| AEPD - R/00092/2021 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 17 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | None |
| Parties: | DIRECCIÓN GENERAL DE LA POLICÍA |
| National Case Number/Name: | R/00092/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD decision (in ES) |
| Initial Contributor: | n/a |
The AEPD ordered the Directorate General of Police to justify the grounds on which they had denied the right to erasure of the complainant.
English Summary
Facts
A complainant exercised their right to erasure of certain criminal records data. This was denied by the Directorate General of Police with a generic answer, so the claimant filed a complain with the AEPD. The AEPD dismissed the case, to which the claimant reacted taking the case to Court. The national court upheld the claim and overrode the AEPD's dismissal of the claim, obliging them to reconsider the case.
Dispute
Is providing a general answer enough to fulfill a claim regarding the right to erasure, when there are no grounds for erasure?
Holding
The AEPD held that, even if the Directorate General of Police was right in denying the right to erasure, as it is not possible to ask for the deletion of one's criminal record without meeting the conditions established in the law, a generic answer it is not enough. The Directorate General of Police shall provide a personalized and specific answer to the claimant, stating the grounds on which they are not granting the right to erasure.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/6
File No.: TD / 00233/2020
RESOLUTION NO: R / 00092/2021
Having regard to the judgment handed down by the National Court of the Contentious Chamber
Administrative Section First in the Contentious Administrative Appeal nº
2107/2019 by which the Resolution of the Spanish Protection Agency is challenged
of Data dated October 16, 2019, which agrees not to initiate procedure
Administrative E / 09967/2019.
Said judgment annuls the contested resolutions, with retrogression of the
Actions so that this Agency admits the cancellation claim for processing
of personal data of D.A.A.A. , against DIRECTORATE GENERAL OF THE POLICE,
for not having been duly attended to your right to cancel in the file
"persons".
Once the procedural actions provided for in article 117 of the
Regulations for the development of Organic Law 15/1999, of December 13, of
Protection of Personal Data, approved by Royal Decree 1720/2007,
of December 21 (hereinafter, RLOPD), the following
FACTS
FIRST: On July 25, 2019, D. A.A.A. (hereinafter, the complaining party)
exercised the right of cancellation of police records in front of the ADDRESS
GENERAL OF THE POLICE, (hereinafter, the claimed), without your request having
received the legally established reply.
The complaining party provides various documentation related to the claim made
before this Agency and on the exercise of the right exercised and declares that,
requested the cancellation of police records included in the file "persons",
received a generic response.
SECOND: Successively transferred the claim and the defense briefs
that occurred in the processing of this file, and for the purposes of
the resolution of this claim is of interest, in summary, the
following allegations:
The defendant indicated that the denial of
police record based on articles 22 and 23 of Organic Law 15/1999 of
December 13, Protection of Personal Data, detailing the reasons
of said denial that, according to the final judgment of December 19, 2013,
conviction of the complaining party as the author of a crime of elaboration of material
pornographic and for possession of pornographic material.
That article 23.1 of the LOPD establishes the exceptions to the rights of
cancellation, depending on the dangers that could arise for the defense of the
State or public safety, the protection of the rights and freedoms of third parties or
the needs of the investigations being carried out. Given the nature of
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/6
the data that appear in the PERSONS file, in which the appellant appears
arrested for a crime of corruption of minors for which he was tried and convicted, for
this, on September 5, 2019, which is why it was decided to reject the
request for cancellation of police records.
THIRD: The complaining party shows that, it is reiterated in the content of
of the letter of September 16.
That the sentence has reopened this procedure and ruled on the
content of the DGP resolution dated September 4, 2019,
considering it null due to lack of motivation.
Given that there is a prior judicial ruling, it is of interest whether the
resolution and proceed to the cancellation of data.
FOUNDATIONS OF LAW
FIRST: The Director of the Spanish Agency for
Data Protection, in accordance with the provisions of section 2 of article 56 in
in relation to paragraph 1 f) of article 57, both of Regulation (EU) 2016/679 of the
European Parliament and of the Council of April 27, 2016 on the protection of
natural persons with regard to the processing of personal data and the free
circulation of these data (hereinafter, GDPR); and in article 47 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD).
SECOND: The fourth transitory provision of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights,
provides that:
"The treatments subject to Directive (EU) 2016/680 of the European Parliament and
of the Council, of April 27, 2016, regarding the protection of natural persons in
regarding the processing of personal data by the authorities
competent for the purposes of prevention, investigation, detection or prosecution of
criminal offenses, and the free circulation of said data and by which the
Framework Decision 2008/977 / JAI of the Council, will continue to be governed by the Organic Law
15/1999, of December 13, and in particular article 22, and its provisions of
development, as long as the norm that transposes into Spanish Law does not enter into force
provided in the aforementioned directive. "
THIRD: Article 16 of the Organic Law on Data Protection 15/1999, of 13
December (hereinafter, LOPD) provides that:
"one. The data controller will have the obligation to enforce the right to
rectification or cancellation of the interested party within a period of ten days.
2. The personal data whose
treatment does not comply with the provisions of this Law and, in particular, when such
data is inaccurate or incomplete.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/6
3. The cancellation will lead to the blocking of the data, being kept only to
disposition of the Public Administrations, Judges and Courts, for the attention of
the possible responsibilities arising from the treatment, during the period of
prescription of these. Once the aforementioned period has elapsed, the deletion must be carried out.
4. If the rectified or canceled data had been previously communicated, the
responsible for the treatment must notify the rectification or cancellation made to
who have been communicated, in the event that the treatment is maintained by this
Lastly, you must also proceed with the cancellation.
5. Personal data must be kept during the periods
provided for in the applicable provisions or, where appropriate, in the contractual relationships
between the person or entity responsible for the treatment and the interested party. "
FOURTH: Article 32.2 and 3 of the RLOPD determines:
"two. The person responsible for the file will decide on the request for rectification or cancellation
within a maximum period of ten days from the receipt of the request.
After the period has elapsed without expressly responding to the request, the interested party
may file the claim provided for in article 18 of Organic Law 15/1999,
December 13.
In the event that you do not have personal data of the affected party, you must
also notify them within the same period.
3. If the rectified or canceled data had been previously transferred, the
responsible for the file must communicate the rectification or cancellation made to the
assignee, within the same period, so that it, also within ten days counted
from the receipt of said communication, proceed, likewise, to rectify or cancel
the data.
The rectification or cancellation made by the assignee will not require communication
any to the interested party, without prejudice to the exercise of rights by the
stakeholders recognized in Organic Law 15/1999, of December 13. "
FIFTH: Article 25 of the RLOPD determines:
"one. Except in the case referred to in paragraph 4 of the previous article, the exercise of the
rights must be carried out by means of communication addressed to the person responsible for the
file, which will contain:
a) Name and surname of the interested party; photocopy of your national document of
identity, or your passport or other valid document that identifies you and, in your
case, of the person who represents it, or equivalent electronic instruments;
as well as the document or electronic instrument certifying such
representation. The use of an electronic signature identifying the affected party
will exempt from the presentation of photocopies of the DNI or equivalent document.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/6
b) The preceding paragraph shall be understood without prejudice to the specific applicable regulations.
to the verification of identity data by the Public Administrations in the
administrative procedures.
c) Request in which the request is specified.
d) Address for the purposes of notifications, date and signature of the applicant.
e) Documents supporting the request made, if applicable.
2. The person in charge of the treatment must answer the request that is addressed to him in all
case, regardless of whether or not personal data of the affected person appears in their
files.
3. In the event that the application does not meet the requirements specified in section
first, the person responsible for the file must request their correction.
4. The answer must be in accordance with the requirements provided for each case in the
present title.
5. The data controller will be responsible for proof of compliance with the duty.
response referred to in section 2, and must retain the accreditation of the
fulfillment of the aforementioned duty ... "
SIXTH: Article 23.1 of the LOPD establishes that
"one. Those responsible for the files that contain the data referred to by the
Sections 2, 3 and 4 of the previous article may deny access, rectification or
cancellation based on the dangers that could arise for the defense of the
State or public safety, the protection of the rights and freedoms of third parties or
the needs of the investigations that are being carried out. "
SEVENTH: Article 22.4 of the LOPD provides:
"4. Personal data recorded for law enforcement purposes will be canceled when not
are necessary for the inquiries that led to their storage.
For these purposes, the age of the person affected and the nature of the
stored data, the need to keep the data until the conclusion of
an investigation or specific procedure, the final judicial decision, especially the
acquittal, pardon, rehabilitation and prescription of responsibility. "
EIGHTH: In the case analyzed here, the complaining party exercised its right to
cancellation of personal data that are included in the file
PEOPLE, and states that their request obtained an unsatisfactory response, given
that has not been adequately addressed by using a generic answer, no
justifies or motivates the reasons for this, based on the aforementioned articles 22 and 23
of the LOPD.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/6
During the processing of this procedure, the respondent has specified the
reasons for the denial of the requested cancellation by indicating that the
police record is related to a conviction as the author of a crime of
sexual assault and a lack of injury.
In this sense, the Judgment of the National High Court dated 03/28/2011 establishes:
“It must therefore be concluded that although the rights of access and cancellation of the
personal data in the files of the Security Forces and Bodies of the
State related to the investigation of allegedly criminal acts may
be limited for security reasons, not to impair the purpose of the investigation or to
preserve the security or data of affected third parties, these restrictions will have
to be specific and motivated, without simply refusing to provide your information
or the generic statement that its content has been referred to the "judicial authority"
without specifying it. The person in charge of this file, when exercising the right of access
urged by the interested party to know the personal data contained in the files
police, specifically those referring to certain police reports in which
appeared as a denounced, you must justify and justify the reasons that prevent you from giving
know these data or why the content of such information should be limited. "
Once this procedure has been initiated, the respondent has responded to the right to
cancellation, indicating the reasons why it is not appropriate to carry out said
cancellation. However, it cannot be accepted that the corresponding response
may manifest itself on the occasion of a mere administrative procedure, such as the
formulation of allegations on the occasion of this procedure.
Therefore, the complained party must send the complaining party a communication about the
decision that has been adopted regarding the claim, indicating the
causes for which the cancellation of the police record in the
people file.
Based on the foregoing, considering that the present procedure is intended to
object that the guarantees and rights of those affected are duly
restored, combining the information in the file with the regulations
referred to in the preceding paragraphs, the claim that originated the
present procedure, since no copy of the necessary
communication to be addressed to the complaining party informing them of the decision
that you have adopted in connection with the claim.
It should be noted that this Agency is not competent to analyze and assess the
need or not for the maintenance of said data by DG Police.
Considering the cited precepts and others of general application,
the Director of the Spanish Data Protection Agency RESOLVES:
FIRST: ESTIMATE the claim made by D. A.A.A. and urge DIRECTION
GENERAL DE LA POLICÍA with NIF S2816015H, so that, within ten
business days following notification of this resolution, send to the party
claimant certification stating that he has complied with the right exercised
for this, where it is motivatedly denied, indicating the reasons why it is not
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/6
the requested cancellation proceeds. The actions carried out as a consequence of
This Resolution must be communicated to this Agency within the same period. The
Failure to comply with this resolution could lead to the commission of the offense
considered in article 72.1.m) of the LOPDGDD, which will be sanctioned, in accordance
with art. 58.2 of the GDPR.
SECOND: NOTIFY this resolution to A.A.A. and to GENERAL MANAGEMENT
FROM THE POLICE.
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to
counting from the day after the notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.
1034-080719
Mar Spain Martí
Director of the Spanish Agency for Data Protection
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
