AEPD - PS/00245/2019
|AEPD - PS/00245/2019|
|Relevant Law:||Article 5(1)(a) GDPR|
Article 9(1) GDPR
Article 13 GDPR
Article 83(5)(a) GDPR
Article 83(5)(b) GDPR
Article 77 LOPDDGG
|Parties:||Departamento de Educación del Gobierno de Navarra|
|National Case Number/Name:||PS/00245/2019|
|European Case Law Identifier:||n/a|
|Original Source:||AEDP (in ES)|
|Initial Contributor:||Francesc Julve Falcó|
The Spanish DPA (AEPD) has imposed three different warning sanctions on the Department of Education of the Government of Navarra for infringing Articles 5(1)(a), 9(1), and 13 GDPR on the processing of data from surveys answered by schoolchildren.
English Summary[edit | edit source]
Facts[edit | edit source]
On 25 February 2019, an individual filed a complaint with the AEDP against the Department of Education of the Government of Navarra regarding a survey conducted by his son in class, asking him about intimate, family, and personal issues.
The respondent stated that the purpose of the surveys was to guide and inform schools and families about the level of education acquired by the schoolchildren. Together with these surveys, context questionnaires were provided to obtain information on the socio-economic and cultural conditions of the schools in order to contextualize the results obtained.
The respondent also explained in detail the respective organic laws that justified the collection of these personal data of the students, in order to know better the conditions of the students. At the same time, it also described the security and confidentiality measures that were being followed to protect this information.
The Department of Education of the Government of Navarra replied to the decision to initiate the procedure, agreeing with the allegations of infringement of Articles 5(1)(a) GDPR and 13 GDPR. On the other hand, they disagreed with the infringement of Article 5(1)(a) GDPR in relation to Article 9(1) GDPR with regard to the question of the gender identity of pupils.
Dispute[edit | edit source]
Should government surveys of underage students do comply with the principles of transparency, lawfulness, and fairness, respecting Articles 5 (1) (a), 9 (1), and 13 GDPR?
Holding[edit | edit source]
The Spanish DPA confirmed that the defendant collected specific personal data that was not necessary for the purpose in question. Therefore, if they could have achieved the same purpose without processing those data, there is no legal basis for processing them.
Consequently, the infringement of Article 5(1)(a) GDPR in relation to Article 9(1) GDPR is established. Article 13 GDPR is also considered to have been infringed as regards the information to be provided when personal data are obtained from the data subject.
The Spanish legal system has chosen not to penalize public bodies with a fine, as indicated in Article 77(1)(c) LOPDDGG, and paragraphs 2, 4, 5, and 6 of the same article.
In view of the above, the Director of the Spanish Data Protection Agency decided to impose three different warning sanctions: one for infringement of Article 5(1)(a) GDPR, another for infringement of the same Article 5(1)(a) GDPR in relation to Article 9(1) GDPR, and a third warning sanction for infringement of Article 13 GDPR.
Comment[edit | edit source]
Particularly interesting here is the argumentation according to which by asking to pupils whether they were a "girl", a "boy", or "other", what was being collected was a special category of data (about gender identity). This is interesting because actually Article 9 GDPR does not mention gender identity as a special category of data. It mentions sexual orientation, which the AEPD believes to be somehow connected to the "other" question. As a consequence of this being about "sensitive data", a legal basis allowing specifically for this processing is needed. However, the AEPD notes that Spanish law on these matters is based on a gender binary, and therefore cannot support questions including the "other" choice (see pages 28 and ff. of the Decision).
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/36 Procedure No.: PS/00245/2019 938-300320 RESOLUTION OF SANCTIONING PROCEDURE From the procedure instructed by the Spanish Data Protection Agency and in based on the following BACKGROUND FIRST: A.A.A. (hereinafter the complainant) dated 25/02/2019, filed a complaint before the Spanish Data Protection Agency against the DEPARTMENT OF EDUCATION OF THE GOVERNMENT OF NAVARRA (DIRECTORATE GENERAL OF EDUCATION) (hereinafter referred to as the Respondent). The complainant states that his son is studying at a state school in the 4th year of (4EP from now on) and has carried out a nominative survey where, among others issues, asks about "your gender (boy/girl/other), the language you use out of school, their feelings about school, their relationships with their peers, or profession of his parents, with special reference to the military career, issues that Understands that they are part of the student's privacy and family life". "To fill in the survey, students must access the web platform of the de- Education Department of the Government of Navarre (https://www.educacion.navarra.es/web/dpto/evaluacion-y-calidad/evaluacion/evaluacion-ex- terna/evaluacion-de-navarra/educacion-infantil-y primaria-curso-2018-2019)". SECOND: In view of the facts, the complaint was transferred on 1/04/2019 to inform the requested party of the causes of the incident, measures adopted to prevent similar incidents from occurring, and copy of the communications The Commission shall inform the complainant of the decision it has taken concerning the transfer of this claim. THIRD: The requested party states: 1) "Since the implementation of the Organic Law 2/2006, of 3/05, on Education (LOE), all The education authorities must carry out, during the primary education stage general diagnostic assessments of the core competencies achieved by their students (ED from now on). This legislation provides for the implementation of these assessments with census character [Articles 21 which indicated until its amendment by LO 2/2013 "At the end - czar el segundo ciclo de la educación primaria"-cuarto de primaria- y 144 de la LOE]. You are evaluations are of a formative and guiding nature for the centres, and informative for families and for the whole educational community". "In the Autonomous Community of Navarre, from the 2009/2010 school year to the This 4EP census is being conducted for the 2013/2014 school year. With the entry into force of Organic Law 8/2013, DE 9/12, for the improvement of the ca- In the case of the Education Ministry (LOMCE), this individualised census evaluation was maintained, but it was transferred to the C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/36 giving its application to 3rd and 6th year of Primary Education. See Articles 20, 21 and 144 of the LOMCE]. In the Autonomous Community of Navarra, a Census Diagnostic Evaluation was carried out in 3º Primary Education during the 2014/2015 school year and in 6º Primary Education du- The school year 2015/2016. During these two school years, no eva- diagnostic evaluation in 4EP". Royal Decree-Law 5/2016, DE 9/12, on urgent measures for the extension of the Article 3 of the LOMCE's implementation timetable abolished the census-based nature of evaluation in Primary Education, transforming it into an evaluation with a sample character where the selection of students and schools must be sufficient to obtain representative data at the level of each Educational Administration. So that from the school year 2016/2017 to date, in the Autonomous Community of Navarre assessments are being carried out Sample diagnostics in 3rd and 6th year of Primary Education. In order not to lose the individual character of the of diagnostic evaluations, and under Article 144.2 of the LOMCE, which provides that "education administrations may establish other evaluations with diagnostic purposes", in Navarra, the history of diagnostic evaluations was taken up again by censa- 4th year of Primary Education from 2016/2017. 2) In addition to DE, "simultaneous" context questionnaires are carried out, (CC in hereinafter) drawn up in accordance with criteria determined by the Ministry of Education, Culture and Sport, which provide information on socio-economic and cultural conditions The aim is to provide a context for the results obtained. See, for example For example, Article 7.5. of ROYAL DECREE 1058/2015, DE 20/11, regulating the general characteristics of the tests of the final evaluation of primary education are tableted in the LOE]: Simultaneously with the conclusion of the final stage evaluation, the following will be implemented context questionnaires, to be drawn up by the Ministry of Education, Culture and Sport. These questionnaires will provide information on socio-economic conditions and cultural centres for the contextualisation of the results obtained'. "Article 8 on results states: "1. The result of the final stage evaluation shall be expressed at the following levels for each of the competences: Insufficient (IN), Sufficient (SU), Good (BI), Remarkable (NT) and Outstanding (SB). The competent education authorities shall record the level obtained by each in an individual report, which will be given to the parents or legal guardians and transferred to schools where the students are to continue their schooling. The report will be of an informative and guiding nature for schools where have completed the sixth year of Primary Education and for those centres where they to attend the next school year, as well as for the teaching teams, parents or legal tutors and the student body." C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/36 3) In the Autonomous Community of Navarre, during the seven school years included between 2009/2010 and 2015/2016 (both inclusive), the DCs associated with DE to which The students' answers were made anonymously, allowing only the students to perform their tasks. The study of the factors influencing performance results is a key element of the school level. From the 2016/2017 school year onwards, it was agreed, subject to prior authoris The Directorate-General for Education, its online implementation (with identification and user). He states that once the questionnaire has been answered, no other user or teacher will be able to do so, neither student nor director can know the identification data of each student (except two members of the technical unit managing the evaluation procedure). "This The change is an advantage and an improvement over the statistical analysis carried out after the The information obtained can be used to link the results of each study to the other. The aim is to provide information on the social, economic and cultural conditions of the The students will be given a more detailed explanation of the course at the level of the students or groups of students within the same centre." This fact favours the detection of needs or strengths for the improvement of the system education, as more individualized information can be obtained. "During the current school year 2018/2019, the Community of Navarra is by carrying out, among other things, the 4EP census survey in all public centres and concerta two who are registered at that level of education. The online application phase of the CC for students was held in February 2019 and the competition tests were held in the The week of 6 to 12 October is the week of the first meeting of the 10/05/2019. You can access the online questionnaire for this school year at the link http://dpto.educacion.navarra.es/eed/ (the application must be accessed under the name Irati test user and Irati test password). The design, organisation and execution of the DE provided for in the LOE is one of the functions associated with the Evaluation, Quality, Training, Equality and Convi- Within this Service, the technical unit responsible for managing them is the Section of Evaluation and Quality. See DECRETO FORAL 5/2017 of 11/01, establishing the European Commission's ec the organic structure of the department of education]". "Access to the online application that allows you to carry out the survey, through a numerical user ID and an associated password, and the data that is recorded in the survey do not contain any nominative reference". "School addresses know the users and passwords aso- The students' names are shared with the teachers responsible for the supervision of the application of the survey in the centre (generally tutoring teachers). These data are not public and are only accessible to the director of each centre. The school is not allowed to use the school's own resources, but only after identification with personal credentials in the school management programme. EDUCA strainer. This information is also known by the technician of the Education that manages the assignment of users and passwords. "For the users surveyed, the online application only allows access to the en- It costs only once, so the answers are recorded and the centre cannot access them. der them. So the school does not know or have access to the answers recorded by their students. Neither did the Education Department technician who managed the assignment of users and passwords knows these answers. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/36 "The computer technician who designs and manages data collection through the en- does not know the nominal identification data of the respondents, it only knows the users and passwords". "The Department of Education guarantees the confidentiality of the data provided for each student in the online questionnaire. In this sense, only two technicians from the uni- The data analysts in charge of analysing the recorded data know the allocation of the identified res numerical (users) and the responses. This connection is necessary in order to link the individual results obtained in the performance tests of the different com- The following is a list of the main factors that have been taken into account to determine the success of the project and the associated contextual factors (collected by means of the questionnaire). In addition, the databases are stored on the network drives of the De- The schools are located in the Department of Education, and therefore are only accessible from within the Department itself. access to the computer equipment by means of a user and password which must be changed every 30 days". "For all the above reasons, it should be noted that although the survey does not is anonymous, personal data are pseudonymised, i.e. they cannot be attributed to an interested party without the use of additional information. Please note that This additional information is given separately and is subject to technical and organisational measures. The Commission has adopted a number of measures designed to ensure that personal data are not attributed to a natural person identified or identifiable. In fact, the RGPD explicitly introduces this in its Article 32, concerning the security of the processing of personal data, pseudonymisation as an appropriate measure to ensure a level of safety commensurate with the risk". 4) The questions in the questionnaire are not intended to attack convictions or privacy of the respondent, the objective being to collect the minimum necessary information to allow, after its subsequent analysis, contextualising the overall results of DE, providing information on the The following is an overview of the performance of the various competencies assessed, but also of the on the socio-economic and cultural conditions of the education system. In this respect, the usefulness of the survey is enormous, both for the schools themselves and for the Department of Education. 5) The CC is compulsory for each student of 4EP, although they can leave unanswered questions, it can even be sent with all your unanswered questions, "without consequences for the student". "The necessary collaboration of students and families responding to the survey, with It is important to detect needs and to design improvement plans in the centres. colare. Thus, for example, some studies useful for the education system as a whole, that would not be possible without the collaboration of families and students, are o From the questions concerning the parents' level of education, their level of occupation - The presence in the home of different consumer goods (magazines, housing, etc.) own, encyclopedias, books, mobile phone with internet access, tablet,) you can obtain the SOCIO-ECONOMIC AND CULTURAL INDEX (ISEC). Thanks to this indicator, at the level of centre, in the DE report, the centres have the ISEC of centre and the estimated for each competition in relation to that index, with the signalling of the The centre's location. The schools' ISEC is also used, within the C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/36 Department of Education, along with many other factors, when distributing the hours diversity awareness programmes allocated to schools. o Questions concerning the use of language in the school and family environment are useful at the The new courses are part of the Department of Education's internal curriculum, as they allow for studies on language use. The Committee is pleased to note that the following policies have been adopted to help improve the way schools are advised to to define and develop its Centre Linguistic Project (PLC). 6) "On the question of sex, with three answer options, the objective is simply is to give the survey an all-inclusive character. This also gives compliance with article 19.a) of the recently approved Provincial Law 17/2019, of 4/04, on The Commission's report on gender equality, which states that "in statistics and studies, the nistraciones Públicas de Navarra, to guarantee the effectiveness of the incorporation of gender perspective in their day-to-day work, they should systematically include the of sex, collecting the different categories, in all statistics, surveys and data that they carry out". It should also be stressed that other organisations are educating University of Navarra (UPNA) or the University of the Basque Country (UBP). (UPV), already include this format in their access questionnaires. Also with the same The term "inclusive" is used to cover the full range of family typologies. The "father" or the "mother" should be the same as the "father" or the "mother". Under no circumstances will I be su- It is not intended to indoctrinate or convince children or young people to take up the challenge. Some respondents simply collect and analyse the information that students and their families share for the diagnosis and improvement of education in Navarra. 7) "With regard to the question concerning the "level of employment" of the parents, I include The first is a series of blocks of possible professions, classified in five groups, from the lowest to the highest. at a higher level according to the professional category involved. Therefore, the profession is not registered. The value of a number from 1 to 5 represents the lowest or highest level of employment of the mother and father. In view of the above, it is impossible to deduce whether the respondent belongs to specifically to the category "basic, medium or high scale military", as mentioned in the claim, or to another category of that group. 8) "From the Technical Unit responsible for the questionnaire, it is acknowledged that the respondent The Commission's proposal for a Directive on the protection of individuals with regard to the processing of personal data and on the free movement of such data has not provided sufficient transparency and clarity, at least as far as the Commission is concerned. In the case of personal data, the information concerning the purpose of the processing will be provided in the form of a report. The purpose of the processing of personal data and the legal basis for such processing, as indicated in Article 13.1.c) of the RGPD and Articles 12 to 18 of the LOPDGDD". "Considers that at the information level, they should change the aspect of the aims of the processing for which the data are intended, the legal basis for the processing and the existence of the right to request from the controller access to, and rectification and deletion of, data data, and therefore: 1-An explicit reference is added to the basic information on protection of data in the action protocol sent to schools and published on the website of the Department of Education. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/36 2- A short letter will be drafted to serve as a model for schools and will be will provide a single, simple and clear information document (diptych or triptych type) where the carve out aspects of what an ED is, why it should be carried out, usefulness etc. This letter and the information document must be sent to all families. The docu- This information will also be published on the website of the Department of Education. the. - When the data is requested, and during the preliminary phase of preparation, in the application itself, the information provided in Article 13 shall be included in the home page of the RGPD indicates that it should be made available to interested parties (student and family). More specifically, when collecting the data, it will be presented within the of the interested party's vision, the following text: "In accordance with the provisions of the RGPD and Organic Law 3/2018 on Pro- Personal Data and Guarantee of Digital Rights, the data of character The evaluation and quality of the staff will be dealt with by the Evaluation and Quality Section of the Edu- The Government of Navarre's "responsible" role and its incorporation into the activity of the The "Primary Education Census Diagnostic Evaluation" treatment is aimed at to contextualise the overall results of the diagnostic evaluation, providing information on the The following is an overview of the performance of the various competencies assessed, but also of the on the socio-economic and cultural conditions of the education system or other factors associated with it such as language use, school and community climate or satisfaction with the school. We also inform you that you can exercise your rights The following are some of the options for access, rectification, deletion and portability of your data, limitation and objection The evaluation and quality section of the department is responsible for processing them, where appropriate. The Government of Navarre's Education Department at the e-mail address". " Purpose of the treatment To obtain information on the socio-economic conditions of the and cultural centres for the contextualisation of the results obtained, as well as as well as other factors related to school performance such as language use, the school and community atmosphere or satisfaction with the school. Legitimacy of processing (legal obligation) Rule enabling data processing: - Organic Law 2/2006, of 3/05, on Education (LOE). - Organic Law 8/2013, of 9/12, for the improvement of educational quality (LOMCE). It is mandatory to provide the data. There are no consequences for not doing so, although the The collaboration required is indispensable in order to contribute together to the improvement of the system educational. The online application of the survey allows you to leave questions unanswered. The recorded data will not be passed on to third parties. Exceptionally, for possible internal use in the technical units of the Department The data already analysed will either be sent globally, where there is no identification of the C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/36 The data would be shared anonymously or, if submitted, by the students themselves. The student's name is not mentioned, that is, without any reference to each student's ID. There are no international transfers of data. Data retention time: A maximum of 3 school years after the school year in which the re taking them. Automated decisions No automated decisions will be taken on the information fa- cylindrical". 9) The person claimed provides a copy of: A- "ACTIONS PROTOCOL" associated with the "CENTRAL DIAGNOSTIC ASSESSMENT SAL 4º DE EDUCACIÓN DE PRIMARIA CURSO 2018-2019", published in pdf on the website of Department of Education from 14/01/2019, on the link: https://www.educacion.na- varra.es/documents/27590/1381944/Protocolo_4EP_2018_2019_castellano.pdf/fe4a6b07- 50eb-12e9-88b6-ee2671d9156c, 16 pages, on file. It is included in the file with the name "EVALUATION 4 EP" You can access it, standing out: 1) The index refers to the protocol for the online application of the socio-economic and cultural questionnaire, who will carry out the tests, delivery and custody, specific instructions for the English language proficiency test, introduction of data, obtaining reports -student and centre-, custody of evidence. 2) On the protocol for the online application of the "socio-economic and cultural" in point B of the table of contents, page 3, is indicated as the most prominent: "The Department of Education will ensure the confidentiality of data provided by two for each student in the online questionnaire. In the diagnostic evaluation report, the centres will have the Socioeconomic and Cultural Index, the estimated scores for each competition in relation to that index, and the graphs with the regression line Performance-ISEC for each competition, with signalling of the centre's position. For the best application of the questionnaire, the centres will follow the instructions below: The questionnaire must be completed by all students in the 4th year of Primary Education, in accordance with the criteria set out in section "(E) Adaptation of tests". 2. The questionnaire will be available at the following address: http://dpto.educacion.navarra.es/eed/ 3. Each student will access the web application using a username (six ca- rical characters) and a personal password (four characters: two numbers and two le- after). CAUTION! This password can only be used once.... 5. School principals shall obtain the list of names The user name and passwords (as many as there are students enrolled) through the in- Educa Formatics C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 8/36 (Educa → School evaluation → Diagnostic evaluation). This list will also include the identification data of each student (cur- The name of the group and the full name). The directors will be able to access it from the 28/01/2019. At the time of application, the director of the centre will provide the names of The user name and passwords of each 4th year EP tutor (as many as there are students), for distribution to your students. 6. Preparation. Before applying, teachers, tutors, students and families will be able to practice freely, accessing the application with the following username and password sign of proof: Test user name: Irati Test password: Irati The centre can prepare the completion of the questionnaire in a way that will will be appropriate. In any case, it is considered convenient to carry out tutorial activities The students will be given a questionnaire, instructions on how to fill in the questionnaire, and a list of the questions to be answered. The Commission will be able to provide the necessary information and to answer questions at the time of implementation. tas. 7. Implementation session. This session will be planned by the tutorial staff, using the computers in the centre. The students will access the application, each tutor will distribute Each student will be given a username and password to enter in the application form. and fill in the questionnaire. It is easy to fill in, if it has been prepared in advance, and it is worth noting the if aspects: ...To end the questionnaire and save the answers, click on the In- viar. This is a prerequisite for saving the answers. If you have left any questions unanswered, when you click on the submit button, the application will be The Commission warns of this fact, and the questionnaire can continue to be filled in, or to terminate it by clicking on the send as is button. After clicking on the send button and completing the questionnaire, you will not be able to access any further vely with the username and password used. 8. Deadlines. The questionnaire will be completed between February 1 and 28. The questionnaires introduced after the deadline, will not be taken into account for the calculation of the centre's ISEC. It is It is advisable not to leave the application for the last few days, in case any pro- Access problem. 9. Clarifications and doubts. Any doubts that may arise may be referred to the Evaluation Section. and Quality, either by e-mail (email@example.com) or through the telephone .... C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 9/36 The correct completion of the questionnaire will allow the centres to have data more reliable and to know better important aspects for the education of their students. Section N contains "Obtaining student and school reports", in The student report is about the evaluation of the competence of the mathematics, English and linguistics. A report is also made with the overall results of the school's students as a whole. It is indicated that the EDUCA application through which the tests are instrumented provides, in addition to the reports, data files and files with the answers of the students, the questions left blank and the score obtained. It also focuses on that "the corrected booklets will be kept and preserved in the school until 30/11/2019 date from which they may be destroyed, and that "The student report is a valid instrument to be given to families in the context of the tutorial action, in the month of June". On the results, assessments and data from the evaluation reports of context, nothing is indicated. B-DIAGNOSTIC ASSESSMENT SURVEY 2018-2019 header with instructions among which it is reported that you have to "answer several questions about yourself and your family" headed by "sex", options: a-boy, b-girl, c-other options, model linguistic study, with references among the answers to options, in Spanish, B, in Basque with Spanish as a subject and some other subjects in Spanish, language in which he watches TV, or reads books or uses video games, social networks, talks to the teachers in the classroom and outside, which language they prefer (distinguishing) with friends in the street, in the school yard or at home with the family, on which continent you have born you, your mother, your father? Parents' level of education, their employment situation, work your parents' current job, with jobs and occupations as "Watchman" "worker of the field", "medical", "military architect of the upper scale", or "medium scale", if have their own single room, as is the relationship with their classmates on if you feel lonely, marginalized -Resolution 30/03/2016 of the Secretary of State for Education "defining the context questionnaires and the centre's common indicators for the evaluation of primary education", BOE 15/04/2016. Article 21 of the LOE provides for individual assessment of all students at the end of the sixth year and that the evaluation criteria and general characteristics of this evaluation for the entire Spanish education system will be established by the Government. - Royal Decree 1058/2015 of 20/11 regulating the general characteristics of the tests of the final evaluation of primary education established in the LOE. In its ar- Article 8.1, and in compliance with the provisions of Article 147 of the aforementioned LOE, determines The results of the final stage evaluations will be made available to the of the educational community, through common indicators for all schools and that these common indicators will be established by the Spanish Ministry of Education. cation, Culture and Sport. In the second section: "Context questionnaires": C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 10/36 1. The context questionnaires to be applied in the final evaluation of Education Primary will be three: One aimed at students in the sixth year of Primary Education who The evaluation (hereinafter referred to as the student questionnaire), another one addressed to their parents, and a third one addressed to the teachers. The following are some of the questions asked by the families, mothers and legal guardians (hereafter referred to as the family questionnaire), and a third one The following questionnaire was sent to the management of the primary school the address). 2. The questions and answer options that must be in- The following are the results of each of the questionnaires defined in the previous section in ANNEX ONE of this resolution In no way does it indicate that the questionnaire should be nominative, or anonymous or the destination or processing that is undertaken with such data. The ANNEX ONE, questionnaire, does not requests the inclusion of the student's name. Articles 144 and 145 of the LOE state: 144 "1. The evaluation criteria for individual evaluations indicated in articles 20.3, 21, 29 and 36 bis of this Organic Law will be common for the the State as a whole. In particular, the tests and procedures for the evaluations indicated in the Articles 29 and 36a will be designed by the Ministry of Education, Culture and Sport, through of the National Institute for Educational Evaluation. These tests will be standardized and design in such a way as to enable accurate assessments and comparisons to be made and monitoring the evolution of results over time obtained. The material execution of the tests is the responsibility of the educational administrations competent. The tests will be applied and qualified by the System's teachers Educational Spanish outside the centre. The procedure for the review of the results of the inspections will be regulated evaluations. Education administrations may establish other assessments for the purpose of diagnosis". 145 "Evaluation of the centres". "1. Podrán education administrations, within the framework of their competencies, to develop and to carry out evaluation plans for schools, which will take into account the socio-economic and cultural situations of the host families and students, the environment of the centre itself and the resources available to it. 2. Asimismo, education administrations will support and facilitate the self-evaluation of the educational establishments." LOE, Additional Provision Twenty-third. Students' personal data "1. Schools may collect personal data on their students that are C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 11/36 necessary for the exercise of their educational function. These data may refer to to the origin and family and social environment, to personal characteristics or conditions, to development and results of their schooling, as well as to those other circumstances whose knowledge is necessary for the education and guidance of students. 2. Parents or guardians and the students themselves must collaborate in obtaining information referred to in this article. The incorporation of a student into a school will imply consent to the processing of your data and, where appropriate, the transfer of data from the centre where he had been attending school with previously, under the terms established in the legislation on data protection. At in any case, the information referred to in this paragraph shall be strictly necessary for the teaching and guidance function, and may not be used for purposes other than educational without express consent. 3. Technical standards and regulations shall be applied to the processing of student data organisational arrangements to ensure their security and confidentiality. The teaching staff and the rest of the personnel who, in the exercise of their duties, have access to personal and family data or who affect the honour and privacy of minors or their families will be subject to the duty of secrecy. 4. The transfer of data, including those of a reserved nature, necessary for the system educational, will be carried out preferably by telematic means and will be subject to the legislation in protection of personal data. In the case of the transfer of data between Autonomous Communities or between them and the State, the minimum conditions shall be agreed by the Government with the Autonomous Communities, within the Conference Education Sector". LA LOMCE reformulated the wording of article 147 of the LOE, indicating 147: "The Government, after consulting the Autonomous Communities, shall present annually to the Congress of Deputies a report on the main indicators of the system the results of Spanish diagnostic evaluations or and the recommendations arising from them, as well as on the highlights of the Council's report on the education system State school. The results of the evaluations carried out by the education authorities shall be brought to the attention of the educational community through common indicators for all Spanish schools, without identification of personal data and after consideration of the socio-economic and socio-cultural factors of the context". 1) The claimant has been contacted by post to inform him of which is manifested to the AEPD. FOURTH: The complaint was admitted for processing by the Director of the AEPD on 11/06/2019. FIFTH: On 20/12/2019, it was agreed by the Director of the AEPD: C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 12/36 "FIRST: START THE PROCEDURE FOR PENALTIES against the DIRECTORATE GENERAL OF EDUCATION ( DEPARTMENT OF EDUCATION, GOVERNMENT DE NAVARRA), for the alleged infringement of Article 5.1(a) of the GPRS, in accordance with Article 83(5)(a) of the GPRS. SECOND: Initiate the procedure for sanctioning the DIRECTORATE GENERAL OF EDUCATION ( DEPARTMENT OF EDUCATION, GOVERNMENT DE NAVARRA), for the alleged infringement of Article 5.1 a) of the RGPD in relation to Article Article 9.1 of the same RGPD, in accordance with Article 83.5.a) of the said RGPD. THIRD: START THE PENALTY PROCEDURE for APPEAKANCE to the DIRECTORATE GENERAL OF EDUCATION- DEPARTMENT OF EDUCATION, GOVERNMENT DE NAVARRA), for the alleged infringement of Article 13 of the RGPD in accordance with the ar- Article 83.5(b) of the RGPD. SIXTH: Against the agreement of initiation, the claimed one dated 14/01/2020 makes the The following claims are made: 1) He agrees with the imputation of the infraction of article 5.1 a) of the RGPD and establishes as a proactive measure the review, deletion and modification of any data identification of the CC carried out during the course of 4EP 2018/2019. In the event that it is decided to continue In this and subsequent courses, the evaluation will be carried out anonymously, from so that the RGPD is not applicable. 2) The infringement of Article 13 RGPD is assumed, since when the CC were made, no information was provided on the results of the tests. The Committee has also adopted an appropriate position on data processing and the rights of parents and guardians of children. the students. Work is underway to establish a model clause. The department of Education has published an entire section on the website dedicated to Data Protection - of the register of processing activities, documentation of interest and models for educational institutions and managers and frequently asked questions about treatment of data in the field of education. 3) They do not agree that Article 5(1)(a) has been infringed in relation to The Committee is pleased to see that the RGPD is in line with 9.1 of the RGPD when the "other options" variant is included in the CC in the question "sex", although the service in charge of the evaluation did not determine any more specificities. The questionnaire referred to in the "other options" box. Including this option within the gender variable refers or is referring only to the gender identity of students, and the Spanish Data Protection Agency seems confuse it with sexual orientation or sexual life, which are especially protected by the European standard. Article 5 of the Provincial Law 8/2017 of 19/06 on social equality in the LGBTBI+ people in force at the time the questionnaires were taken and clearly differentiates "definitions for the purposes provided for in this foral law are - LGBTBI+ lesbian, gay, bisexual, transgender, intersex people and other minorities on the basis of sexual and/or gender identity, sexual orientation and/or gender issues. - sexual orientation orientation of erotic sexual or affective desire experienced by a per- The awareness of belonging to one sex is directed towards other sexual identities. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 13/36 - gender identity a feeling of belonging to a human group defined around the categories of men and women, identifying with either of them (binary) both (no bina- rio) or none (gender)". It ends by indicating that, without prejudice to the anonymisation of the CCAs that are carried out, From now on, this department understands that it did not violate article 9 of the regulation, since it was only asking for the gender identity of the students. SEVENTH: On 4/03/2020 it was decided to start the trial period requesting: 1) To the Department of Education of the Government of Navarra (Directorate General of education): 1.1.1.Provision or regulation of the Government of Navarra authorising or permitting resume diagnostic evaluations of 4EP from the 2016/2017 school year. On 2/06/2020 he replied that this was the decision of the Director General of Education 273/2016 approving the instructions that will regulate the course 16/17 the organisation and operation of centres. The fourth section, two, establishes the conditions under which the DE tests will be reapplied at the end of the 4EP It is in- The legal framework for the diagnostic evaluation will be coordinated by the evaluation section. and quality. It will have external tests that will evaluate competencies and will be applied and corrected in the schools. "This evaluation is of a formative and guiding nature- for the centres. The information obtained from this analysis will be relevant to the educational attention to the needs detected. The centres will decide when and how to for- The Committee is also concerned that reports should be sent to families before the end of the school year if they are not available. It is advisable that this is done in the context of the tutorial action". 1.1.2 What is the distinction between census-type and sample-type evaluations? It states that the census refers to the participation of the entire population under study, such as 4EP, which samples only a certain set of the target population study. 1.1.3 You said: "From the 2016/2017 school year onwards, it was agreed, before the end of the year, to The Commission has authorised the Directorate-General for Education to implement the online application of the socio-economic and cultural aspects of the diagnostic and individualised evaluations of the The Navarra education system will no longer be anonymous and will be accessed through a password per- The aim is to guarantee the confidentiality of the data provided by students in the Answers answered" In this connection, you are requested: -It is understood that what is done online, are both types of tests, the diagnostic competency tests, and context questionnaire tests? In this sense, it is requests that you report on the need or obligation for both types of questioning - The student must be identified, and the provision or rule from which this identity is deduced must be specified. tificability. It indicates that DE is a tool for diagnosing and identifying the degree of acquisition of The aim is to improve the basic skills of all students to include improvements at the individual level. and the centre. The need to generate reports for families in the area of ac C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 14/36 The tutorial is based on the level of acquisition of the assessed skills of each student. The diagnostic evaluation tests are nominal and in Navarre they are diagnostic tests have always been done manually on paper. The CC has been online since the academic year 2011/2012 and until the 2016/17 had always been answered anonymously 1.1.4. You are asked to report on the generation of the password keys and user in the questionnaires, in the diagnostic one and in the context one, moreover, if the keys user name and password are the same as the second one, if they are related or can be relate both questionnaires in terms of their author. As only the context questionnaire was done online, the answers were that: -Credentials were generated in the academic year 2018-19 that allowed the identification of the participating students. - "EDUCA's iidgnrpersona, the management information system, was used educational department of the Department of Education. The centres distributed the identifiers to the Students, each their own, and they completed the questionnaire. “ "As the questionnaire did not allow access for the second time, the centres could not The answers are known."" "In the Department, not all people had access to the answers to the questionnaire were able to identify the people The first of these was the introduction of a new system for the management of the health care unit. process, because they had the answers and also the list of identifiers and people." At EDUCA, users and passwords for the questionnaires for the 2018-19 academic year and an- The previous years have been eliminated (this is done each time the current school year is loaded). EDUCA only serves as a system to facilitate these credentials. Both the questionnaire as the response records are outside EDUCA. 1.1.5. In "Protocol of actions" associated with the "Census Diagnostic Evaluation 4ºEP curso 2018-2019" published on the Department of Education's website refers to The protocol for the online application of the socio-economic and cultural questionnaire is applicable. Above it, which appears in point B of the index, page 3 is indicated as the most outstanding - do For the best application of the questionnaire, the centres will follow the following instructions nes: -3: Each student will access the web application using a user (six numeric characters) and a personal password (four characters: two nú- Careful! This password can only be used once .... On the key generation system, they are asked for the mode of generation of the username and password, for this CC data to be filled in to obtain- the, method of storage, how long the questionnaires are kept, and which units, and people had access and why they could and should access it. It is reported that measures have been taken since the academic year 2019/2020, related to the issues which are the subject of this test: C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 15/36 The Director-General for Education issued an Instruction on 23 January 2020 the online questionnaire will be anonymous this academic year 2019-2020 and through a random key that will guarantee the confidentiality of the data provided by the student The answers to these questions are The copy of the reply, signed on 23/01/2020, also states: 'Once No other user, teacher, student, director or teacher has answered the questionnaire. The staff of the education department will be able to find out the identification data of each es- tudiante"." The directors of the centres will obtain through EDUCA the relation- The use of usernames and passwords to be allocated among the student body will be ra random." All records, archives and backups where the information could be accessed have been destroyed. confidential data of students from previous courses may appear. It also provides a pdf guide on the website called "day-to-day evaluation". Census data for the fourth primary school year 2019-2020, protocol of actions" It is indicated that from - The questionnaire should be filled in by all students who are studying 4EP and who, in order to access the Each application will use a random username/password but only once, even though it uses Passwords will be obtained through the EDUCA application and will be distributed randomly. tory to the students. There are also instructions for the assessment of competencies which is handmade on paper, in the form of booklets in which the answer is selected ta. It is indicated that a student report is generated and with the generic definition of the levels The level achieved in each assessed competence is directly scored by the The following information is provided for each test and space for observations can be filled in by your- tor or tutor . As for the custody of the evidence, it is said that the booklets were kept in They will be available and preserved until 30/11/2020. 1) To the Ministry of Education and Vocational Training - Institute of Evaluation and Educational Administrations: 2.1 Regarding the DE questionnaire on basic competences and CC, please to report: On which courses are they compulsory? On 12/03/2020, it indicates that Organic Law 8/2013 of 9/12 provides for three evaluations In the third and sixth grades (end of primary school), and in the second year of primary school, the daria, in the fourth year (Articles 20.3, 21 and 29). It states that CC are carried out in cases of: a) Individualised assessment of third year of primary education, with the following results The education authorities are responsible for regulating whether or not apply or not CC and of what type. b) It is carried out in the final evaluation of primary education, sixth grade, in accordance with Article 7.5 of RD 1058/2015 of 20/11 which regulates the general characteristics of tests of the final evaluation of primary education, it is indicated: "simultaneously with the the final stage evaluation will be carried out using context questionnaires which will The Ministry of Education, Culture and Sport. These questionnaires were described in the resolution of 4/12/2017 of the Secretary of State for Education, Vocational Training and Universities . These evaluations have been carried out at the end of the 2015-2016 academic year, until C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 16/36 2018-2019. The implementation of these evaluations is the responsibility of the government The Ministry of Education is responsible for compliance with these regulations. It refers to the appeal decided by the Constitutional Court on various provisions of the Royal Decree 310/2016 of 29/07, by Judgement 114/2019 of 16/10 which considers partially a positive conflict of competences and declares the unconstitutionality and nullity of the provisions of the aforementioned Royal Decree related to the preparation of the CC, which already is not within the competence of the Ministry of Education as it corresponds to (STCO 109/2019 FJ 9) because it "does not constitute a direct configuration of the requirements for obtaining a diploma academic. Therefore, Article 5.1 of the RD states that "as of the ruling, the information on the socio-economic and cultural background conditions of the centres The results of the survey will be obtained through the application of different context questionnaires", has not to be prepared by the National Institute for Educational Evaluation, of the Ministry of Education, Culture and Sport. The same sense of the content of this ruling is appreciated, referred to RD 1058/2015 which regulates the general characteristics of the final evaluation of Primary Education, is contained in the related plenary judgment of the T Co, No. 109/2019 of 3/10. CC are also carried out in the final assessment of Compulsory Secondary Education which is regulated by the provisions of Article 22 of Royal Decree Law 5/2016 of 9/12 on measures urgent for the extension of the calendar for the implementation of the Organic Law 8/2013. These questionnaires have been established by annual ministerial order for the courses 2016, 2.017, 2018. 2.1.2. Indicate if both questionnaires are developed in the same act. They say that CCs can be aimed at students, their parents and guardians and that addressed to the management of the primary school. He adds that in the schedules planned for the application of the tests a pe- The period for students to complete the CC and for families to complete the CC the questionnaire at your home. 2.1.3. Report whether both questionnaires are nominal and can and should be identified by the The student who completes the form will be given a copy. Legal basis from which this identification can be deduced He says that both the assessment tests and the QCs "are carried out in an ano- The It is clear that this statement is contrary to what has also been stated in evidence by the respondent who stated that the "diagnostic evaluation is of a nomi In Navarre, they have always been done manually on paper," although the question I could have understood the question about the various context questionnaires that exist. here. As for the legal basis: Third PD "It is the responsibility of the educational administrations. Within the scope of the Ministry of Education and vocational training the instructions given each school year reco- I expressly request that the evaluation data be processed anonymously. "To guarantee the Anonymity of the answers to the family questionnaire will be given out in envelopes that the families can use to send in their own answers. The Commission will be able to close the questionnaires once they have been filled in". PD, final evaluation C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 17/36 "Article 8.4 of Royal Decree 1058/2015 states that "the results of the evaluations The final stages will be brought to the attention of the educational community through in- dicators common to all Spanish schools without identification of data from personal nature and after consideration of the socio-economic and cultural factors of context. It should be noted that since the entry into force of Royal Decree Law 5/2016 the The evaluation is sample-based and has a diagnostic purpose, so the indicators are not common. The new system will be available for all Spanish centres. According to article 3: "the provisions of the Royal Decree 1058/2015 of 20/11 shall apply only to the extent that they do not conflict with this provision". Competence for the material conduct of the tests lies with the educational authorities. catives. In the area of the Ministry's competence, the annual instructions include in the following paragraph:' confidentiality. All participants in the evaluation process will at all times maintain the utmost confidentiality regarding the content of the and their results until they are made public. In any case, the personal data resulting from the application of the tests must be processed in accordance with the provisions of the regulations in force. “ ESO final evaluation Royal Decree 310/2016 of 29/07 regulating the final evaluations of Article 3.1(g) of the Secondary Education Act states that the following shall apply to educational administrations to take measures to ensure the custody and confidentiality of the evidence as well as ensuring the anonymity of the data of students in the correction and grading phase of the tests" Article 5.3 "Context questionnaires shall in all cases be anonymous". 2.1.4. Indicate whether the Institute develops uniform criteria related to the identification of The ability of the questionnaires/pupil. It states that the Institute coordinates the implementation of the evaluation in the field of com- The Ministry's competence. The identification of students in these evaluations is done me- The students are assigned a unique numerical code prior to the completion of the evaluation. The Institute does not know the correspondence between codes and names so cannot identify the student body. In 3rd year of PD, the only course in which the evaluation is individualized and a report is given of results to the students, the identification is done in the educational centres themselves and in the Provincial Directorates of Education in Ceuta and Melilla or the Regional Ministries of Education the different countries. Since the evaluations of 6th year PE and 4th year ESO are not individualized students are not identified at any time. The Institute shares with the Autonomous Communities the method used for the anonymisation of evaluations but it is up to them to implement this system or not. 2.1.5. On whether the Institute is aware of the context questionnaires that are carried out by the different Autonomous Regions, and whether to issue any kind of report. It states that it is not compulsory in relation to assessments of its competence. 2.1.6. On whether you have implemented in such questionnaires or addressed the issue of questions about gender identity? C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 18/36 It states that the Autonomous Communities drawn up by the Institute and those defined in the BOE for the 6th EP and 4th year of ESO that have been prescribed for all educational administrations has- The 2019/2020 course does not contain any questions on gender identity, only to the student if he or she is a boy or a girl and to the families the questionnaires refer to their child or daughter. 1) You can access the website of the claimed party at the following address: https://www.educacio- n.navarra.es/web/dpto/evaluación-y-calidad/evaluacion/evaluacion-externa/evaluacion-de- navarra/child and primary education - course 2018-2019, entitled "Protocol of actions of CENSAL DIAGNOSTIC ASSESSMENT 4th year of Primary Education Academic year 2018-2019", the file contains the name "webnavarra eva 4 instru" and The archive contains the publication of all the elements of the test. ba even the answers. It opens for verification, the maths test, com- and you can see that on the front of the booklet there are spaces for the identification cation of the student, centre, classroom, date, location, referring to the DE as mentioned. It is therefore proven that the competence assessment questionnaire developed in the diagnostic assessment test must be nominative. The guide for the use of the EDUCA computer application indicates that this application, tasks can be carried out according to an assigned profile and as an example, generate report for families in relation to the diagnostic evaluation, Identify the alumni The Commission has been exempted from this requirement, and has made observations, recorded responses, and access to the report on the results of the work of the Commission. There are three profiles: director, tutor and manager - management team and administrative staff. EIGHTH: A proposal for a resolution, of the verbatim, is issued on 8/09/2020: "1-The Director of the Spanish Data Protection Agency should sanction with a warning to the defendant, by: - a breach of Article 5(1)(a) of the GPRS, pursuant to Article 83(5)(a) of the RGPD. - a breach of Article 5.1(a) of the GPRS, in conjunction with Article 9.1 of the RGPD and 9.1 of the LOPDGDD, in accordance with article 83.5 a) of the RGPD. -a breach of Article 13 of the GPRS, pursuant to Article 83(5)(b) of the RGPD" Allegations are received on 23/09/2020 reiterating this. PROVEN FACTS 1) The complainant states that his son is in 2018/2019, 4th grade of primary school (9- 10 years) in an Associated School of the Autonomous Community of Navarre and has had to a nominal questionnaire which among other things contains questions such as sex: (boy/girl/other options), about the language you use outside school, your feelings to school, their relationships with their peers, or their parents' profession. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 19/36 2) In the Spanish primary education system, there are two modalities individualised diagnostic evaluation (ID) for all students. Third year evaluation: the degree of mastery of the skills will be checked, skills and abilities in oral and written expression and comprehension, calculation and resolution of problems. If this assessment proves to be unfavourable, the teaching team will have to adopt it, in collaboration with families, the most appropriate ordinary or extraordinary measures setting and implementing plans to improve individual or collective results that allow solve the difficulties. Final evaluation of Primary Education, in the sixth year, which will check the degree of acquisition of linguistic and mathematical communication skills, and of basic competences in science and technology, as well as the achievement of the objectives of the stage. The result of the evaluation will be expressed in the levels: Insufficient (IN), Sufficient (SU), Good (BI), Notable (NT) or Outstanding (SB). The level obtained by each student is will be recorded in a report that will be given to the parents or legal guardians. This report will will be of an informative and guiding nature for those schools where students have for the sixth year of Primary Education and for those who will continue their studies, as well as for teaching teams, parents or legal guardians and students. 3) Simultaneously with the conclusion of the final stage evaluation, the following will be applied context questionnaires (CC), complementary to the competence test, which will be drawn up ( at the date of the complaint ) by the Ministry of Education, Culture and Sport. These questionnaires provide information on the socio-economic conditions and cultural centres for the contextualisation of the results obtained. Royal Decree 1058 /2015 of 20/11 regulating the general characteristics of the tests of the final evaluation of primary education established in the LOE in its article The following is a summary of the results of the evaluations carried out in the sixth year of primary school by the CC indicates that there would be three, one for the student, one for the families and one for the school do- and that "the questions and answer options that must be included in each of the questionnaires defined in the previous section are those indicated in ANNEX ONE of the resolution" 4) The education regulations provide that the Autonomous Regions may carry out other evaluations for diagnostic purposes, in accordance with Article 144.2 of Organic Law 2/2006, of 3/05, on Education, modified by the Organic Law 8/2013, of 9/12, for the Improvement of Educational Quality. In the Autonomous Community of Navarre, this power is used and ED and CC are carried out for the fourth year of primary school from the 2009/2010 school year. In the Autonomous Community of Navarre, the EDs are carried out on forms that are named for each paper format,(booklets in which the data for each student is filled in at the the test, considering that it has been carried out in accordance with the to relate the degree of acquisition of competences and improvement of the student. 5) In the Autonomous Community of Navarre, during the seven school years between 2009/2010 and 2015/2016 (both inclusive), the forms for the fourth grade CC that the students respond to were made anonymously, without containing their data C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 20/36 personal. From the 2016/2017 school year, "it was agreed", to carry out the CC through a application, online, no longer anonymous, accessed through the pair (user password) that was assigned to the students. In the academic year 18-19, the CCs were during the month of February 2019 and the DE tests during the week of 6 to 10/05/2019. 6) The respondent had a PROTOCOL of action associated with the assessment census diagnosis of the fourth year of primary education for 2018/2019 published on its website since 14/01/2019, in which it referred to both DE and CC tests. In the pun- In addition to 5 of the INSTRUCTIONS for the implementation of the questionnaire, it was indicated (for the questions In the case of the context studies, which were carried out online, the DE was done on paper, while the directors of the A list of user names will be made available to teachers and school principals. The computer application allows you to enter your name and password, as well as the number of students enrolled. EDUCATE. This list will also include the identification data of each student (course, group and full name). The directors will be able to access it from the of 28/01/2019. At the time of application, the director of the centre provides The usernames and passwords will be given to each 4th year EP tutor (as many as there are students), for distribution to their students. The test is carried out using the centre's computers, distributing each tutor to each student their username/password to be entered in the application and complete and submit the questionnaire. Before sending it, the application warns of possible unanswered questions, and may disregard this option and terminate the How to send it as it is, or fill in what is missing. 7) The personal data of the students collected in the forms of the CC were stored in the databases of the respondent that were kept in the network units of the Department of Education server, accessible from within of the Department itself, and on the computer equipment by means of a user name and password. 8) In the form of the CC associated with the DE, for the 2018-2019 fourth year of primary school, The "Questions and answer options which must be included in the The "PUPIL QUESTIONNAIRE" is included in each of the questionnaires instructions, informing that you have to "answer several questions only". and your family". All questions are answered by ticking boxes in the answers. The following are offered under the heading of "sex", options: a-boy, b-girl, c-other "For the sake of the How often have you missed this course in an unjustified way? How many days a week you dedicate to doing homework? options, linguistic model in which you study, with references among the answers to options, in Spanish, B, in Basque with the caste- The course is taught in Spanish, the language in which you watch television, or reads books or uses video games, social networks, talks to teachers in the classroom and was ra, which language he uses preferably (distinguishing) with friends in the street, in the courtyard from school or at home with your family, on which continent were you born, your mother, your father? Parents' level of education, their employment situation, your parents' current job, with trades and example jobs such as "watchman" "farm worker", "doctor", "architect "upper scale military", or "middle scale", if they have their own single room, as is the relationship with his classmates about whether he feels lonely, marginalized. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 21/36 The context questionnaire does not have to contain the identification data of the student who is carrying out the This follows from the analogical application of the provisions for these CC in the RD which refers to the CC for the compulsory tests of the sixth year of primary school 9) Filling in the CC form is compulsory for each student in the fourth year of primary, although questions can be left unanswered, it can even be sent with all your unanswered questions. 10) As stated by the respondent, the legal authorisation for the processing of data for the CC is the fulfillment of a legal obligation derived from the LO 2/2006, LOE, with amendments to the LO 8/2012 LOMCE, although no regulation states that the CC must contain the student's identification data. The aforementioned regulations for education The primary education system consists of the Organic Law 2/2006, of 3/05, on Education, modified by the Organic 8/2013, of 9/12, for the Improvement of Educational Quality, which provides in its article 21 conducting an individual assessment of all students at the end of the sixth Primary Education course. The Royal Decree 1058/2015, of 20/11, regulates general characteristics of the tests of the final evaluation of Primary Education, 11) On the question in the CC of, sex of the student completing the questionnaire, with three response options, boy-girl, other options, was introduced unilaterally by the one requested in application of Article 19.a) of the Provincial Law 17/2019, of 4/04, on equality between men and women, which points out that "in statistics and studies, the The aim is to ensure that the public authorities of Navarre are effective in incorporating the perspective of in their day-to-day work, they should systematically include the variable of sex, rec The different categories, in all statistics, surveys and data collection that they carry out". As determined by the rules applicable to the CC, the questions of This questionnaire was prepared by the Ministry of Education, which did not introduce any aspect of the guno on the subject. If it was pointed out that education administrations could introduce new issues, but not expand on them. 12) With the EDUCA application in which the data is stored, it is possible to produce information on the month and access the questionnaires, see the answers, the questions left blank, and the score obtained. The "corrected booklets", alluding to ED, are kept in the school until 30/11/2019. Families are given a "student report at the month of June" (13) At least in the CC, there was no reference to the collection, storage, storage, processing and distribution of the products. The processing of personal data, the legal basis or the exercise of rights chos. It is not known if the same thing happened in the diagnostic skills questionnaire (DQ) which has not been the subject of the complaint, although the interdependence between am- bos. (14) In the course of these proceedings, the respondent has stated that -You have added explicit references to the basic information on data protection in the protocol of actions sent to the schools and published on the website of the De- Education Department. -Implementing the information on DE and CC that will be given to the families, in addition to be exhibited on the Regional Ministry's website. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 22/36 -The information aspects of data collection and processing will be provided when the data is requested in the online application itself. -Provides for a data retention period of three school years following the school year in which they are collected. - Users and passwords for the cur- so 2018-19 and earlier (this is done each time the current school year is loaded) and in evidence claimed to have destroyed all records, files and backups in which data on students from previous courses may appear. The Director-General for Education issued an Instruction on 23 January 2020 it is provided that the CC online will be anonymous this academic year 2019-2020 and through a key random. -The protocol of actions for the questionnaires for the 2019-2010 academic year has been changed of the fourth year of primary school published on the web. LEGAL FOUNDATIONS I By virtue of the powers conferred on each authority in Article 58(2) of the GPRS control, and in accordance with the provisions of Articles 47 and 48.1 of the LOPDGDD, the The Spanish Data Protection Agency is competent to resolve this procedure. II As a starting point, it should be noted that the twenty-third additional of the Organic Law 2/2006, of 3/05, on Education, generally establishes the principles in relation to the processing and communication of personal data within of its scope, by providing for the following: "1. Schools may collect personal data from their students that are necessary for the exercise of their educational function. Such data may make reference to the origin and family and social environment, characteristics or conditions and results of their schooling, as well as those of other circumstances whose knowledge is necessary for the education and guidance of the students. 2. Parents or guardians and the students themselves must collaborate in obtaining the information referred to in this article. The incorporation of a student to an educational establishment will imply consent to the processing of its data and, where appropriate, the transfer of data from the centre where it was schooling, under the terms established in the legislation on data protection. In any case, the information referred to in this section will be the strictly necessary for the teaching and guidance function, and cannot be treated for purposes other than educational without express consent. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 23/36 3. In the processing of student data, normas técnicas and organisational arrangements to ensure their security and confidentiality. The teaching staff and the other personnel who, in the exercise of their duties, access personal data and or that affect the honour and privacy of minors or their families will be subject to the duty of secrecy. 4. The transfer of data, including those of a reserved nature, necesarios to the educational system, will be carried out preferably by telematic means and will be subject to legislation on the protection of personal data, and the minimum conditions shall be agreed by the Government with the Communities Autonomous within the Sectoral Conference on Education". In this complaint, the issue at stake is the competence of the assessment of the quality of teaching by means of questionnaires, in this particular case, not in the The evaluation of acquired knowledge is not the same as the evaluation of socio-economic factors and cultural issues related to the homes, environment and environments where the student. For example, the Socio-economic and Cultural Index (ISEC), which also includes among others, in the PISA tests, is calculated from some of the answers of The students and their families in the context questionnaires, which summarise various aspects of the training on the social and family context of the students and is elaborated from data as the level of education of the father, mother, their professions, or level of resources do- The use of a computer for personal use is also possible. On whether for the 2018/2019 academic year the current regulations required the course to be Some kind of context assessment, and if required, if this is a requirement, is must be anonymous or identifiable, it should be noted: Even with the modification of the LOE by the LOMCE (2013), it is not apparent that there is a reference to the obligation to carry out any evaluation of the students of 4EP. An- Article 21 of the LOE also did not indicate that it was obligatory or census, stating: "At the end of the second cycle of primary education all children centres will carry out a diagnostic assessment of the basic skills achieved by their students. This evaluation, which is the responsibility of the educational administrations, will have training and guidance for the centres and information for families and the community together with the educational community. These evaluations will have as a reference framework the general diagnostic evaluations established in article 144.1 of this law". Article 20.3 of the LOMCE states "Schools will carry out an individualised assessment of all pupils The school will be open to all students at the end of the third year of Primary Education, as arranged by the Admissions Authorities. The educational institutions, which will check the degree of mastery of the skills, ca- patience and skills in oral and written expression and comprehension, calculation and problems in relation to the degree of acquisition of competence in line-based communication and mathematical competence. If this assessment is unfavourable, the team will be able to The teacher shall take the most appropriate ordinary or extraordinary measures Since 30/12/2013 the diagnostic evaluation is on the teaching of sixth form. It follows that it will not be anonymous, as Article 21(3) indicates that the result of the analysis will be published in the Official Journal of the European Union. The certificate will also be given to the parents. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 24/36 It indicates that with the entry into force of the LOMCE, the individual assessment The 4EP census was maintained for the 3rd and 6th grades of primary school, and that voluntary In accordance with Article 144.2 of the LOMCE in Navarre, the historical evaluation of the 4EP diagnostic census data from 2016-2017. The result is that there is no obligation derived from the law, which expressly establishes the carrying out of any kind of evaluation, or specifically the evaluation of context, although article 144.2 of the LOE states: "The educational administrations may establish other assessments for diagnostic purposes. claimed Taking as an example of context evaluation, that of the end of primary school, it is pointed out in Royal Decree 1058/2015, in its article 7.5, which at the same time as the of the final stage evaluation, context questionnaires developed by the Ministry of Education, Culture and Sport. These questionnaires will make it possible to obtain information on the socio-economic and cultural conditions of the centres for contextualisation of the results obtained. Also in its article 8.1, and "giving compliance with Article 147 of the LOE, the results of the final stage evaluations will be brought to the attention of the educational community through common indicators for all Spanish schools, and that these common indicators will be established by the Ministry of Education, Culture and Sport." On whether the applicable regulations establish that the data from the context questionnaire must be anonymous, or the resolution of 30/03/2016 of the State Secretariat for Education, Vocational Training and Universities, which define the context questionnaires and common centre indicators for The final evaluation of primary education determines in its article 7.5 that "in a At the same time as the final stage evaluation is carried out, questionnaires will be applied to context, to be drawn up by the Ministry of Education, Culture and Sport. These questionnaires will provide information on the socio-economic and cultural conditions of centres for the contextualisation of the results obtained. It is indicated as outstanding: Article Two: Background questionnaires. "The context questionnaires to be applied in the final evaluation of Educa- There will be three primary schools: one for pupils in the sixth year of primary education to carry out the evaluation (hereinafter referred to as the student questionnaire), another one addressed to their parents and legal guardians (hereinafter referred to as the family questionnaire), and a third addressed to the management of the primary school (hereinafter referred to as the for the management). 2. The questions and answer options that must be included in each of the questionnaires defined in the previous section are those indicated in ANNEX I to this resolution 3. Educational administrations may: a) To apply questionnaires addressed to other groups, in addition to those indicated in article The second paragraph of paragraph 1 of this resolution. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 25/36 b) To include other questions in each questionnaire in addition to those referred to in Article the second part of this resolution. However, no response options may be added other than the questions set out in ANNEX ONE to this resolution. c) Apply the different questionnaires in the format considered most appropriate (pa- pel or digital). d) To define the time and place of completion of the different questionnaires. e) Lay out the questionnaires according to their needs and alter the order of the questions. This includes the possibility of jointly designing the questionnaire for the and the questionnaire for families, provided that it is clearly stated who you must complete each part. The third point states that "The National Institute for Educational Evaluation facilitates the educational administrations will provide a code book with the necessary instructions and mandatory for the correct recording of data and subsequent processing of the common indicators" . This State Secretariat resolution has been amended by a resolution of 4/12/2017, BOE of 27/12, which varies one question in this ANNEX ONE. No aspect of data protection is included in the resolution or in the modifies it. The ANNEX ONE mentioned above lists the questions and response options that The following should be included in each of the questionnaires, indicating and differentiating The student's form must be filled in by the parents or guardians. The question- The student body starts with the question "Are you a boy or a girl? and contains questions about how often you use a computer or tablet for school work in each of the following locations, how many days a week of The first thing you have to do is to do your homework. It contains a block total of 11 questions, ending with the "In general to what extent you agree with these statements about your teachers and teachers? A) I know what you expect me to do...There is no indication in any section that the ques- The context context is to be nominative or the student is or can be identified in The identity of the students who complete the questionnaire is therefore not revealed. ec as necessary in any rule, nor is it justified in relation to the purpose of the data The following is a list of The questionnaire for families starts with questions such as in which country they were born. If you and your daughter or son, please indicate how often you use the family home following resources..., with four response options, number of people who convert see at home, degree of satisfaction with the following aspects related to the school... in As for the teaching staff, or the question of whether you would recommend this centre, how many days a week your child does homework including studying how often you or other people in the house talk about the following with your son or daughter... you also wonder the highest level of study completed by the mother or father, or the category that better describes the employment situation of the mother and father. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 26/36 In the context test that made the claim of 4 EP, for the student are contained 17 issues, some other than ANNEX ONE, plus the above-mentioned boy/girl, related to the use of language, including those referred to in ANNEX ONE questionnaire for families, such as those referring to parents, parents' employment status, their level of education and the kind of work they do. The issue must be linked not only to existing legislation, but also to contextual assessments that are carried out in conjunction with evaluations of and for the purpose of the data extracted from this evaluation of the context. The result is that there is no obligation derived from law, which expressly establishes the carrying out of any kind of evaluation, or specifically the evaluation of context, although article 144.2 of the LOE states: "The educational administrations may establish other assessments for diagnostic purposes. claimed. It is concluded that the online context questionnaire for 4EP students contain personal data, it is not anonymous, it is not justified because must not be anonymous, having been so in the past, and has no information clause of data collection. While the DE questionnaire of competencies is nominative, it contains the da- It is clear from the regulations that such identification must be However, the CC does not have such a character, which is furthermore completed in different moments. Nor does it follow from its purpose that it should be nominative when, they were anonymous, those carried out before the one carried out in the academic year 2018- 2019. However, for the academic year 2018-19 which is the subject of the complaint, the CC was nominated by the ve, the access and user passwords being assigned by the system itself. No indication In no section of the regulations in force does the CC have to be named or have o the student surveyed should be identified, so that the identity of the students who meet the requirements of the The questionnaire is not required by any standard, nor is it justified in The data will be used in accordance with the purpose for which they are intended, and it will be possible to obtain the same factual information. The data will be processed without processing the personal data of the students, i.e. without filling in their names. The questionnaire. III The respondent collected information associated with some data and stored it in her systems for the realisation of indicators, which according to the precedents do not require san of the identification of the author of the questionnaire. The collection and processing of this data This involves the processing of specific personal data that is not necessary for the purposes of The Commission is also aware of the need to ensure that personal identification data are recorded, and therefore ex- The data protection laws, which do have proof of ED, are being processed. As an example, it should be noted that the statistical analyses of the centre's group or at national level - The information provided in the questionnaire should not be correlated with the identified or identifiable author of the questionnaire. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 27/36 As for the statement by e claiming "that although the survey is not anonymous, personal data are pseudonymised, i.e. they cannot be attributed to an interested party without the use of additional information", that Regulation extends their protection, as set out in Article 1(2), to the rights and freedoms of natural persons, and in particular their right to protection of the personal data, defined in Article 4.1 as "any information relating to a person identified or identifiable natural person ("the data subject"); an identifiable natural person any person whose identity can be established, directly or indirectly, in particular by means of an identifier, such as a name, an identification number, data location, an online identifier or one or more elements of the identity physical, physiological, genetic, psychological, economic, cultural or social characteristics of that person. Therefore, the respondent is charged, generally speaking, with the following of the 2018-2019 academic year made with personal data of 4EP students, the commission of the infringement of Article 5.1.a) of the RGPD, which states "The personal data will be: (a) processed in a lawful, fair and transparent manner in relation to the data subject ("lawfulness, loyalty and transparency") The infringement is connected to the cases in which the various bases are determined Article 6 of the RGPD, entitled "Lawfulness of processing", contains the following indicates: 1. Treatment shall only be lawful if at least one of the following conditions is met nes:" and those which serve this purpose. In this case, there is no need for such questionnaires to be associated the student who completes them, who must be named, and the rule does not indicate that it affects to the student or must contain his or her data. This applies to the entire questionnaire in general, and it is established that there is no legitimate basis for the processing carried out. As a general rule, data should only be collected for specific purposes. and legitimate and explicit purposes. This prerequisite involves analysing whether the personal data The following are the main reasons why the treatment is necessary and right for the The aim is to develop and assess the CC The specification of the purpose of data processing analysed the current regulations and purposes of the processing by the CC does not result in personal data having to be used to fulfil the purpose for which is designated in the LOE and concordant norms. If the aims of the questionnaire treatments can be achieved without the use of a The processing of personal data, in addition to proving that it is not It follows that there is no concrete legitimate basis for this, considering that the processing of personal data has an impact on the fundamental rights of the student, in terms of personal data and privacy. So if the same purpose can be achieved without processing the data, if it does not derive from the regulations in force that are to be processed, not there is a legal basis for processing them. IV Because it deals with "sex" in the same questionnaire: with the options "boy", C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 28/36 "girl", and "other options" is charged with the infringement of Article 5.1.a) of the RGPD, considered as special category data as they relate to "data relating to the sexual life or sexual orientation of a natural person", which has no basis legal to be treated as it has been in the CC questionnaire, by introducing in the question: sex: boy, girl, a third with the selection of "other options". The complaint does not detail what this option refers to, which is intended to socio-economic questionnaires accompanying the evaluation test of diagnosis where knowledge and skills are valued. The ED tests are the 2018-2019 CC, which are also denounced, without being inform the parents of the processing of data, and that the questionnaires do not contain information clauses that must contain the aspects and purposes of the data for the purposes information and exercise of rights. These articles are marked: 5"1. The personal data will be: (a) processed in a lawful, fair and transparent manner in relation to the data subject ("lawfulness, loyalty and transparency") 9. 1. The processing of personal data revealing ethnic origin is prohibited or racial, political opinions, religious or philosophical convictions, or the and the processing of genetic data, biometric data to identify unambiguously to a natural person, data relating to health or data relating to life sexual orientation of a natural person. 9.2. Paragraph 1 shall not apply where one of the following circumstances applies following: a) the data subject has given his explicit consent to the processing of such data for one or more of the specified purposes, except where the law of Union or of the Member States provides that the ban referred to in the paragraph 1 may not be lifted by the person concerned;" Adding Article 9.1 of the LOPDGDD "For the purposes of Article 9.2.a) of Regulation (EU) 2016/679 , in order to avoid discriminatory situations, the only consent of the data subject will not be sufficient to lift the ban on data processing whose main purpose is to identify their ideology, trade union membership, religion, orientation sexual orientation, beliefs or racial or ethnic origin. It is recalled that the option presented in the context questionnaire was "sex", in addition of the boy-girl one, "other options". This is a question included in ANNEX ONE of the Royal Decree 1058/2015 and in the resolution of 30/03/2016, recalling that the The possibility for the Autonomous Regions of " Including other questions in each questionnaire in addition to the The following are the main points made in Article 2 of this resolution. However, no op- The following questions were answered by the Commission, other than the questions in Annex 1 to the Preliminary Report The resolution. There is the possibility of introducing new ones. This regulation, provides for ANNEX ONE: "Questions and answer options which must be included in the The questions and answer options that are asked in each of the questionnaires are C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 29/36 The following should be included in each of the questionnaires defined under the heading The definitions of the above are those indicated in ANNEX I to this resolution". First of all, the model questionnaire created by the respondent is out of line with the The model of the ANNEX ONE of the resolution of 30/03/2016 which does not include this term. It is noted that within sex the given option of "other option" is unrelated. The "gender of the student" is not biologically determined, but is that would fall under the issue of gender identity that is introduced without explanation in the questionnaire. Gender refers to the social and cultural construction that defines the different carac- emotional, affective and intellectual characteristics, as well as the behaviours that each person The concept of "gender equality" is not a new one, but it is one that has been assigned to men and women as their own. The main reason for this is the fact that men and women do not identify with these characteristics, and so, apart from the Male and female there would be other genders: trans, intersex, non-binary gender, pangene - ro, etc. In this way, there are as many genders as there are identities, and therefore as many identities. gender as people. On the specific term "gender identity", the RGPD makes no mention of it. On the other hand, "sexual orientation" is the emotional, romantic, sexual and psycho- (Wikipedia) and is how it is experienced by the person in a sustained way over time. describes different from gender identity. The Universal Declaration of Human Rights, the International Covenant on Civil and Political Rights and the International Covenant on Economic, Social and Cultural Rights include in their guarantees on non-discrimination, lists of prohibited grounds for discrimination. These lists do not explicitly mention sexual orientation and identity but conclude with the expressions "any other condition" or "any other social status". The use of these expressions shows that the intention was that these lists were open and illustrative; in other words, the grounds for discrimination are not closed. It is clear and corroborated that sexual orientation and gender identity are two as- different points. In its case law, general comments and concluding observations, the United Nations treaty bodies have consistently held that sexual orientation and gender identity are prohibited grounds for discrimination nation in accordance with international law. Moreover, the procedures have long been The special procedures of the Human Rights Council have recognised the discrimination that exists because of sexual orientation and gender identity. In the same vein, various mechanisms for the protection of human rights at the international level, such as the Committees, have affirmed that States have an obligation to protect people from discrimination on the basis of their sexual orientation. It is possible to This is reflected in decisions of the Human Rights Committee - (Toonen v. Australia, 1994) and in general comments of the Committee on Economic Rights, So- Committee on the Rights of the Child, the Committee against Torture, the Committee on the Rights of the Child, the The Committee on the Elimination of Discrimination against Women For example, in its observation In general, the Committee on Economic, Social and Cultural Rights points out that the States parties to the Covenant have a duty to protect the rights of the child. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 30/36 must ensure that a person's sexual preferences do not constitute a obstacle to the realization of the rights recognized by the covenant. Gender identity is also recognised as a prohibited ground of discrimination. The Committee on Economic, Social and Cultural Rights The right to non-discrimination in Article 2 of the Convention on the Rights of the Child has been interpreted as The Convention on the Rights of the Child includes sexual orientation and gender identity. The CC that was made in February 2019, according to the petitioner, is intended to comply with the mandate contained in legal provisions to ensure the effective integration of the gender perspective in the ordinary activity of public authorities "including systematically the gender variable in statistics, surveys and data collection that carry out", an action which, as indicated in Article 19 of Law 17/2019 of 4/04 of the same The number of men and women it indicates: The Public Administrations of Navarre, in order to guarantee the efficiency of the incorporation of The gender perspective in their day-to-day work should be a) Systematically include the variable of sex, collecting the different categories, in all the statistics, surveys and data collection they carry out. b) Establish new gender indicators that will make it possible to better understand differences in values, roles, situations, conditions, aspirations and the needs of women and men, and their manifestation and interaction in the reality that should be analysed and included in statistical operations. (c) Carry out sufficiently large samples so that the various variables can be analysed according to the gender variable, and deal with the available data on so that the different situations and needs of women and girls can be men in the various fields of action". As can be seen, the above-mentioned rules of reference, which are based on the ANNEX ONE, refers exclusively to the variable "sex" differentiating exclusively between boy-girl. The introduction of such a gender identity identifying its holder would have to be carried out in any case, when there is a relationship between what is being asked, for some purpose that the data is to be obtained for the purpose for which the data is to be processed, without any attempt to collect data by have them, without a specific purpose, and in this case, the survey was of a socio-economic and The evaluation of the project was carried out by the Ministry of Health and the Ministry of studies or analyses that aspect, so it makes no sense to establish a single that scope, with no connection to the rest of the issues. In this sense, it is not appreciated need in the treatment of that option when carrying out the questionnaire. Furthermore, for statistical purposes, Spanish regulations maintain, as does the in most European countries, the binary model of sex: male and female, which appears Article 170 of the Decree of 14/11/1958 approving the Regulation of the Civil Registry Law. In this case, moreover, the possibility of introducing in the questionnaires the variable "other options" under "sex" does not correspond to this The concept of "legal aid" is not well understood and lacks the necessary legal basis in our legal system. In the Agency's view, the exception provided for in point (j), being the processing necessary for statistical purposes, does not apply, as it requires that the C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 31/36 provided for in Union or Member State law, which must be proportionate to the objective pursued, respecting in substance the right to data protection and establishing appropriate and specific measures to protect the interests and fundamental rights of and the above-mentioned regulations only cover the variable "sex". In any case, a questionnaire is presented here in which the student, while not mentioning the If your sexual orientation is not clear, you can deduce that you do not feel like a boy or a girl, if you mark other options, an issue that can be considered to be related to sexual orientation, which The issue is often developed in the standards in a unitary way, and in the background, to a question that I would like to address. This is a very important issue, and one that should be related to expressing your beliefs, as gender identity is a matter of concern to all of us. The internal structure of each, as defined by the Inter-American Committee on Economic, Social and Cultural Rights, is as follows The European Union is committed to the promotion of human rights in accordance with resolution AG/RES. 2653 (XLI-O/11): Human Rights, Sexual Orientation and Gender Identity, 23 /04/2012 which defines like: "Gender identity is the internal and individual experience of gender as each The person experiences it deeply, which may or may not correspond to the sex assigned to him or her. The body's personal experience (which could be in the form of a "body" or "body") is the most important factor in determining whether or not a person is born. to change the appearance or function of the body through medical techniques, surgical or other, provided that it is freely chosen) and other ex gender issues, including dress, speech and manners." That is, she is questioning her sense of gender, with which she identifies, if she co- affects the one assigned at birth: woman or man, or "others", when their sex is felt, with the which is identified, does not coincide with that assigned at birth, which is outside the character and purpose of the educational context questionnaire as it is not oriented in that way and it should not oblige minors or any other person to express or declare their beliefs personal and intimate affairs. This prohibition is based on the following points out the precept transcribed, in avoiding discriminatory situations, such as those that could The public register of the sexual orientation of girls and women in the persons or the collection of gender identity of various groups without a determined or without a legitimate basis, or of beliefs. According to this provision, the general rule is a ban on processing of such data, unless one of the exceptions set out in its paragraph 2. The contribution of the information of the questionnaire was obligatory, not being it to all issues. In any case, this should be clearly reported and thus indicated in the data collection systems. The infringement of Article 5.1.a) of the RGPD is considered and accredited in relation to 9.1 of the RGPD and 9.1 of the LOPDGDD. V The questionnaire does not contain any information clause on the protection of data. No content or information given to students, parents/parents on the completion of this questionnaire. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 32/36 Considering the previous declaration of infringement of Article 5.1. The lack of a legitimising basis for the treatment of 4EP students by the CC, and The purpose of this is to analyse the conduct of the respondent, which in this case was indeed collected from The course is designed for the personal use of all students. As soon as personal data is collected, it means that it was not contained in the same information on the purpose, legitimate basis and exercise of rights of the alumni The Commission is not aware of any such information, as it was not included in the questionnaire, nor is it clear that the information was given a, parents/guardians on the completion of this questionnaire. In this case, it was possible to know who each of the questionnaires corresponded to by have associated user and password data, identifiable since they were assigned by the directors of the centres. The information collected and the transparency of such collection and processing is a principle established by the GDR in Articles 12 and 13. are not sufficient to legitimise the processing of personal data, but they are a condition is The processing of personal data is essential to guarantee the legality of the processing. In order to be valid, the treatment must be legal, fair and transparent. The aim is to ensure that the public is supported on a legitimate basis and that it is informed at the time of any re take the data from the points made in Articles 12 and 13 of the RGPD. Also the contraventions of these principles are independent. The defendant does not comply with the provisions of Article 13 of the RGPD, as indicated in the Informa- The information to be provided when personal data are obtained from the data subject: "1. Where personal data relating to a data subject are collected, the When the data are obtained, the data controller will provide you with all the information below: a) the identity and contact details of the person in charge and, where appropriate, his representative b) the contact details of the data protection delegate, if applicable; (c) the purposes of the processing for which the personal data are intended and the legal basis of treatment; (d) where the processing is based on Article 6(1)(f), the legitimate interests of the person in charge or of a third party; e) the recipients or categories of recipients of the personal data, where applicable; (f) where appropriate, the controller's intention to transfer personal data to a third country or international organization and the existence or absence of a decision on the adequacy of Commission, or, in the case of transfers referred to in Article 46 or 47 or Article 49(1), second subparagraph, reference to adequate or appropriate safeguards and means of obtaining a copy of these or the fact that they have been lent. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 33/36 2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject, at the time the personal data are obtained, with the following information necessary to ensure fair and transparent data processing: a) the period during which the personal data will be kept or, when this is not possible, the criteria used to determine this deadline; b) the existence of the right to request access to the data from the data controller and their rectification or deletion or the limitation of their processing, or to oppose the processing, as well as the right to the portability of the data; (c) where the processing is based on Article 6(1)(a) or Article 9, paragraph 2(a), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on prior consent to its withdrawal; (d) the right to lodge a complaint with a supervisory authority; (e) whether the communication of personal data is a legal or contractual requirement, or a necessary to enter into a contract, and whether the data subject is obliged to provide the personal data and is informed of the possible consequences of not providing such data; (f) the existence of automated decisions, including profiling, to be referred to in Article 22(1) and (4) and, at least in such cases, significant information on the logic applied, as well as the importance and expected consequences of such treatment for the interested party. 3. Where the controller plans the further processing of data for a purpose other than that for which they were collected, will provide the information about that other purpose and, prior to such further processing, information any additional relevant information within the meaning of paragraph 2. 4. The provisions of paragraphs 1, 2 and 3 shall not apply when and to the extent that the person concerned already has the information". In the context of the information provided to children or their representatives, the The use of short notices in simple language should be particularly stressed in Wales. The course is short, concise and didactic and easy to understand. A short notice will contain the in- basic training to be communicated when collecting personal data directly from the inte- (Articles 10 and 11). This notice shall be accompanied by a further notice ex tense, perhaps a hypertext link, which will contain all the relevant details. It informs you- The legal representatives and the children who have the custody of the child shall (always) be informed of the required quality VI Article 83.5 a and b of the GPRD, considers that the infringement of "the principles treatment, including the conditions for consent under the Articles 5, 6, 7 and 9" and "the rights of the data subjects under Articles 12 to 22; is punishable under Article 83(5) of the said Regulation, with administrative fines of up to EUR 20,000,000 or, in the case of C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 34/36 one company, for an amount equivalent to 4% of turnover at most overall annual total for the previous financial year, opting for the highest amount". In addition, Article 83.7 of the GPMR states "Without prejudice to the corrective powers of the supervisory authorities under Article 58(2), each Member State may lay down rules as to whether it may, and to what extent, imposing administrative fines on public authorities and bodies is in that Member State". The Spanish legal system has chosen not to penalise with a fine the public entities, as indicated in Article 77.1. c) and 2. 4. 5. and 6. of the LOPDDGG: "1. The regime established in this Article shall apply to processing operations for which are responsible or in charge: c) The General State Administration, the Administrations of the Communities The local authorities and the entities that make up the local administration. 2. Where the persons responsible for, or in charge of, the activities listed in paragraph 1 commit any of the offences referred to in Articles 72 to 74 of this organic law, the The competent data protection authority shall issue a decision sanctioning the same with caution. The resolution will also set out the measures that the appropriate action should be taken to bring about the cessation of the conduct or the correction of the effects of the infringement that is would have committed. The decision shall be notified to the controller or processor, to the body of which depends hierarchically, where appropriate, and to those affected who had the status of interested, if any. 4. The data protection authority must be informed of decisions that be made in connection with the measures and actions referred to in paragraphs previous. 5. The following shall be communicated to the Ombudsman or, where appropriate, to the analogous institutions the autonomous communities the actions carried out and the decisions taken at under this article. 6. When the competent authority is the Spanish Data Protection Agency, it shall will publish on its website, with due separation, the resolutions referring to entities in paragraph 1 of this article, with express indication of the identity of the the controller or processor who committed the infringement". Article 58(2) of the GPRS states: "Each supervisory authority shall have all the The following corrective powers are indicated below: (b) to punish any controller or processor with a warning where processing operations have infringed the provisions of this Regulation mento; (d) order the controller or processor to carry out the processing operations treatment in accordance with the provisions of this Regulation, where appropriate, of in a certain way and within a specified time". C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 35/36 Therefore, in accordance with the applicable legislation and assessed on the basis of graduation of penalties whose existence has been established, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: TO IMPOSE ON THE DEPARTMENT OF EDUCATION OF THE GOVERNMENT OF NAVARRA, with NIF S3100007H: - A warning penalty for an infringement of Article 5.1.a) of the GPRS, of in accordance with Article 83.5(a) of the GPRS. - A warning penalty for an infringement of Article 5.1.a) of the GPRS, in relation to Article 9.1 of the RGPD and 9.1 of the LOPDGDD, in accordance with Article 83.5 a) of the RGPD. - A penalty of a warning for an infringement of Article 13 of the RGPD, in accordance with Article 83.5(b) of the GPRS. SECOND: To notify this resolution to the DEPARTMENT OF EDUCATION OF THE GOVERNMENT OF NAVARRA. THIRD: TO COMMUNICATE this resolution to the PEOPLE'S DEFENDER, of in accordance with the provisions of Article 77.5 of the LOPDGDD FOURTH: In accordance with the provisions of article 50 of the LOPDGDD, this The decision will be made public after it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with Article 123 of the LPACAP, the The interested parties may lodge an appeal for reconsideration with the Director of the Spanish Data Protection Agency within one month from the day following the notification of this decision or directly in an appeal before the Administrative Chamber of the National Court of Justice, with in accordance with Article 25 and the fourth additional provision, paragraph 5 of Law 29/1998, of 13/07, regulating the Contentious-Administrative Jurisdiction, in two months from the day following the notification of this act, as laid down in provided for in Article 46.1 of the aforementioned Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, it is may suspend, as a precautionary measure, the final administrative decision if the interested party expresses its intention to lodge an administrative appeal. If this is the In this case, the interested party must formally communicate this fact in writing to the Spanish Data Protection Agency, presenting it through the Electronic Register of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the other registrations provided for in Article 16.4 of the aforementioned LPACAP. It must also be transferred to the Agency the documentation proving that the contentious action has been effectively brought administrative. If the Agency is not aware that the action has been brought administrative proceedings within two months from the day following notification of this resolution, would terminate the precautionary suspension. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid Sedeagpd.gob.es 36/36 Mar Spain Martí Director of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es