AEPD - E/00739/2021
|AEPD - E/00739/2021|
|Relevant Law:||Article 12(5) GDPR|
Article 13 GDPR
Article 15 GDPR
|Parties:||UNIVERSIDAD MIGUEL HERNÁNDEZ DE ELCHE(UMH)|
|National Case Number/Name:||E/00739/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD decision (in ES)|
The Spanish DPA found that an access request was abusive, taking into account the context and the background of the relationship between the data subject and the controller. The data subject had previously filed various claims and lawsuits against the controller in other fields of law.
English Summary[edit | edit source]
Facts[edit | edit source]
A data subject filed a complaint with the Spanish DPA (AEPD) against a university where they had had different roles. The university provided the data subject with certain information (partly non-personal data too) and asked them to specify what additional information they required. They rejected the rest of the generic request with grounds on Article 12(5). The university alleged that they had tried to answer to the request on time but that they didn't have the resources, given that they have 26000 students, 1122 teaching and research staff, 521 administrative staff, 269 project staff; with a teaching structure of 7 faculties, 2 schools, 4 research institutes, 27 departments, 33 services and administrative Units, and 4 management centres, and the data subject had had a role in many of them, as an alumni, worker, and litigant.
The controller also held that they were implementing a more efficient system to handle data subject request. They claim that the data subject is just trying to diminish the university's functioning via different requests, claims and lawsuits, also in law fields other than data protection.
The data subject reiterated the initial request in the same terms. To this, the controller again alleged Article 12(5) and stated that it constituted an abuse of rights.
Holding[edit | edit source]
The AEPD aligned with the controller and found that the data subject was abusively exercising their rights in bad faith. The AEPD brought forward Article 12(5) GDPR, as well as Article 7 of the Spanish Civil Code, that states that rights must be exercised in good faith, and that it cannot be done in a way that the natural limits of the right are respected.
They also based their decision in the interpretation of such Article by the Spanish Supreme Court, saying that the abuse of rights entails the exercise of a right that, while complying with the formal requirements of such right, the essence of the rights, and its ethos and nature are not respected.
In this regard, the AEPD's records show that the complainant had abnormally exercised their right, both in quantitative terms (this was not the first time they had complained against the respondent) and qualitative terms (given the submission of applications with numerous claims that are not subsequently clarified by the data subject in order to facilitate their processing when requested to do so).
The necessity of good faith is also stated by the Spanish Procedural Civil Act in its Article 247, also interpreted by the Spanish Supreme Court, that has stated in this regard that complainants shall act in good faith, saying that acting in good faith also means not claiming to access data in a generic way when it can be done through other means. In this case, the AEPD condemns the negative of the data subject to narrow their claim, given that they are aware of the roles they had had in such university and can possibly know what particular information the university holds on them and what specific information they want to access.
Based on these grounds, the AEPD decides not to uphold the data subject's claim and archives the proceeding.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/10 Procedure No.: E / 00739/2021 RESOLUTION OF ACTION FILE Of the actions carried out by the Spanish Agency for Data Protection and based on the following FACTS FIRST: The claim filed by A.A.A. (hereinafter, the claimant) has entry dated November 20, 2019 in the Spanish Agency for the Protection of Data. The claim is directed against the MIGUEL HERNÁNDEZ DE ELCHE UNIVERSITY (UMH), with NIF Q5350015C (hereinafter, the claimed one). The reasons on which the claim is based are the following: That he addressed several writings to the defendant, 6 months ago, related to questions referred to data protection. He was told that they needed some time, but he had not yet have answered. Accompany the request made to the defendant in which he asks: What data do you have about the claimant? Where are they stored? Who has access to data ?, Is any graphic document saved ?, In what location and with what measures of security?. As they were previously sanctioned, you want to know what measures were taken to prevent further infractions. Request. Data, charts, titles, courses, accesses made to files with your data, and related employees. SECOND: On December 2, 2019, the claimant submits the briefs of answer of the claimed. On November 5, 2019, the respondent communicates the following: - As data controllers, who must provide you with all the information established in article 13 and 14 of the European Data Protection Regulation. That since the University is a complex entity in matters of personal data management, and since the claimant has been an employee, an employee with a disciplinary record, undergraduate student, master's student, course assistant, interested in administrative procedures, participant in selective processes, litigating party, contrary, etc ..., it is difficult to attend to the exercise of the right of access. That according to established in article 13.2 of the LOPDGDD request that it be more specific in its request, specify the treatment you want to access, to proceed to facilitate the access. - The claimant answers by requesting exactly the same thing that he already requested. - Based on the provisions of article 12.5 of the RGPD, they reject the request for excessive. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/10 THIRD: In accordance with article 65.4 of Organic Law 3/2018, of 5 December, Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), with reference number E / 00952/2020, a transfer of said claim to the defendant, so that it could proceed to its analysis and inform this Agency within a month, of the actions carried out to adapt to the requirements provided in the data protection regulations. The defendant answered the request for information stating that they had already answered the claimant to complete their application, since they have more than 26,000 students, 1,122 teaching and research staff, 521 people in administration, 269 hired from Projects; with a teaching structure of 7 faculties, 2 SCHOOLS, 4 Institutes of Research, 27 Departments, 33 Services and Administrative Units, and 4 centers management. Since the claimant has had numerous roles at the University, he is answered various questions raised in his request that had nothing to do with the right of access and was asked to specify what data and treatments he wanted to access. Answer by reiterating what was requested and therefore the requested access is denied understanding that it is excessive. They have tried to meet the legally established deadlines to answer, although it has not been possible. For this reason they have established the possibility of exercise of rights through the electronic headquarters so that the requests to competent persons. A protocol is being developed so that all those affected to exercise their rights act. FOURTH: On June 2, 2020, the Director of the Spanish Agency for Data Protection agreed to accept for processing the claim presented by the claimant. FIFTH: The defendant presented a brief of allegations to said admission, on date 23 June 2021, stating the following: After reiterating what was indicated in previous writings, he specified that of all his requests he has responded who was responsible for data processing and the measures to be taken they had taken after the resolution of the sanctioning procedure; and all the Sections in which your data were recorded so that you could specify what you were referring to. The claimant should not use data protection regulations as a subterfuge to hinder the normal functioning of an entity such as the University claimed, requesting information that can be obtained through different channels. Has been a clear abuse of rights, as reflected in numerous judgments. In many resolutions of the AEPD it is stated that the requests cannot be generic. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of Regulation (EU) 2016/679 (Regulation- General Data Protection Mention, hereinafter RGPD), recognizes each Authority Control, and as established in articles 47, 48.1, 64.2 and 68.1 of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), the Director of the Spanish Agency Data Protection is competent to initiate and resolve this procedure. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/10 Article 63.2 of the LOPDGDD determines that: «The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of the Regulation (EU) 2016/679, in this organic law, by the provisions regulations dictated in their development and, as long as they do not contradict them, in a subsidiary, by the general rules on administrative procedures. " II This procedure has its origin in the exercise of the right of access to its data and numerous documentation exercised by the claimant against the claimed. Article 12 of Regulation (EU) 2016/679, of April 27, 2016, General of Data Protection (RGPD), provides that: "1. The person responsible for the treatment will take the appropriate measures to facilitate the interested party all information indicated in articles 13 and 14, as well as any communication in accordance with articles 15 to 22 and 34 regarding the treatment, in the form concise, transparent, intelligible and easily accessible, with a clear and simple language, in particular any information directed specifically to a child. Information will be provided in writing or by other means, including, if applicable, by means electronic When requested by the interested party, the information may be provided verbally provided that the identity of the interested party is proven by other means. 2. The person in charge of the treatment will facilitate the interested party the exercise of their rights under articles 15 to 22. In the cases referred to in article 11, section 2, the person in charge will not refuse to act at the request of the interested party in order to exercise your rights under articles 15 to 22, unless you can demonstrate that it is not in a position to identify the interested party. 3. The person responsible for the treatment will provide the interested party with information regarding their proceedings on the basis of a request pursuant to Articles 15 to 22, and, in In any case, within one month of receipt of the request. Saying The term may be extended for another two months if necessary, taking into account the complexity and number of requests. The person in charge will inform the interested party of any of said extensions within a period of one month from the receipt of the request, stating the reasons for the delay. When the interested party presents the request by electronic means, the information will be provided by electronic means when possible, unless the interested party requests that it be provided otherwise. 4. If the person responsible for the treatment does not comply with the request of the interested party, inform without delay, and no later than one month after receipt of the request, the reasons for not acting and the possibility of submitting a claim before a control authority and to exercise legal actions. 5. The information provided by virtue of articles 13 and 14 as well as all communication and any action carried out pursuant to articles 15 to 22 and 34 they will be free of charge. When the requests are manifestly unfounded or excessive, especially due to its repetitive nature, the person responsible for the treatment may: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/10 a) charge a reasonable fee based on the administrative costs incurred to facilitate information or communication or perform the requested action, or b) refuse to act on the request. The data controller will bear the burden of proving the character manifestly unfounded or excessive of the request. 6. Without prejudice to the provisions of article 11, when the person responsible for the treatment has reasonable doubts regarding the identity of the natural person making the request referred to in articles 15 to 21, may request that the provide the additional information necessary to confirm the identity of the interested party. 7. The information that must be provided to interested parties by virtue of articles 13 and 14 may be transmitted in combination with standard icons that allow provide in an easily visible, intelligible and clearly legible way a suitable overview of the planned treatment. Icons presented in the format electronic will be machine readable. 8. The Commission is empowered to adopt delegated acts in accordance with Article 92 in order to specify the information to be submitted through icons and procedures for providing standard icons. " III Article 13 of the LOPDGDD determines the following: "1. The right of access of the affected party will be exercised in accordance with the provisions in article 15 of Regulation (EU) 2016/679. When the person in charge treats a large amount of data related to the affected person and it exercises its right of access without specifying whether it refers to all or a part of the data, the person in charge may request, before providing the information, that the affected specify the data or processing activities to which the request. 2. The right of access will be understood to be granted if the person responsible for the treatment provide the affected party with a system of remote, direct and secure access to data that guarantees, permanently, access to its entirety. Such effects, the communication by the person in charge to the affected party of the way in which he may Accessing said system will be enough to consider the request to exercise the right. However, the interested party may request from the person in charge the information referred to the points provided for in article 15.1 of Regulation (EU) 2016/679 that are not be included in the remote access system. 3. For the purposes established in article 12.5 of Regulation (EU) 2016/679, may consider the exercise of the right of access repetitive on more than one occasion during the period of six months, unless there is legitimate cause for it. 4. When the affected party chooses a means other than the one offered that involves a disproportionate cost, the request will be considered excessive, so that said affected will assume the excess costs that his election entails. In this case, only C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/10 The data controller will be required to satisfy the right of access without undue delay. " IV From the documentation provided by the claimant and the defendant, it is proven that the First, he went to the University requesting numerous information, both referring to the access to the data object of treatment by the claimed, as well as to other questions such as the measures taken by the defendant after the sanctioning procedure instructed by the Spanish Agency for Data Protection, people who have accessed to your data ... Regarding the exercise of the right of access, the complainant, in accordance with the established in article 13.1 of the LOPDGDD addressed the claimant informing him to specify what data he was referring to, adding that he had been a student, worker, litigant…; the claimant reiterates the initial request in the same terms, without specify which data you are requesting access to. Faced with this answer, the claimed resolves to deny the exercise of the requested right as it is considered excessive, and in accordance with the provisions of article 12.5 of the RGPD. Subsequently, the defendant submits a new statement of allegations in which he indicates that the claimant's request constitutes an abuse of rights, since in the multiple roles that he has maintained with the University, the litigating party stands out against it for different reasons, unrelated to data protection. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/10 Article 7 of the Civil Code (CC hereinafter), provides that: "1. The rights must be exercised in accordance with the requirements of good faith. 2. The Law does not protect the abuse of the right or the antisocial exercise of it. Any act or omission that, by the intention of its author, by its object or by the circumstances in which it is carried out manifestly exceeds the normal limits of the exercise of a right, with damage to a third party, will give rise to the corresponding compensation and the adoption of judicial or administrative measures that prevent persistence in abuse ”. Good faith is a general principle of law incorporated into positive law that translates into the imposition of a series of duties on whoever holds the ownership of a right. At the same time, the consideration that a right has been exercised in a abusive must be supported by objective, rigorous and true data, so that it is recorded proven that the right holder has manifestly exceeded the limits normal of this on the occasion of his exercise. In this regard, the ruling of the Supreme Court of 05/20/2002 states that “In this way, to the courts of this jurisdiction, the abuse of the right or the antisocial exercise of the same that the law does not protect (art. 7.2 of the CC), it supposes that even respecting the limits formalities with the actions carried out by those who are the holders of the rights produces a violation of the values or the axiological idea that is part of the content of the subjective right or of the norm whose objective is addressed ”. Therefore, sometimes, even while exercising the rights that the legal system recognizes and acting in a way that formally respects the requirements set by the law, its exercise is abusive. This, either because it is performed abnormally in relationship with the end pursued by the legal norm, or with the absence of an interest legitimate or exceeding in excess the natural limits of the right, to the point which is distorted in its essence. In this sense, the antecedents in this Agency regarding the claimant, an abnormal exercise of his right is revealed, both due to quantitative issues (it is not the first time that the defendant has been denounced) such as qualitative (submissions of applications with numerous claims that are not clarified to facilitate processing when requested). C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/10 For its part, in the Civil Procedure Law (LEC, hereinafter) and within Book I, Title VIII, dedicated to procedural good faith, establishes in article 247 that: "1. Those involved in all types of processes must adjust in their actions to the rules of good faith. 2. The courts will fundamentally reject the petitions and incidents that are formulate with manifest abuse of rights or involve legal or procedural fraud ”. In relation to the principle of good faith (either in its material aspect, art. 7 CC or in its procedural-formal aspect, art. 247 LEC) and its adequacy in the performance of the claimant, it is enough to make a reference to the literality of the requests and clarifications presented collected in the Facts of this resolution for evidence the absence of this principle. The Judgment of the Supreme Court of February 4, 2011 being especially revealing relapse into Appeal No. 425/2007, which analyzes an alleged violation of the right of access by a Public University with respect to an administrator who had permanent access to your data as a computer-enabled user, considering that invoking the absence of satisfaction of the right of access is contrary to the principle of good faith, because precisely he had the means to "Access your data" autonomously without having to go to the person responsible for the file. Specifically, in its Fourth Law Foundation, it provides that: Since this fact has to be taken for granted, it is clear that the request for access to the personal data collected in the letter of February 9, 2004 was reiterative, when not merely rhetorical; and, for this same reason, present a claim before the AEPD for breach of the duty to allow access to the personal data is, without any doubt, a behavior contrary to good faith. It is not fair to reproach another for not having done something that, in fact, they have already done. Y justify this imputation in the non-observance of forms and deadlines provided for in the law it is no longer an abuse of formal requirements, something that has traditionally been seen as one of the archetypal assumptions of violation of the general principle of good faith. Moreover, it is not just that the applicant had the possibility permanent access to your personal data by computer means, but in your letter of February 9, 2004 did not specify by what specific means of access he wanted his right to be satisfied; and, in these circumstances, affirm that it is denied access within the legally established period is simply abusive deformation of reality. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 8/10 It is peaceful, moreover, that the general principle of good faith should not only guide the actions of the Administration with respect to the administered, such as provides art. 3 LRJ-PAC, but also has to preside over the exercise of all kinds of rights by individuals by imperative of art. 7 CC. Since the exercise unfair right of access to personal data by the individual is not worthy of guardianship, the AEPD, as an administrative entity in charge of ensuring due to compliance with data protection legislation, it should not have considered that the UNED had violated the right of Don Manuel; and the same can be said of the court to quo, since the aforementioned decision of the AEPD is deemed to be in accordance with the law. For all this, the second reason for this appeal has to be upheld, which leads to the annulment of the contested judgment. In the present case, as stated at the beginning of this Resolution, the claimant you can get the desired access if you clarify the terms of your request as it is knowledgeable of the numerous roles that he has exercised in the claimed entity. When Rights are exercised by formally adjusting to the requirements established by the Law, but in an abnormal way, in such a way that its essential content is distorted, incurs an abuse of rights that the legal system in no case can protect. V C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 9/10 The claimant requests that a sanctioning procedure be initiated against the defendant. In this regard, it should be remembered that the sanctioning procedure constitutes one of the manifestations of the "ius puniendi" of the State and it always starts ex officio by the Director of the Spanish Agency for Data Protection, in accordance with provided for in article 68.1 of the LOPDGDD, as the Hearing has maintained National in judgments such as, among others, the one handed down in March 2006 (REC 319/2004). Therefore, it is the exclusive competence of the Spanish Data Protection Agency. assess whether there are administrative responsibilities that have to be clarified in a sanctioning procedure and, consequently, the decision on its opening, not existing obligation to initiate procedure before any request made by third, but it must be based on the existence of elements that justify said initiation of sanctioning activity. On the other hand, it should be remembered that, to define the condition of "interested" to urge to the exercise of the sanctioning competence of this Agency, the STS of October 6 of 2009 provides that the complainant is not interested, and does so in the following terms: "the complainant of an infringement of data protection legislation lacks active standing to challenge the resolution of the Agency in what concerns the sanctioning result itself ”(imposition of a sanction, amount of the same, exoneration, etc.) " Applying the peaceful doctrine of the Supreme Court, according to which "the complaint does not make the complainant the holder of a subjective right or personal interest or legitimate that would have to translate into a benefit or utility "the circumstance of having presented several complaints in this Agency, does not grant you the condition of interested party, all without prejudice to the circumstances surrounding the presentation of the same indicated in the Acts of this Resolution. SAW Ultimately, from the background examined and the complaints submitted, it is it follows that there are circumstances that allow questioning the serious purpose and legitimacy of the claimant in the exercise of their rights, allowing to identify their behavior as abusive and lacking in good faith. The claimant may request the exercise of the right of access against the claimed specifying your request, given that it is a University that carries out numerous differentiated treatments with students, workers, teachers, hired ... what you know having worked in the claimed entity; and being able request all the desired accesses, well differentiated, in accordance with the provisions of the data protection regulations. Therefore, in accordance with the provisions, by the Director of the Spanish Agency for Data Protection, IT IS AGREED: FIRST: PROCEED WITH THE FILING of these actions. SECOND: NOTIFY this resolution to the claimant and claimed. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 10/10 In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure as prescribed by the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations, and in accordance with the provisions of the arts. 112 and 123 of the aforementioned Law 39/2015, of October 1, interested parties may file, optionally, an appeal for reconsideration before the Director of the Agency Spanish Data Protection within a period of one month from the day following notification of this resolution or directly contentious appeal administrative before the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of article 25 and paragraph 5 of the provision Additional fourth of Law 29/1998, of July 13, regulating the Jurisdiction Contentious-Administrative, within two months from the next day upon notification of this act, as provided in article 46.1 of the aforementioned Law. 940-0419 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es