to reasons of public interest assessed by the competent body.
In any case, administrative acts shall be published, and this publication shall have the effects of notification, in the following cases:
b) When it concerns acts that are part of a selective procedure or competitive bidding of any kind. In this case, the call for the procedure must indicate the medium where subsequent publications will be made, and publications carried out in other places will not be valid.
3. The publication of the acts shall be made in the official journal corresponding to the Administration from which the act to be notified originates.
4. Notwithstanding the provisions of Article 44, the publication of acts and communications that, by legal or regulatory provision, must be practiced on a bulletin board or through edicts, will be considered fulfilled by their publication in the corresponding Official Gazette."
In this specific case, it is not about notification related to a selection process but rather, in one instance, about the approval of the Public Employment Offer, which pertains to vacant positions, not individuals, and in another case, about the rejection of a motion for reconsideration.
These regulations aim to balance the need for public transparency in the administration's operations with the protection of personal data. The law clearly delineates when and how information about administrative actions, especially those involving multiple interested parties or public interest, should be made public. In situations such as public employment offers or procedural decisions like the rejection of a motion for reconsideration, these are communicated in ways that ensure both accessibility to the information and adherence to legal standards for data protection.
V
Regarding the publicity of municipal activities, Article 70 of the Regulatory Law of the Bases of Local Regime (LBRL), as amended by Law 57/2003 of December 16, provides:
"1. The sessions of the Plenary of local corporations are public. However, the debate and vote on issues that may affect the fundamental right of citizens referred to in Article 18.1 of the Constitution can be secret, if so agreed by an absolute majority.
The sessions of the Local Government Board are not public.
The decisions made by local corporations are published or notified in the manner prescribed by law.
All citizens have the right to obtain copies and certifications accrediting the decisions of local corporations and their precedents, as well as to consult archives and registers under the terms established by the legislation that develops Article 105, paragraph b), of the Constitution. The denial or limitation of this right, in all matters affecting the security and defense of the State, the investigation of crimes or the privacy of individuals must be verified through a motivated resolution."
Although the sessions themselves may not be public, the publication of administrative acts follows general rules on notification and publicity of decisions as appropriate (Art. 70.2 LBRL).
The implementation regulation referred to by the LBRL can be found in its development norm, Royal Decree 2568/1986, of November 28, which approves the Regulation of Organization, Operation, and Legal Regime of Local Entities:
"Article 229.2
The calls and agendas of the Plenary sessions will be transmitted to the local media and made public on the Notice Board of the entity.
Without prejudice to the provisions of Article 70.2 of Law 7/1985, of April 2, the Corporation shall give a summarized publicity of the content of the plenary sessions and of all the decisions of the Plenum and the Government Commission, as well as the resolutions of the Mayor and those delegated by the Delegates.”
There is no specific mention of the minutes, nor of the minutes of the Local Government Board. Similarly, the basic principles of data protection tie data minimization, adequacy, and necessity of processing to the purpose as described in Article 5.1 c) "Principles relating to processing":
“1. Personal data shall be:
adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimization');”
The exact content of the summary that may be published from plenary sessions is not specified, and there is no express reference to the publicity of the minutes of the Local Government Board. There is no legal mandate that such a summary must offer the same content as provided for the minutes by Article 109, nor therefore the operative part of the decisions that are adopted. On the other hand, the core essential right of information for residents remains intact as they can always, regardless of the publication of such a summary, directly exercise the right to information.
The "summary" referred to by the regulation advises the omission of any personal data that are not adequate, relevant, or are excessive for the purpose of providing "generic" information to the residents and should in no case contain sensitive personal data.
If the purpose is the approval of the public employment offer including positions that have obtained the status of permanent workers, it is not necessary to publish the data of such individuals, nor those who have resigned, their reasons and category, and if they present a motion for reconsideration, it is also not suitable for the purpose of its resolution and notification, as the notification for these is not public and is governed by common rules for that purpose, being common internal management.
Thus, the communication of data, including its inclusion on the website, would only be compliant with data protection legislation when covered by a norm with the rank of law. In other cases, the publication containing personal data or making individuals identifiable would only be possible if consent is obtained from the interested party or if the data could not, in any case, be linked to the individual concerned.
VI
Given the manner prescribed for notifying administrative resolutions is not through display on the electronic headquarters of the Local Government Board’s agreements, accessible to any person, and there is no legal basis for such display of the claimants' data, it is proven that the VIGO CITY COUNCIL commits an infringement of Article 5.1.f) of the GDPR, which states:
“1. Personal data shall be:
f) processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (‘integrity and confidentiality’).”
The display on the website results in a breach of the confidentiality obligation of the data controller, their management, and treatment for matters under their competence. The LOPDGDD states in its Article 5:
1. Data controllers and processors, as well as all persons involved in any phase of this, will be subject to the duty of confidentiality referred to in Article 5.1.f) of Regulation (EU) 2016/679.
2. The general obligation mentioned in the previous section will be complementary to the duties of professional secrecy in accordance with its applicable regulations.
3. The obligations established in the previous sections will be maintained even after the termination of the relationship of the obligated party with the controller or processor.
The internal disciplinary scope of violation of the duty of secrecy due to professional activities is independent from the duty of secrecy concerning the files and databases for which one is responsible. The former is on an individual, deontological basis, while the latter is defined by the file creation norm and the condition of being the file's controller. Their penalties are also different, as is the legally protected good.
It is important to delineate the scope of the right to data protection as contained in Sentence 292/2000. By ensuring the power of control over the personal data of the holder, the mentioned Court states, “the content of the fundamental right to data protection consists of a power of disposition and control over personal data that enables a person to decide which of those data to provide to a third party, whether the State or a private entity, or what this third party may collect, and it also allows the individual to know who holds those personal data and for what purpose, being able to oppose such possession or use. These powers of disposition and control over personal data, which constitute part of the content of the fundamental right to data protection, are legally concretized in the ability to consent to the collection, obtaining, and access to personal data, their subsequent storage and processing, as well as their possible use or uses, by a third party, whether the State or a private entity. And this right to consent to the knowledge and processing, whether computerized or not, of personal data, requires as indispensable complements, on the one hand, the ability to know at all times who holds those personal data and to what use they are being subjected, and, on the other hand, the power to oppose such possession and uses.” The fact that the claimants have obtained a favorable ruling does not prescribe that the other party, the respondent, must communicate the data and the judgment in the minutes, and that it be available to any person.
There is no legal norm that grants powers to expose agreements of the Board containing the data of the claimants related to the judgments or properly with the filing of a motion for reconsideration by those affected.
The acts consisting of publishing for any person on the respondent's website the data of the claimants constitute an infringement of Article 5.1.f) of the GDPR.
Regarding the application of the previous legislation, the LOPD, it should be noted that the principle of confidentiality that has been violated exists in both regulations. At the time of opening the agreement of initiation, the reported infringement still persisted. Under the LOPD, it was framed under Article 10 of the LOPD, with the new regulations under 5.1.f) of the GDPR.
Whether the LOPD or the GDPR is applied, the basic principle violated is that technical means have been made available so that one can openly enter and view documents with personal data that should not be available for open consultation and access on that website.
On the other hand, the consequences in both regulations imply a declaration of infringement under the LOPD or a warning under the GDPR in similar procedures, which do not entail a monetary sanction but rather the adaptation of taking measures in their case with their subsequent follow-up if required.
VIIVII
Regarding the data being exposed to fulfill the duty of transparency, with active publicity, it should be noted that the Preamble of Law 19/2013, of 12/9, on transparency, access to public information, and good governance indicates that:
"The Law expands and strengthens the obligations of active publicity in various areas. In terms of institutional, organizational, and planning information, it requires the subjects included in its scope of application to publish information related to their functions, applicable regulations, and organizational structure, as well as their planning instruments and evaluation of their degree of compliance. In terms of legal information that directly affects the relationships between the Administration and citizens, the law includes a broad repertoire of documents that, when published, will provide greater legal certainty. Likewise, in the area of economic, budgetary, and statistical information, a broad catalog is established that must be accessible and understandable to citizens, given its optimal instrument for controlling the management and use of public resources. Lastly, it establishes the obligation to publish all information that is frequently requested for access so that transparency obligations align with the interests of citizens."
To channel the publication of such an enormous amount of information and facilitate the fulfillment of these active publicity obligations, and from the perspective that one cannot speak of transparency without providing adequate means to facilitate access to the disclosed information, the Law contemplates the creation and development of a Transparency Portal.
"Chapter II, dedicated to active publicity, establishes a series of obligations for the subjects included in the scope of application of Title I, which must disseminate certain information without waiting for a specific request from the public. This includes data on institutional, organizational, and planning information, of legal relevance, and of an economic, budgetary, and statistical nature.
To decisively promote access to the information disseminated, the Transparency Portal will be created, which will include, in addition to the information for which there is an obligation of active publicity, that which is most frequently requested. The Portal will be a meeting and dissemination point, showing a new way of understanding citizens' right to access public information. It is also foreseen that the General State Administration, the Autonomous Communities Administrations, and the entities that make up the Local Administration may adopt collaboration measures to fulfill their active publicity obligations."
The aspect of active publicity is developed in the following articles:
Article 5. General Principles
The subjects listed in Article 2.1 will periodically and updatedly publish information whose knowledge is relevant to ensure the transparency of their activity related to the functioning and control of public action.
The transparency obligations contained in this chapter are understood without prejudice to the application of the corresponding regional regulations or other specific provisions that provide for a broader regime in terms of publicity.
The limits to the right of access to public information provided in Article 14 and, especially, those derived from the protection of personal data, regulated in Article 15, will be applicable. In this regard, when the information contains specially protected data, publicity will only be carried out after dissociation of the same.
The information subject to transparency obligations will be published in the corresponding electronic headquarters or websites in a clear, structured, and understandable manner for interested parties and, preferably, in reusable formats. Adequate mechanisms will be established to facilitate accessibility, interoperability, quality, and reuse of the published information as well as its identification and location.
When it comes to non-profit entities pursuing exclusively social or cultural purposes and whose budget is less than 50,000 euros, the fulfillment of the obligations derived from this Law may be carried out using electronic means provided by the Public Administration from which most of the public aids or subsidies received originate.
All information will be understandable, easily accessible, and free of charge and will be available to people with disabilities in a mode supplied by means or in formats that are accessible and understandable, according to the principle of universal accessibility and design for all."
Article 14. Limits to the Right of Access
"1. The right of access may be limited when accessing the information would harm:
a) National security.
b) Defense.
c) Foreign relations.
d) Public safety.
e) The prevention, investigation, and sanctioning of criminal, administrative, or disciplinary offenses.
f) The equality of parties in judicial proceedings and effective judicial protection.
g) The administrative functions of oversight, inspection, and control.
h) Economic and commercial interests.
i) Economic and monetary policy.
j) Professional secrecy and intellectual and industrial property.
k) The guarantee of confidentiality or secrecy required in decision-making processes.
l) Environmental protection.
2. The application of the limits will be justified and proportionate to their object and purpose of protection, taking into account the circumstances of the specific case, especially the presence of a superior public or private interest that justifies access.
3. The resolutions that, in accordance with the provisions of section 2, are issued in application of this article will be subject to publicity after dissociation of the personal data they contain and without prejudice to the provisions of section 3 of Article 20, once they have been notified to the interested parties."
Section 2 deals with "Exercise of the right of access to public information."
Article 15. Protection of Personal Data
"1. If the requested information contains specially protected data referred to in section 2 of Article 7 of Organic Law 15/1999, of December 13 (RCL 1999, 3058), on the Protection of Personal Data, access may only be authorized if there is the express and written consent of the affected party unless the affected party had previously made the data manifestly public before the access request.
If the information includes specially protected data referred to in section 3 of Article 7 of Organic Law 15/1999, of December 13, or data relating to the commission of criminal or administrative offenses that do not entail public admonishment of the offender, access may only be authorized if there is the express consent of the affected party or if it is protected by a rule with the rank of Law.
2. As a general rule, and unless in the specific case the protection of personal data or other constitutionally protected rights prevails over the public interest in disclosure that prevents it, access to information containing merely identifying data related to the organization, functioning, or public activity of the body will be granted.
3. When the requested information does not contain specially protected data, the body to which the request is addressed will grant access after a sufficiently reasoned assessment of the public interest in the disclosure of the information and the rights of the affected parties whose data appear in the requested information, particularly their fundamental right to the protection of personal data.
For the realization of the mentioned assessment, the body will particularly consider the following criteria:
a) The least harm to the affected parties derived from the passage of the deadlines established in Article 57 of Law 16/1985, of June 25, on Spanish Historical Heritage.
b) The justification by the applicants of their request in the exercise of a right or the fact that they have the condition of researchers and motivate access for historical, scientific, or statistical purposes.
c) The least harm to the rights of the affected parties if the documents only contained merely identifying data of them.
d) The greatest guarantee of the rights of the affected parties if the data contained in the document could affect their privacy or security, or refer to minors.
4. The provisions of the previous sections will not apply if access is made after dissociation of personal data so that the identification of the affected persons is prevented.
5. The personal data protection regulations will apply to the subsequent processing of the data obtained through the exercise of the right of access."
As a conclusion, it should be noted that the disclosure of the claimants' data in the minutes of the local Government Board does not occur for the purpose of active publicity on the transparency portal of the respondent and does not fit within the assumptions provided as active publicity, as it is not necessary or proportional to the knowledge of the personal data of the persons who obtained the status of indefinite by court ruling with their systematic publication in said minutes. They do not, therefore, form part of the information that by Law 19/2013 must be published as active information. Furthermore, the exposure on the respondent's open website reaches a greater significance considering the multiplying disclosure effects that occur through the Internet and its impact on the protection of personal data.
VIII
Regarding the allegation that the data are exposed in the minutes to ensure the transparency and publicity of the competitive process, providing the report of the Legal Office of the AEPD number 385/2015, which deals with a query about candidate data in the development of a selective process, admitted, excluded, qualifications, it should be noted that it deals with a different issue, unrelated to the management of the public employment offer and the exposure of data, replacement of staff, causes, and categories of people who leave the service, or people who hold the status of permanent labor by court ruling. Therefore, this allegation does not serve to justify the exposure of the data subject to this procedure.
IX
Article 83.7 of the GDPR states:
"Without prejudice to the corrective powers of supervisory authorities pursuant to Article 58(2), each Member State may establish rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State."
Article 58.2 of the GDPR provides the following:
"Each supervisory authority shall have all of the following corrective powers:
(a) to issue reprimands to a controller or processor where processing operations have infringed provisions of this Regulation;
(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period."
Article 72.1.a) of the LOPDGDD states:
"Very serious infringements are considered:
In accordance with Article 83(5) of Regulation (EU) 2016/679, the following infringements, which constitute a substantial violation of the articles mentioned therein, are considered very serious and shall prescribe after three years:
(a) The processing of personal data in violation of the principles and guarantees established in Article 5 of Regulation (EU) 2016/679."
In this regard, Article 77.2 of the LOPDGDD states:
"When the controllers or processors listed in section 1 commit any of the infringements referred to in Articles 72 to 74 of this organic law, the competent data protection authority shall issue a resolution sanctioning them with a reprimand. The resolution shall also establish the measures to be taken to cease the conduct or correct the effects of the committed infringement. The resolution shall be notified to the controller or processor, the hierarchical superior body, if applicable, and the affected individuals who have the status of interested parties, if applicable."
The resolutions relating to the measures and actions referred to in the previous sections shall be communicated to the data protection authority.
Actions taken and resolutions issued under this article shall be communicated to the Ombudsman or, where applicable, to the analogous institutions of the autonomous communities.
When the competent authority is the Spanish Data Protection Agency, it shall publish on its website the resolutions concerning the entities listed in section 1 of this article, clearly indicating the identity of the controller or processor who committed the infringement. When the competence corresponds to a regional data protection authority, the publicity of these resolutions shall be governed by its specific regulations.
In response to the proposal, news has been received of the instruction approved to consider personal data in the minutes, related to the purpose of transparency, so that the data holder is not known or identifiable according to the purpose of public knowledge, reasonably to prevent the recurrence of an infringement like the one analyzed, without prejudice to conducting continuous analyses and evaluations of the disclosure of data through various platforms that may occur in the respondent's actions.
Therefore, in accordance with the applicable legislation, the Director of the Spanish Data Protection Agency RESOLVES:
FIRST: TO IMPOSE on the VIGO CITY COUNCIL, with NIF P3605700H, for an infringement of Article 5.1.f) of the GDPR, related to Article 5 of the LOPDGDD, in accordance with Article 83.5 a) of the GDPR, a sanction of REPRIMAND.
SECOND: TO NOTIFY this resolution to the VIGO CITY COUNCIL.
THIRD: TO COMMUNICATE this resolution to the OMBUDSMAN, in accordance with the provisions of Article 77.5 of the LOPDGDD.
FOURTH: In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution shall be made public once it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative route according to Article 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, the interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Data Protection Agency within one month from the day following the notification of this resolution or directly a contentious-administrative appeal before the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, within two months from the day following the notification of this act, as provided in Article 46.1 of the said Law.
Finally, it is noted that, as provided in Article 90.3 a) of the LPACAP, the final administrative resolution may be suspended provisionally if the interested party expresses their intention to file a contentious-administrative appeal. If this is the case, the interested party must formally communicate this fact by writing to the Spanish Data Protection Agency, submitting it through the Agency's Electronic Register [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the remaining registers provided in Article 16.4 of Law 39/2015, of October 1. The interested party must also provide the Agency with documentation accrediting the effective filing of the contentious-administrative appeal. If the Agency does not have knowledge of the filing of the contentious-administrative appeal within two months from the day following the notification of this resolution, the provisional suspension shall be deemed to have ended.
Mar España Martí
Director of the Spanish Data Protection Agency
ANNEX 1
B.B.B.
C.C.C.
D.D.D.
E.E.E.
F.F.F.
G.G.G.
