AEPD - E/01090/2021
|AEPD - E/01090/2021|
|Relevant Law:||Article 4(9) GDPR|
|National Case Number/Name:||E/01090/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
Spanish DPA holds that sharing documents containing personal data with the courts and other parties involved in the context of legal proceedings does not infringe the right to data protection, as in the rights of due process and legal defense have to be balanced against it.
A data subject made a complaint to the Spanish DPA because a party in a legal proceeding against the data subject shared with another counterparty in the same legal proceeding with the same data subject a legal document containing personal data of the data subject.
Can the right of data protection preclude sharing documents containing personal data with the courts and the other parties involved in the context of a legal proceeding?
The Spanish DPA, based on case-law from the Spanish Constitutional Court, held that in the context of legal proceeding where the data subject is a party, it is not necessary to ask for his consent in order to share documents that are used as evidence in a trial with the court and with the other counterparties in the proceedings.
The decision from the Spanish DPA does not analyze in detail the articles of the GDPR but makes a general balancing act between the right of data protection and the right to due process and the right to legal defense. It argues that individuals can't use data protection rights to avoid disclosing personal data that is relevant for the legal proceedings.
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/5 Procedure Nº: E / 01090/2021 RESOLUTION OF ACTION FILE Of the actions carried out by the Spanish Agency for Data Protection and based on the following ACTS FIRST: A.A.A. (hereinafter, the claimant) on July 4, 2020 filed claim before the Spanish Agency for Data Protection. The claim is directs against WALLNER EUROPA, S.L. with NIF B63809560 (hereinafter, the claimed). The reasons on which the claim is based are that the company WALLNER EUROPA SL or the law firm representing SINDREU ABOGADOS has provided the company ADGEST MANAGER S.L. an auto document of dismissal of precautionary measures requested by the claimant in a dismissal against WALLNER EUROPA S.L. You have filed a labor lawsuit against ADGEST MANAGER S.L. and has had knowledge that the order for the rejection of precautionary measures has been provided in the proceeding against said company. Along with the claim, it provides -Copy of ADGEST document, represented by FMI ABOGADOS Y ECONOMISTAS addressed to the Social Court no. 7 of *** LOCALITY. 1, of June 15, 2020, claim procedure amount *** PROCEDURE.1, and diligence of incorporation into the judicial procedure signed by the Attorney for the administration of Justice of June 18, 2020. The brief explains that “it challenges the request for precautionary measures and preventive seizure of assets because it is understood that the requirements". It indicates that there is no employment relationship with the claimant and "there is no indication any insolvency of the co-defendants that prevented the execution of a eventual conviction… ”It is illustrative for these purposes, signing the thesis of this, is provided as document 1, Writ in piece of precautionary measures, in procedure of the actor himself ... in claim of dismissal, against another entity financial Wallner Europa SL followed before the Social Court 4 of this city, in dismissal orders *** CARS.1. " The aforementioned order that you attached is dated February 5, 2020 with the claimant as plaintiff against Wallner Europa S.L, “in demand for dismissal with request of precautionary measure of preventive seizure of the defendant's assets, indicating that Since they were part of a Business Group with only one partner, they could transfer the assets or rights and divert funds from the entity to other companies of the group frustrating the possibilities of collection of the amounts requested. " At reasoning, the car analyzes the documentation provided by WALLNER: balance of situation and provisional operating account for the year 2019, annual accounts C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/5 of the 2018 financial year, as well as certificates of being up-to-date with Social Security or up to date with tax obligations for the purposes of contracts with the public sector. The order dismisses the request for precautionary measures presented by the claimant, indicating that the existence of circumstance any that lead to your request being considered. The operative part contains the rejection of the petition filed, with the name of the claimant, as well as in the header. The document on its left margin horizontally, along the folios, it contains a literal that warns: "The dissemination of the text of this resolution to parties not interested in the process in which it has been issued may only be carried out carried out prior dissociation of the personal data that they contain and with full respect for the right to privacy, the rights of the people who require a special duty of guardianship or the guarantee of the anonymity of the victims or harmed where appropriate. The personal data included in this resolution does not they may be transferred or communicated for purposes contrary to the law "- -Copy of order of the Judge of the Social Court 7, subject: defendant ADGEST in which the day after its presentation, June 16, 2020, gives transfer of the brief submitted by ADGEST to the complaining party, in order for them to allege what is convenient for you. SECOND: In view of the facts denounced in the claim and the documents provided by the claimant to the General Subdirectorate of Inspection of Data proceeded on July 23, 2020 to transfer the claim of in accordance with the provisions of Title VII, Chapter I, Second Section, of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). On August 6, 2020, the respondent responds: -The claimant throughout 2019 has filed on his own behalf and in representing his mother a total of seven legal proceedings in the matter of dismissal, claim for quantity, illegal assignment, violation of rights fundamentals against WALLNER EUROPA S.L. Indicates the number of procedures and the subject of each one of them. He states that upon receiving the first claim, he entrusted DURÁN SINDREU S.L. defense and representation in all proceedings, and that “El 9 June 2020, Wallner receives a call from lawyer B.B.B., from the IMF firm ABOGADOS Y ECONOMISTAS S.L., “who tells us that his client the company ADGEST MANAGERS, a competitor of WALLNER, has received demand from the claimant with identical motions of merits to those received by WALLNER. WALLNER forwarded said call to the lawyer of DURÁN SINDREU's office, C.C.C. to get in touch with attorney B.B.B. since the claimant had submitted identical claims to WALLNER and ADGEST and had requested against both precautionary measures. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/5 From the various conversations that took place between the lawyers and for the sake of the defense of our companies against claims with identical motions, the attorney C.C.C. provided the ADGEST attorney with the order dismissing precautionary measures issued. " It considers that the communication between lawyers of the aforementioned dismissal order "is It is part of the confidentiality and professional secrecy established in article 5 of the code of ethics of the Spanish Lawyers, not having violated the right any relation to Data Protection " On October 20, 2020, the claim is admitted for processing. FOUNDATIONS OF LAW I In accordance with the investigative and corrective powers that article 58 of the Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD) grants each control authority, and according to the provisions of article 47 of the Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD), is competent to resolve these investigative actions by the Director of the Spanish Agency for Data Protection. II The RGPD defines in its article 4: "1)" personal data ": any information about an identified natural person or identifiable ("the interested party"); an identifiable natural person shall be considered any person whose identity can be determined, directly or indirectly, in particular by means of an identifier, such as a name, an identification number, data from location, an online identifier or one or more elements of the identity physical, physiological, genetic, psychic, economic, cultural or social of said person; " 2) "treatment": any operation or set of operations carried out on personal data or personal data sets, whether by procedures automated or not, such as collection, registration, organization, structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, broadcast or any other form of authorization of access, collation or interconnection, limitation, deletion or destruction; 4) "file": any structured set of personal data, accessible in accordance with to certain criteria, whether centralized, decentralized or distributed in a functional or geographic; 7) "controller" or "controller": the natural or legal person, authority, service or other body that, alone or together with others, determines the purposes and means of treatment; whether the law of the Union or of the Member States determines the purposes and means of the treatment, the person responsible for the treatment or Specific criteria for their appointment may be established by Union law. or the Member States]. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/5 9) "addressee": the natural or legal person, public authority, service or other body to which personal data is communicated, whether or not it is a third party. Do not However, public authorities that may receive personal data in the framework of a specific investigation in accordance with the Union or Member State law; the treatment of such data by said public authorities will be in accordance with the rules on protection of data applicable to the purposes of the treatment; 10) "third party": natural or legal person, public authority, service or body other than the interested party, the person responsible for the treatment, the person in charge of the treatment and of the persons authorized to process personal data under the authority direct from the person in charge or the person in charge; " III The Constitutional Court has declared, in its Sentence 292/2000, of November 30, Regarding the fundamental right to data protection, “that the right to Data protection is not unlimited, and although the Constitution does not impose express- specific limits, nor refer to the Public Powers for their determination As it has done with other fundamental rights, there is no doubt that they must contradict them in the remaining fundamental rights and constitutional legal rights protected, as it is required by the principle of unity of the Constitution ”. The enforceability of the consent of the parties in the judicial processes for the contribution tation of documents in which the data of the counterparty appears would mean leaving the disposition of the former, the will to use it, which would result in the impossibility of to fully exercise their right to effective judicial protection, producing defenselessness Zion. Thus, the lack of these data or their communication to the counterparty may imply, lo- gically, a reduction in the possibility of contribution by the interested party of "the media pertinent evidence for his defense ", violating another of the guarantees derived of the aforementioned right to effective guardianship and restricting the possibility of obtaining the full development of this right. In view of this, the legislator has created a system in which the right to protection of personal data yields in those cases in which the legislator himself (constitutional or ordinary) has considered the existence of reasoned and fundamental reasons given that justify the need for data processing, incorporating said supposed to norms of, at least, the same rank as the one that regulates the gida. As stated by the reiterated jurisprudence of the Constitutional Court (for all, STC 186/2000, dated 07/10, with the citation of many others) "the right to privacy is not absolute, as none of the fundamental rights is, being able to yield to constitutionally relevant interests, provided that the cut that it has to experience is revealed as necessary to achieve the legitimate purpose envisaged, proportionate to in order to achieve it and, in any case, be respectful of the essential content of the right ". Therefore, the acceptance or knowledge of the affected party is not required for the transfer of personal data, when the communication is for judicial defense and as C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/5 recipients to the Judges or Courts within the exercise of their powers, including the cases in which it is evidence that, although it has not been Requested by the Judge or Court, they are provided by the parties. The action is subsumed in the right of all citizens to use all means of relevant evidence for your defense, in the exercise of your rights and interests legitimate, without, in any case, being defenseless, as indicated in the Article 24.2 of the Constitutional text that prevails in this case, also considering that the personal data of the claimant was already known by the defendant because it was the counterpart of a demand for quantity against them, and the document contained the reasons for the denial of the precautionary measures that he requested, so that with his transfer does not reveal intimate data of the claimant nor was his identity unknown to ADGEST. In the present case, the analysis carried out on the documents provided and the concurrent circumstances, there are no indications of infringement in the field competence of this AEPD. Therefore, in accordance with the provisions, by the Director of the Spanish Agency for Data Protection, IT IS AGREED: FIRST: PROCEED WITH THE FILING of these actions. SECOND: NOTIFY this resolution to the claimant and claimed. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure as prescribed by the art. 114.1.c) of Law 39/2015, of 1/10, of the Common Administrative Procedure of the Public Administrations, (LPCAP) and in accordance with the provisions of the arts. 112 and 123 of the same Law, the interested parties may file, optionally, appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month from the day following notification of this resolution or directly administrative contentious appeal before the Chamber of Contentious-administrative of the National Court, in accordance with the provisions of the Article 25 and in section 5 of the fourth additional provision of Law 29/1998, of 07/13, regulating the Contentious-Administrative Jurisdiction, within two months from the day following notification of this act, as provided in article 46.1 of the aforementioned Law. 940-0419 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es