| AEPD - PS/00201/2019 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 4(1) GDPR Article 14 GDPR Article 58(2)(d) GDPR Article 83(5)(b) GDPR Article 83(7) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | None |
| Parties: | AAA la Mancomunidad de la Comarca de Pamplona |
| National Case Number/Name: | PS/00201/2019 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | n/a |
The Spanish DPA (AEPD) held that a municipal council violated Article 14 GDPR by failing to inform data subjects of the processing of their personal data in a pilot project for a new waste managment scheme.
English Summary
Facts
The Mancoumnidad de la Comarca de Pamplona (MCP) launched a pilot project in certain districts for a new waste collection system that involved the use of magnetic cards that corresponded with different waste containers for regular and organic matter. Following the trial run, participating households recieved a letter from the MCP stating that they would be sent information with the opening details of the cards, including some points on improving their usage of the new waste management system. The complainant, Ms AAA, filed a complaint with the AEPD claiming that the actions of the MCP violated her right to information under Article 14 GDPR, because the MCP had failed to inform the participating households that their data was being collected, what data the MCP was collecting and how it was being processed. The MCP refuted the claim on the basis that no processing of personal data had taken place, meaning GDPR obligations did not apply.
Dispute
Are these magnetic cards personal data within Article 4(1) GDPR? If so, did the MCP infringe on the data subject's Article 14 right?
Holding
The AEPD decided that the material on the bins was in fact personal data, because the cards used postal addresses of natural identifiable persons. Subsequently, the AEPD decided that Article 14 GDPR had been violated during the implementation of the pilot test, as the MCP did not provide the parties affected by the processing with the necessary information to be provided to data subjects where their personal data is not obtained from them in the course of the processing. The AEPD then issued the MCP with a warning under Article 83(5)(b) and pursuant to Article 58(2)(d) ordered the MCP to adapt its information provision policy on the magentic cards in order to make it Article 14 compliant.
Comment
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
DECISION ON DISCIPLINARY PROCEEDINGS
From the procedure instructed by the Spanish Data Protection Agency and based on the following
FIRST: On January 4, 2019, a claim formulated by Ms. A.A.A., (hereinafter, the claimant) against the Mancomunidad de la Comarca de Pamplona, (hereinafter MCP or the Mancomunidad) was registered with the Spanish Data Protection Agency, stating that
"Six months ago, the Pamplona Community put into operation a new waste collection system that implies the need to use nominative cards per address in order to use the organic and other containers.
Now, about to finish the test of this new system, the Mancomunidad de Pamplona sends us a letter notifying us that in the next few weeks we will be sent "information with the opening details registered at your address".
Evidently, the Commonwealth of Pamplona had not informed users that data were going to be collected, what specific data were collected, nor the treatment and use that was going to be made of them, thus obviating the users' right to information".
The complainant attaches a copy of two letters sent in May and December 2018 by the President of the Association to the neighbours regarding the implementation of a pilot test to introduce a new card opening system for organic matter containers (brown) and rest containers (grey) in order to improve the results obtained in the selective collection of organic matter.
In the letter sent in May 2018, new features of the new system were identified:
" - The brown container opening key is replaced by a magnetic card;
- This card will open the brown container and, from now on, the rest container as well.
- Each household will receive two cards associated with the home address that will allow the data on their use to be recorded".
In the letter sent in December 2018, the President of the Commonwealth informed that "In the coming weeks we will send you information with the details of openings registered at your home or establishment, and with those points of improvement where you will be able to make progress in the event that the containers are not used properly".
SECOND: In accordance with article 65.4 of the Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter, LOPDGDD), on 19 February 2019 the Subdirectorate General for the Inspection of Data transferred this complaint to the MCP for its analysis and communication to the complainant of the decision adopted in this respect. Likewise, it was required that within a period of one month it send the AEPD certain information, among which was information on the causes that had motivated the facts that had given rise to the complaint and information on the measures adopted to prevent similar incidents from occurring.
On the 8th of March 2019, a letter from the MCP was registered in the AEPD indicating that the claim had been transferred to the company "Servicios de la Comarca de Pamplona, S.A.", (hereinafter, SCPSA), so that it could proceed to respond to the request made in accordance with the following:
- That the MCP is the Public Administration that owns the water supply and sanitation, waste management and urban transport services, with the management of the services corresponding to SCPSA, a public company with exclusive capital, in accordance with the provisions of Article 1 of the Regulations on Relations between the Association and SCPSA, approved by the General Assembly of the Association.
Article 2.3 of said Regulations attributes to SCPSA the material provision of the business activity, whose functions include the ownership of the legal relationship with the users of the urban waste management services entrusted.
Articles 3 and 4 of the Ordinance regulating Waste Management in the Community of Pamplona Region (BON nº 245 of 23/12/2013) reaffirm the condition of SCPSA as the holder of the relations with the users of the waste management service.
Article 1 of the Ordinance Regulating the Financial Benefits of
Non-tax public nature for the provision of Urban Waste Management Services 2019 (BON nº 249 of 28/12/2018) determines that the SCPSA provides and manages the above-mentioned services. Articles 3, 4.1 and 5.1 of this Ordinance set out the system for financing the service, based on its nature as an obligatory receipt, and derived directly from the ownership or use of the property, for which purpose the data from the Navarre Land Registry and the user file registered with the AEPD on 21/09/2009 by said company are used, the cadastral value being the taxable base for the public and non-taxable provision of property.
- That the CCM has not implemented the new waste collection system that implies the need to use nominative cards by address; nor has it requested any information from any citizen about the nominative cards in order to use the organic and other containers, lacking any information about the use of these cards.
THIRD: On March 20, 2019, a letter from the Data Protection Delegate of the SCPSA was registered in the AEPD, stating that the claim is not justified as no personal data processing has taken place, and therefore no specific measures have been taken in response to the claim, as the claimant has also been informed.
The Mancomunidad has the competence and responsibility for the collection and treatment services of urban waste, the integral provision of which it manages through its management company SCPSA, by virtue of the provisions of the Ordinance Regulating the Management of Urban Waste published in the Official Gazette of Navarre No. 17 of 7 February 2007.
The Waste Plan of Navarra 2017-2017 requires the competent public administrations and urban waste managers to adopt the necessary measures to achieve the recycling targets set in the Plan, establishing a separation at source of organic matter of 50% in 2020 and 70% in 2027.
In compliance with MCP/SCPSA's 2017 Annual Management Plan, the "p ilot project for the design of a system of containers for organic matter and other waste that allows users to be identified and the amount of waste deposited to be measured, with the aim of substantially increasing separation at source" was launched. "Among the actions implemented to achieve an increase in the separation at source of organic matter (also MO, from now on), is the pilot test consisting of establishing a system for opening closed MO containers, with opening by means of a card linked to the addresses that allows data to be collected for analysis of the impact and monitoring of their use. In order to carry out this monitoring, the postal address has been taken as the unit of measurement, and therefore no personal data have been taken into account for the management of the service,
It was decided to carry out this pilot project in two different areas of the region with a duration of one semester. The cards have the postal address to which the card is linked engraved on the outside. The delivery of the cards was done after communicating to the different postal addresses the existence and objectives of the pilot program. Two cards for opening containers were distributed for each postal address (home or local), and the total figures at the start of the project were 8,266 cards.
Each of the two cards has the same postal address in order to be able to record the use of the activity of that address. The information obtained is kept in separate databases in order to obtain and exploit statistical information on the use of the cards. While the use of the cards has not been limited to the owners (natural or legal person) or users of the postal address, nor has it been prohibited that their use be transferred to third parties, the information collected through the cards does not allow a direct and unambiguous relationship to be established with any identified or identifiable natural person. For this reason, the information obtained is not subject to the personal data protection regime as the definition of personal data in the RGPD is not fulfilled.
They point out that in order to obtain the postal addresses, the postal addresses of the cadastral units within the scope of the Mancomunidad de la Comarca de Pamplona that appear in the Register of Territorial Wealth of Navarre and which are subject to invoicing of the waste tax, according to the price ordinance for this service, have been used.
They provide capture printing of the front and back of one of these "Selective Waste Collection" cards meaning that it does not contain any personal data, only the postal address to which the card was delivered.
As for the application where the card data are stored, of which they provide capture of a record of the same, it is argued that it only contains data relating to the postal address, without storing other information that may relate that postal address with an identified or identifiable natural person. Each card has its unique identifier number and the data obtained is only referenced to that number. The card application and its related data are stored in the Commonwealth's Data Processing Centre.
They point out that during the development of the aforementioned pilot project, an indirect control of the use of the containers by the citizens and their changes of habits with respect to the previous situation has been carried out. As part of this action, it was considered of interest to send to the postal addresses of the cards the statistics on the use of the cards delivered to the respective postal addresses in order to be able to compare the results with the overall data. Previously, in December 2018, an information letter was sent informing that such a shipment would be made, which is what the complainant refers to, although it only indicates aggregate statistical data on the use of the cards delivered to their respective postal addresses for the purpose of being able to compare them with the overall data of the rest of the program's users. At no time has any data been indicated or used that would allow this information to be related to identified or identifiable natural persons.
FOURTH: In view of the documentation provided by the SCPSA, it can be seen that
From the capture print of the card provided, it is noted:
That on the front of it appears as "Selective waste collection"/"Hondakinen gaikako biketa", containing, among other information relating to the type of waste, the logo of the Commonwealth, a postal address with a street and floor number under which there is an identification number.
The back of the card reads: "This card is the property of the Mancomunidad de la Comarca de Pamplona and its use is subject to the conditions determined by the latter", which also appears in Basque, under which there is the logo of the claimed party linked to the "Mancomunidad Comarca de Pamplona"/"Iruñerriko Mankomunítatea" , also containing the contact details of the Mancomunidad's Citizen's Advice Service.
From the communications sent in May, June, July and December 2018 to the addresses of the neighbors affected by the mentioned pilot project, a copy of which has been attached to the letter of the SCPSA registered in this Agency on March 20, 2019, it is noted that they are headed by the logo of the claimed and signed by the President of the MCP, without any reference to the SCPSA.
Thus, for example, in the heading of the letter sent in June 2018 the following sentence: "As we recently announced in the letter sent by this Commonwealth, on 28 May we began the information actions on the occasion of the pilot test of the new container system".
The letter sent in July 2018 was also headed by the same person:
"As we recently announced in a previous letter from this Commonwealth, the pilot test of the new container system with magnetic card opening began on June 18 at ***LOCALIDAD.1.
FIFTH: In accordance with Article 65 of the LOPDGDD and for the purposes set forth in Article 64.2 thereof, on June 12, 2019 the Director of the AEPD agreed to admit the claim presented by the claimant
SIXTH: On November 14, 2019, the Director of the Spanish Data Protection Agency agreed to initiate the sanctioning procedure of warning to the claimed, in accordance with the provisions of article 58.2.b) of the RGPD, for the alleged infringement of article 14 of the RGPD, typified in article 83.5.b) of the RGPD.
In that agreement it was stated: "That, if the existence of an infringement is confirmed, for the purposes of Article 58.2 of the RGPD the corrective measure that could be imposed on the MANCOMUNIDAD DE LA COMARCA DE PAMPLONA, with a tax identification number (...), in the resolution, would consist of ORDENARLE, under the provisions of Article 58.2.d) of the RGPD, the adoption of the necessary measures to provide the magnetic cards for opening containers, used for the selective collection of waste, with the information relating to the items indicated in Article 14 of the RGPD when they include data on identified persons or, as in this case, include data on identifiable persons, for which purpose the provisions of Article 6 of the RGPD regarding the lawfulness of the processing should be taken into account. Such a measure must be adopted, where appropriate, within a period of one month calculated from the day following that on which the sanctioning resolution is notified, and the means of proof of its compliance must also be provided within the same period".
The aforementioned agreement to initiate the procedure was notified to the Commonwealth by electronic means on 15 November 2019.
SEVENTH : On November 28, 2019, a written statement of the Commonwealth's allegations to the aforementioned agreement of initiation is registered in this Agency, in which it indicates the measures that it has decided to adopt in order to comply with the obligations set out in Article 14 of the RGPD, and which are set out in Ground Law VI of this resolution.
EIGHTH: On 19 December 2019, a proposal for a resolution was made by the Director of the Spanish Data Protection Agency:
-A sanction of warning is imposed on the defendant, in accordance with the provisions of Article 58.2.b) of the RGPD, for an infringement of Article 14 of the RGPD, typified in Article 83.5.b) of the RGPD.
- The respondent shall be ordered in the resolution to be issued, pursuant to Article 58.2.d) of the RGPD, that it should prove that the information communications indicated in Basis of Law V of the proposal for resolution formulated had been sent to the interested parties affected by the pilot test, and that, if the system for opening containers studied were to be implemented throughout the Community, it had provided for the adoption of the necessary measures so that the magnetic cards for opening containers to be used for the selective collection of waste would offer the information relating to the points indicated in article 14 of the RGPD when they include data on identified or identifiable persons.
- Communicate the resolution to the Ombudsman.
The CCM was notified of this proposed resolution on 19 December 2019.
NINTH: On February 17, 2020, a written statement of the allegations of the MCP to the referred proposal is registered in this Agency, in which it communicates the measures that it has decided to adopt through the SCPSA, and that are cited in the Legal Basis VII of this resolution.
PROVEN FACTS
First: On January 4, 2019, a claim made by the claimant against the Mancomunidad de la Comarca de Pamplona (MCP) was registered with the Spanish Data Protection Agency, as it had not informed the interested parties about the processing of the personal data used in the framework of the pilot test carried out to implement a new opening system with a magnetic card for the containers of organic matter and other items.
Second: The MCP is the public administration that owns the water supply and sanitation, waste management and urban transport services, which it provides through "Servicios de la Comarca de Pamplona, S.A.", (SCPSA), a company with exclusive capital for the MCP.
Third: In compliance with the 2017 Annual Management Plan, the MCP started up a pilot project in two areas of the Region between June and December 2018, based on the implementation of a system for opening containers of organic matter and the rest by means of magnetic cards linked to the postal addresses of homes and establishments, which would allow the identification of users, the measurement of the amount of waste deposited and the monitoring of the use of these containers through the activity of using the cards.
Fourth, for each mailing address (home or premises), the CCM provided two container opening cards. Each card contained
On the front, the card is linked to the "Selective Waste Collection"/"Hondakinen gaikako biketa", with, among other information, the MCP logo, the postal address with street and floor number to which the card is associated and the card's unique identification number.
On the back, the following legend appears: "This card is the property of the Mancomunidad de la Comarca de Pamplona and its use is subject to the conditions determined by the latter", also written in Basque, the logo of the MCP associated with the "Mancomunidad Comarca de Pamplona"/"Iruñerriko Mankomunítatea", and the information contact details of the Mancomunidad's Citizen Service.
Fifth: The postal addresses used in the aforementioned opening cards were obtained from the cadastral units within the scope of the MCP that appear in the Register of Territorial Wealth of Navarre and which are subject to invoicing of the waste rate, according to the price ordinance for this service.
Sixth: The application in which the information on the use of the opening cards is stored records the postal addresses of the homes and establishments to which they are linked and their unique identification number.
Seventh: It is recorded in the sanctioning procedure that in the months of May, June, July and December 2018 the President of the MCP sent and signed as such, two communications addressed to the neighbors affected by the implementation of the pilot test. In these communications the President of the MCP informed about the reasons and scope of the new system, the operation of the cards delivered and the percentage result and separation of organic matter obtained with the information available at the date of the sending in question in relation to the objective programmed in the Waste Plan of Navarra.
All these communications show the logo of the MCP linked to the "Mancomunidad Comarca de Pamplona"/"Iruñerriko Mankomunítatea", and do not make any reference to the management company SCPSA or its participation in the development of the pilot test on which it is reported.
Thus, for example, in the heading of the letter sent in June 2018 the following sentence: "As we recently announced in the letter sent by this Commonwealth, on 28 May we began the information actions on the occasion of the pilot test of the new container system".
In addition, the letter sent in July 2018 stated in its headline: "As we recently announced in an earlier letter from this Commonwealth, the pilot test of the new magnetic card opening container system began on June 18, 2010 in ***LOCALIDAD.1".
Eighth: In the communication sent by the CCM chair in December 2018, he indicated, among other things
"With the information available at this time, it can be confirmed that the new opening system is offering encouraging results: in the case of ***LOCALITY.1 63% of the organic matter generated is being adequately deposited, which is a significant advance on the 18% with which the pilot experience began.
In the coming weeks we will send you information with the data of openings registered in your home or establishment, and with those points of improvement in which you will be able to advance in the event that the containers are not used properly".
Ninth: The communications sent by the MCP outlined in the above test events and the "Cards for the selective collection of waste" linked to the addresses that were given to the residents of the areas where the pilot test was implemented did not include the information indicated in Article 14 of the
RGPD.
LEGAL FOUNDATIONS
I
By virtue of the powers conferred on each supervisory authority by Articles 55.1 and 2, 57.1 and 58.2(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "PGDR"), and in accordance with Articles 47, 48.1, 77.1(c) and 2 of Organic Law 3/2018 of December 5, 2018, on Data Protection
Personal and guarantee of digital rights (hereinafter LOPDGDD), the Director of the Spanish Data Protection Agency is competent to resolve this procedure.
Article 63(2) of the LOPDGDD states that: 'The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, in this organic law, by the regulatory provisions issued in its implementation and, in so far as they do not contradict them, in the alternative, by the general rules on administrative procedures'.
II
Articles 1 and 2.1 of the RGPD provide as follows:
"Article 1.
1. This Regulation lays down the rules on the protection of individuals with regard to the processing of personal data and the rules on the free movement of such data.
2. This Regulation protects the fundamental rights and freedoms of natural persons, and in particular their right to the protection of personal data.
3. The free movement of personal data within the Union may not be restricted or prohibited on grounds relating to the protection of individuals with regard to the processing of personal data.
Article 2. Material scope
1. This Regulation shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data contained in or intended for inclusion in a file.
For this purpose, it is recalled that Article 4 of the GPRS, under the heading "Definitions", provides that
"For the purposes of this Regulation
1) "personal data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, localisation data, an online identifier or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity;
2) "processing' means any operation or set of operations which is performed upon personal data or upon sets of personal data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, limitation, erasure or destruction
Thus, in accordance with these definitions, the inclusion of the postal address monitored for use together with a unique identification number on each of the two magnetic cards delivered per postal address used (home or local) in the framework of the aforementioned pilot project constitutes processing of data on identifiable natural persons, developed by the Mancomunidad in two areas of the Pamplona District, with the aim of collecting data at source on the use by citizens of the new organic matter waste containers and the rest installed to facilitate the achievement of the recycling objectives set out in the Waste Plan of Navarre.
Therefore, the postal addresses included in the cards can be used to identify any individuals who are obliged to pay for non-taxable public property services - a condition attributed to the fees for urban waste management services - and who live in the area for whatever reason, occupy or enjoy the dwellings, premises, establishments or centres for the benefit or use of which this general and obligatory service is provided or arranged, and the natural persons who own the properties and are obliged to pay for this service may even be identified when the persons who benefit from the service are not known.
III
In the present proceedings, the Commonwealth is accused of violating the duty to inform provided for in Article 14 of the RGPD, which it establishes:
"Article 14. Information to be provided where personal data have not been obtained from the data subject
Where personal data have not been obtained from the data subject, the controller shall provide him/her with the following information:
a) the identity and contact details of the person responsible and, where appropriate, his
representative;
b) the contact details of the data protection officer, if any;
c) the purposes of the processing for which the personal data are intended, as well as the
legal basis of the treatment;
d) the categories of personal data concerned;
e) the recipients or categories of recipients of the personal data,
in your case;
f) Where appropriate, the intention of the controller to transfer personal data to a recipient in a third country or international organisation and the existence or absence of a decision of adequacy by the Commission, or, in the case of transfers pursuant to Article 46 or 47 or the second subparagraph of Article 49(1), reference to adequate or appropriate safeguards and the means to obtain a copy of them or the fact that they have been provided.
2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject
a) the period for which personal data will be kept or, where that
the criteria used to determine this deadline;
b) where the processing is based on Article 6(1)(f), the
legitimate interests of the data controller or of a third party;
c) the existence of the right to request access from the controller
to the personal data concerning the data subject, and to the rectification or erasure of such data or the limitation of their processing, and to object to their processing, as well as the right to the portability of the data;
d) where the processing is based on Article 6(1)(a) or Article 9(2)(a), the existence of the right to withdraw consent at any time, without affecting the lawfulness of the processing based on consent prior to withdrawal
e) the right to lodge a complaint with a supervisory authority;
f) the source from which the personal data originated and, where appropriate, whether
from public access sources;
g) the existence of automated decisions, including the development of
profiles, as referred to in Article 22(1) and (4), and, at least in such cases, significant information on the logic applied and the significance and expected consequences of such processing for the data subject.
3. The controller shall provide the information referred to in paragraphs 1 and 2:
a) within a reasonable time after the personal data have been collected, and at the latest within one month, taking into account the specific circumstances in which the data are processed;
b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject, or
c) if it is intended to communicate them to another recipient, at the latest at the time
when the personal data is first communicated.
4. Where the controller plans the further processing of personal data for a purpose other than that for which they were collected, he shall provide the data subject, prior to such further processing, with information about that other purpose and any other relevant information referred to in paragraph 2.
5. The provisions of paragraphs 1 to 4 shall not apply when and to the extent that
a) the interested party already has the information;
b) the communication of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, for the purposes of scientific or historical research or for statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or insofar as the obligation referred to in paragraph 1 of this Article would make it impossible or seriously impede the achievement of the objectives of such processing. In such cases the controller shall take appropriate measures to protect the rights, freedoms and legitimate interests of the data subject, including by making the information public;
c) the obtainment or communication is expressly provided for by Union law or by the Member States which applies to the controller and which lays down appropriate measures to protect the data subject's legitimate interests, or
d) where personal data must remain confidential
on the basis of an obligation of professional secrecy governed by Union law or by the law of the Member States, including an obligation of secrecy of a statutory nature.
This provision should be read in conjunction with Article 12 of the same Regulation, which provides in paragraph 1 that
"Article 12. Transparency of information, communication and modalities for the exercise of the rights of the data subject
1. The controller shall take appropriate measures to provide the data subject with all the information referred to in Articles 13 and 14 and any communication pursuant to Articles 15 to 22 and 34 relating to the processing, in a concise, transparent, intelligible and easily accessible form, using clear and simple language, in particular any information addressed specifically to a child. The information shall be provided in writing or by other means, including, where appropriate, by electronic means. At the request of the data subject, the information may be provided orally provided that the identity of the data subject is established by other means.
For its part, Article 11 of the LOPDGDD, under the heading "Transparency and information to the affected party", in its paragraph 3 determines that
"When the personal data have not been obtained from the data subject, the controller may fulfil the duty of information established in Article 14 of Regulation (EU) 2016/679 by providing the data subject with the basic information indicated in the previous paragraph, indicating an electronic address or other means that allows simple and immediate access to the remaining information. In these cases, the basic information shall also include
a) The categories of data being processed.
b) The sources from which the data came."
As stated in the aforementioned Article 11(2) of the LOPDGDD, the basic information referred to in paragraph 3 of the same Article must at least contain:
"“2. (…)
a) The identity of the data controller and his representative, in his
case.
b) The purpose of the treatment.
c) The possibility of exercising the rights set out in Articles 15 to 22
of Regulation (EU) 2016/679.
If the data obtained from the data subject are to be processed for profiling purposes, the basic information shall also include this circumstance. In this case, the data subject shall be informed of his right to object to the adoption of automated individual decisions which produce legal effects concerning him or significantly affect him in a similar way, where this right exists in accordance with Article 22 of Regulation (EU) 2016/679. IV
Based on the fact that in the previous Legal Basis II it has been justified that, at the dates in which the mentioned pilot test took place, the MCP carried out a processing of personal data consisting of including in the magnetic cards that were being monitored the postal addresses of natural persons that were easily identifiable, it is considered that the MCP is responsible for such processing according to the very content of the magnetic cards delivered to the neighbours of the postal addresses included in the cards and that In turn, it endorses the information provided by the President of the MCP to these neighbors in the communications he addressed to them between May and December 2018 on the occasion of the implementation and development of the pilot project associated with the new container system (Proven Facts Four, Seven and Eight), documentation, which, on the other hand, does not mention the SCPSA.
Based on the above, it is also proven in the procedure that during the implementation of the aforementioned pilot test, the CCM did not provide the interested parties affected by such processing with the information regarding the points indicated in Article 14 of the RGPD that must be provided to them when the personal data have not been obtained from them, as has occurred in this case in which the information on the postal addresses treated in the pilot test came from the cadastral units of the scope of the MCP that appear in the Register of Territorial Wealth of Navarre, and which are subject to invoicing of the waste rate, according to the price ordinance of that service (Fifth Proved Fact).
In this way, the MCP failed to comply with its duty of information by not providing the information relating to the points indicated in Article 14 of the RGPD mentioned above in the communications addressed to the interested parties or in the cards distributed to them for the opening of containers. This duty could have been fulfilled by providing in these documents the basic information indicated in Article 11(2) and (3) of the LOPDGDD and by indicating an e-mail address or other means that would allow simple and immediate access to the rest of the information.
As a result, the MCP, in its capacity as the party responsible for the processing of the personal data used in the pilot test developed to implement a new card opening system for the containers of organic matter and other items, has not shown the diligence required of it to provide the interested parties affected by this processing with the information indicated in article 14 of the RGPD, thereby infringing the right of the interested parties to be informed of the aspects indicated in said precept, since the personal data used had not been obtained from the interested parties themselves affected by the processing under study.
V
By virtue of the provisions of Article 58.2 of the RGPD, the Spanish Data Protection Agency, as the supervisory authority, has a set of corrective powers in the event of a breach of the precepts of the RGPD.
Article 58(2)(b), (d) and (i) of the GPRS, "Powers of Attorney", provides as follows
"2 Each supervisory authority shall have all the following corrective powers as set out below:
(…)
(b) sanction any controller or processor with a warning where processing operations have infringed the provisions of this Regulation
(...)
"(d) to instruct the controller or processor to bring processing operations into conformity with the provisions of this Regulation, where appropriate, in a particular manner and within a specified time limit;".
"(i) to impose an administrative fine pursuant to Article 83, in addition to or instead of the measures referred to in this paragraph, depending on the circumstances of the individual case;".
For the purposes of determining the sanction that could be associated with the conduct described, the following precepts must be taken into account:
Article 83 of the RGPD, under the heading 'General conditions for the imposition of administrative fines', provides in paragraph 5(b) that:
"“5. Infringements of the following provisions shall be punishable, in accordance with paragraph 2, by administrative fines of a maximum of EUR 20 000 000 or, in the case of an undertaking, of a maximum of 4 % of its total annual turnover in the preceding business year, whichever is the greater:
(…)
(b) the rights of the persons concerned under Articles 12 to 22
In turn, Article 72.1.h) of the LOPDGDD, under the heading "Offences considered very serious", provides:
"1. In accordance with Article 83(5) of Regulation (EU) 2016/679, infringements which substantially infringe the articles mentioned therein, and in particular those listed below, are considered to be very serious and shall be subject to a three-year limitation period:
(…)
h) The omission of the duty to inform the person concerned about the processing of his or her personal data in accordance with the provisions of Articles 13 and 14 of Regulation (EU) 2016/679 and 12 of this Organic Law".
In parallel, Article 83.7 of the RGPD states that:
"Without prejudice to the corrective powers of the supervisory authorities under Article 58(2), each Member State may lay down rules as to whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State".
To this end, Article 77(1)(c), (2), (4) and (5) of the LOPDGDD, under the heading 'Rules applicable to certain categories of data controllers or processors', provides as follows
"The rules laid down in this Article shall apply to processing operations for which they are responsible or in charge:
(…)
c) The General State Administration, the Administrations of the
Autonomous Communities and the entities that make up the Local Administration.
(…)
2. When the persons responsible or in charge listed in paragraph 1 commit any of the offences referred to in Articles 72 to 74 of this Organic Law, the competent data protection authority shall issue a decision punishing them with a warning. The decision shall also establish the measures to be adopted to cease the conduct or to correct the effects of the infringement that has been committed.
The decision shall be notified to the controller or processor, to his or her hierarchical body, if any, and to the data subjects who are data subjects, if any".
"Decisions taken in relation to the measures and actions referred to in the previous paragraphs shall be communicated to the data protection authority
5. The Ombudsman or, where appropriate, the analogous institutions of the Autonomous Communities shall be informed of the actions taken and the resolutions issued under this article.
In accordance with the above, the treatment carried out by the MCP during the development of the pilot test constitutes a breach of the provisions of Article 14 of the RGPD, as defined in Article 83.5.b) of the aforementioned legal text and qualified as very serious for the purposes of prescription in article 72.1.h) of the LOPDGDD, being able to be sanctioned with a warning, in accordance with the provisions of article 58.2.b) of the RGPD in its relation with the provisions of article 77.1.c) and 2 of the LOPDGDD. VI
In this case, the MCP in its pleading to the agreement of initiation communicated that it had "resolved to adopt the necessary measures to comply with the obligations indicated in Article 14 of the General Regulations on Data Protection and therefore will inform, through its Management Company, Servicios de la Comarca de Pamplona, S.A. to all interested parties on the points indicated in the aforementioned Article 14 of the RGPD", adding that "In the event that this information cannot be found on the card already distributed in the pilot test, the information will be provided by means of communication to the interested parties", also indicating that "the means of proof of the aforementioned communications will be provided to this Agency, once they have been made".
In view of this, the Instructor of the procedure considered it appropriate to propose to the Director of the AEPD the application of the provisions of article 58.2.d) of the RGPD, proposing to order the MCP not only to accredit the sending of the aforementioned communications to the interested parties affected by the pilot test with the information relating to the requirements contemplated in article 14 of the RGPD, but also to carry out the necessary actions to adapt the treatments similar to that studied to the provisions of the RGPD that have been violated. So that in the event that the system of opening containers by means of magnetic card that includes personal data that have not been obtained from the interested parties is implemented throughout the Mancomunidad, it will be necessary to establish the necessary mechanisms to comply with the duty to inform as set out in the aforementioned article 14 of the RGPD.
VII
After notification of the proposed resolution, the CCM claimed to have decided to adopt, through the SCPSA, the measures indicated below, which it communicated "before carrying out the communications and implementing the measures planned in the future":
a) Information communication to be sent to interested persons affected by the pilot test.
The attached copy, dated February 2020, bearing the CCM logo and signed by the CCM chair, contains, inter alia, the following information
"In June 2018, ***LOCALITY.1 (Pamplona) and ***LOCALITY.2
(Baerrioplano) were the two areas where the pilot experience of implementing the new waste collection system began, which incorporates the opening of the organic matter containers (Brown) and the rest (grey) by means of a magnetic card identified with the postal address on the outside.
In relation to the data recorded by these cards and their subsequent processing, the Spanish Data Protection Agency has pointed out the need to provide users with the information reproduced below:
<Each of the delivered cards includes a device that allows recording the number of openings of the different containers, data that will be associated to the postal address indicated on the outside of the card.
As it is data, sometimes relating to an identified or identifiable natural person, the information obtained concerning the opening of containers will be treated in accordance with personal data protection regulations.
All data collected as a result of the use of these cards will be treated under the responsibility of Servicios de la Comarca de Pamplona S.A. (SCPSA), in order to analyse the use of the containers in the fractions of organic matter and the rest, and specifically to find out the degree of use in order to achieve the applicable regulatory objectives, as well as to carry out information activities, promote the service and its results.
Likewise, we inform you that you can exercise your rights of access, rectification, suppression and the rest of the rights you have, by contacting the person in charge of the treatment through the mail proteccióndatos@mcp.es.
Additional information on privacy is available at www. mcp.es/wastefiles>>
The objective of complying with European legislation on waste and achieving an environmentally sustainable region committed to fighting climate change is a collective task that requires the contribution of each neighbour. (…)”
b) In order to comply with the duty to inform as set out in article 14 of the RGPD in the implementation throughout the association of the new card-based container opening system, the following basic information on data protection has been introduced in the opening cards, with an e-mail address that allows simple and immediate access to the rest of the information:
Person in charge: Servicios de la Comarca de Pamplona, S.A. You can exercise your rights at proteccióndatos@mcp.es. Additional information at www. mcp.es/waste data file.
It is argued that due to the limited space available to include in the aforementioned card all the basic information provided for in the applicable regulations, it has been arranged to provide a minimum of information that can be extended through the electronic address indicated, which will contain the additional information on data protection, the content of which is that indicated in the Waste Cards file.
c) Waste card file, housed in the url to which the letter refers
information www. mcp.es/wastefiles, (hereinafter the card).
The copy attached with the additional information in question shows that the following sections have been completed:
Who is responsible for the processing of your data, where SCPSA is identified as such, whose postal address and email are provided. The Data Protection Delegate is also identified and his address and e-mail address are provided.
For what purpose do we process your data? which states that "The data on the opening of the containers for each of the cards will be processed to analyze the use of the containers in the fractions of organic matter and the rest and specifically to find out the degree of use in order to achieve the regulatory objectives of application, as well as to carry out activities to promote the service and its results.
How long do we keep your data?
What is the legitimacy for the processing of your data?
To which recipients will your data be communicated?
What are your rights when you provide us with your data, including rights of access, rectification, deletion, limitation of processing, opposition and portability. It is added that "If you consider that the data has not been correctly processed, you can inform us by sending an e-mail to protecciondatos@mcp.es and then go to the control authority: Spanish Data Protection Agency". "How did we get your data?
Of the data of use of the card by the interested party.
From the register of Territorial Wealth approved by Regional Law 12/206 of 21 November.
The types of data processed are:
Identifiers. Name and surname, associated postal address.
Of transactions. Card usage data linked to the postal address."
In view of the contents of these documents, the following is noted:
- With regard to the information to be sent to the interested parties affected by the pilot test, the following statement must be eliminated "In relation to the data recorded by these cards and their subsequent processing, the Spanish Data Protection Agency has indicated the need to provide users with the information reproduced below:", since it is uncertain whether the AEPD has required the textual provision of the information that is deemed to be reproduced in the text in quotation marks, which is proven by the simple reading of the acts involved in the procedure.
- With regard to the additional information on data protection accessible through the url www. mcp.es/wastefiles that would be included in the cards, the following irregularities are detected in relation to the information to be provided in accordance with Article 14 of the GPRS
It is not recorded that the personal data being processed has been obtained from the data subjects, however, in the section on the time of conservation of the data it is stated that "The personal data provided will be kept (...)".
As regards the categories of personal data or types of data processed, information is provided on the processing of first names and surnames linked to the postal address on the cards, when the documentation on the procedure only includes the processing of the postal address as personal data processed on the cards.
In relation to the information referred to that "If you consider that the data has not been correctly processed, you may bring it to our attention through the e-mail address protecciondatos@mcp.es and then go to the supervisory authority: Spanish Data Protection Agency", it is noted that Article 14.2.e) merely indicates the duty to inform about "the right to file a complaint with a supervisory authority" without introducing any kind of condition prior to the exercise of that right.
VIII
Having established the existence of the infringement of the duty to inform provided for in Article 14 of the RGPD by the MCP during the development of the project analysed, and in view of the irregularities observed in the documentation reviewed, it is considered appropriate to apply the provisions of Article 58.2.d) of the RGPD, ordering the MCP to eliminate from the information communication to send the interested parties affected by the pilot test the statement contained therein referring to the Spanish Data Protection Agency.
Likewise, it is considered appropriate to order the MCP to carry out the necessary actions so that the processing of personal data included in the magnetic cards for opening containers to be implemented throughout the Commonwealth entails that, on the part of the data controller, the information to be included in the layered information system that has been allegedly used by the data controller is adapted to the requirements contemplated in the aforementioned precept, which will require the correction of the informational irregularities stated in the previous Legal Basis in relation to the additional information. (Waste Card File)
Such measures must be adopted within ONE MONTH, calculated from the day following that on which the decision in the procedure is notified, and the complainant must prove that it has been complied with within the same period of time by providing documentation or any other legally valid means of proof that makes it possible to verify its adoption and implementation in an irrefutable manner.
Therefore, in accordance with the applicable legislation and assessed the circumstances surrounding the infringement whose existence has been proven,
The Director of the Spanish Data Protection Agency RESOLVES:
FIRST: IMPOSE on the MANCOMUNITY OF THE COMMUNITY OF PAMPLONA, with
NIF P3112070B, in accordance with the provisions of article 58.2.b) of the RGPD, a warning sanction for an infringement of Article 14 of the RGPD, typified in article 83.5.b) of the RGPD.
SECOND: TO ORDER the MANCOMUNIDAD DE LA COMARCA DE PAMPLONA, with NIF P3112070B, under the provisions of Article 58.2.d) of the RGPD, to adopt the measures indicated in the Fundamento de Derecho VIII for the purpose of adapting the information to be offered to the provisions of Article 14 of the RGPD.
THIRD: TO NOTIFY this resolution to the COMMUNITY OF THE REGION OF PAMPLONA.
FOURTH : To communicate this resolution to the Ombudsman, in accordance with Article 77.5 of the LOPDGDD.
In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure in accordance with Article 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, data subjects may, optionally, lodge an appeal for reversal with the Director of the Spanish Data Protection Agency within a period of one month from the day following notification of this decision or directly lodge an administrative appeal with the Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998 of 13 July 1998, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned Law.
Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP, the final resolution may be suspended as a precautionary measure through administrative channels if the interested party expresses its intention to file a contentious-administrative appeal. If this is the case, the interested party must formally communicate this fact in writing addressed to the Spanish Data Protection Agency, presenting it through the Electronic Register of the Agency
[https://sedeagpd.gob.es/sede-electronica-web/], or through any of the other registers provided for in Article 16.4 of the aforementioned Law 39/2015, of 1 October. It must also send the Agency the documentation that accredits the effective filing of the contentious-administrative appeal. If the Agency is not aware of the lodging of the contentious-administrative appeal within two months from the day following the notification of the present resolution, it will terminate the precautionary suspension.
Mar España Marti
Director of the Spanish Data Protection Agency
