AEPD - R/00092/2021
|AEPD - R/00092/2021|
|Relevant Law:||Article 17 GDPR|
|Parties:||DIRECCIÓN GENERAL DE LA POLICÍA|
|National Case Number/Name:||R/00092/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD decision (in ES)|
The AEPD ordered the Directorate General of Police to justify the grounds on which they had denied the right to erasure of the complainant.
English Summary[edit | edit source]
Facts[edit | edit source]
A complainant exercised their right to erasure of certain criminal records data. This was denied by the Directorate General of Police with a generic answer, so the claimant filed a complain with the AEPD. The AEPD dismissed the case, to which the claimant reacted taking the case to Court. The national court upheld the claim and overrode the AEPD's dismissal of the claim, obliging them to reconsider the case.
Dispute[edit | edit source]
Is providing a general answer enough to fulfill a claim regarding the right to erasure, when there are no grounds for erasure?
Holding[edit | edit source]
The AEPD held that, even if the Directorate General of Police was right in denying the right to erasure, as it is not possible to ask for the deletion of one's criminal record without meeting the conditions established in the law, a generic answer it is not enough. The Directorate General of Police shall provide a personalized and specific answer to the claimant, stating the grounds on which they are not granting the right to erasure.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/6 File No.: TD / 00233/2020 RESOLUTION NO: R / 00092/2021 Having regard to the judgment handed down by the National Court of the Contentious Chamber Administrative Section First in the Contentious Administrative Appeal nº 2107/2019 by which the Resolution of the Spanish Protection Agency is challenged of Data dated October 16, 2019, which agrees not to initiate procedure Administrative E / 09967/2019. Said judgment annuls the contested resolutions, with retrogression of the Actions so that this Agency admits the cancellation claim for processing of personal data of D.A.A.A. , against DIRECTORATE GENERAL OF THE POLICE, for not having been duly attended to your right to cancel in the file "persons". Once the procedural actions provided for in article 117 of the Regulations for the development of Organic Law 15/1999, of December 13, of Protection of Personal Data, approved by Royal Decree 1720/2007, of December 21 (hereinafter, RLOPD), the following FACTS FIRST: On July 25, 2019, D. A.A.A. (hereinafter, the complaining party) exercised the right of cancellation of police records in front of the ADDRESS GENERAL OF THE POLICE, (hereinafter, the claimed), without your request having received the legally established reply. The complaining party provides various documentation related to the claim made before this Agency and on the exercise of the right exercised and declares that, requested the cancellation of police records included in the file "persons", received a generic response. SECOND: Successively transferred the claim and the defense briefs that occurred in the processing of this file, and for the purposes of the resolution of this claim is of interest, in summary, the following allegations: The defendant indicated that the denial of police record based on articles 22 and 23 of Organic Law 15/1999 of December 13, Protection of Personal Data, detailing the reasons of said denial that, according to the final judgment of December 19, 2013, conviction of the complaining party as the author of a crime of elaboration of material pornographic and for possession of pornographic material. That article 23.1 of the LOPD establishes the exceptions to the rights of cancellation, depending on the dangers that could arise for the defense of the State or public safety, the protection of the rights and freedoms of third parties or the needs of the investigations being carried out. Given the nature of C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/6 the data that appear in the PERSONS file, in which the appellant appears arrested for a crime of corruption of minors for which he was tried and convicted, for this, on September 5, 2019, which is why it was decided to reject the request for cancellation of police records. THIRD: The complaining party shows that, it is reiterated in the content of of the letter of September 16. That the sentence has reopened this procedure and ruled on the content of the DGP resolution dated September 4, 2019, considering it null due to lack of motivation. Given that there is a prior judicial ruling, it is of interest whether the resolution and proceed to the cancellation of data. FOUNDATIONS OF LAW FIRST: The Director of the Spanish Agency for Data Protection, in accordance with the provisions of section 2 of article 56 in in relation to paragraph 1 f) of article 57, both of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and the free circulation of these data (hereinafter, GDPR); and in article 47 of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). SECOND: The fourth transitory provision of Organic Law 3/2018, of 5 December, Protection of Personal Data and guarantee of digital rights, provides that: "The treatments subject to Directive (EU) 2016/680 of the European Parliament and of the Council, of April 27, 2016, regarding the protection of natural persons in regarding the processing of personal data by the authorities competent for the purposes of prevention, investigation, detection or prosecution of criminal offenses, and the free circulation of said data and by which the Framework Decision 2008/977 / JAI of the Council, will continue to be governed by the Organic Law 15/1999, of December 13, and in particular article 22, and its provisions of development, as long as the norm that transposes into Spanish Law does not enter into force provided in the aforementioned directive. " THIRD: Article 16 of the Organic Law on Data Protection 15/1999, of 13 December (hereinafter, LOPD) provides that: "one. The data controller will have the obligation to enforce the right to rectification or cancellation of the interested party within a period of ten days. 2. The personal data whose treatment does not comply with the provisions of this Law and, in particular, when such data is inaccurate or incomplete. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/6 3. The cancellation will lead to the blocking of the data, being kept only to disposition of the Public Administrations, Judges and Courts, for the attention of the possible responsibilities arising from the treatment, during the period of prescription of these. Once the aforementioned period has elapsed, the deletion must be carried out. 4. If the rectified or canceled data had been previously communicated, the responsible for the treatment must notify the rectification or cancellation made to who have been communicated, in the event that the treatment is maintained by this Lastly, you must also proceed with the cancellation. 5. Personal data must be kept during the periods provided for in the applicable provisions or, where appropriate, in the contractual relationships between the person or entity responsible for the treatment and the interested party. " FOURTH: Article 32.2 and 3 of the RLOPD determines: "two. The person responsible for the file will decide on the request for rectification or cancellation within a maximum period of ten days from the receipt of the request. After the period has elapsed without expressly responding to the request, the interested party may file the claim provided for in article 18 of Organic Law 15/1999, December 13. In the event that you do not have personal data of the affected party, you must also notify them within the same period. 3. If the rectified or canceled data had been previously transferred, the responsible for the file must communicate the rectification or cancellation made to the assignee, within the same period, so that it, also within ten days counted from the receipt of said communication, proceed, likewise, to rectify or cancel the data. The rectification or cancellation made by the assignee will not require communication any to the interested party, without prejudice to the exercise of rights by the stakeholders recognized in Organic Law 15/1999, of December 13. " FIFTH: Article 25 of the RLOPD determines: "one. Except in the case referred to in paragraph 4 of the previous article, the exercise of the rights must be carried out by means of communication addressed to the person responsible for the file, which will contain: a) Name and surname of the interested party; photocopy of your national document of identity, or your passport or other valid document that identifies you and, in your case, of the person who represents it, or equivalent electronic instruments; as well as the document or electronic instrument certifying such representation. The use of an electronic signature identifying the affected party will exempt from the presentation of photocopies of the DNI or equivalent document. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/6 b) The preceding paragraph shall be understood without prejudice to the specific applicable regulations. to the verification of identity data by the Public Administrations in the administrative procedures. c) Request in which the request is specified. d) Address for the purposes of notifications, date and signature of the applicant. e) Documents supporting the request made, if applicable. 2. The person in charge of the treatment must answer the request that is addressed to him in all case, regardless of whether or not personal data of the affected person appears in their files. 3. In the event that the application does not meet the requirements specified in section first, the person responsible for the file must request their correction. 4. The answer must be in accordance with the requirements provided for each case in the present title. 5. The data controller will be responsible for proof of compliance with the duty. response referred to in section 2, and must retain the accreditation of the fulfillment of the aforementioned duty ... " SIXTH: Article 23.1 of the LOPD establishes that "one. Those responsible for the files that contain the data referred to by the Sections 2, 3 and 4 of the previous article may deny access, rectification or cancellation based on the dangers that could arise for the defense of the State or public safety, the protection of the rights and freedoms of third parties or the needs of the investigations that are being carried out. " SEVENTH: Article 22.4 of the LOPD provides: "4. Personal data recorded for law enforcement purposes will be canceled when not are necessary for the inquiries that led to their storage. For these purposes, the age of the person affected and the nature of the stored data, the need to keep the data until the conclusion of an investigation or specific procedure, the final judicial decision, especially the acquittal, pardon, rehabilitation and prescription of responsibility. " EIGHTH: In the case analyzed here, the complaining party exercised its right to cancellation of personal data that are included in the file PEOPLE, and states that their request obtained an unsatisfactory response, given that has not been adequately addressed by using a generic answer, no justifies or motivates the reasons for this, based on the aforementioned articles 22 and 23 of the LOPD. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/6 During the processing of this procedure, the respondent has specified the reasons for the denial of the requested cancellation by indicating that the police record is related to a conviction as the author of a crime of sexual assault and a lack of injury. In this sense, the Judgment of the National High Court dated 03/28/2011 establishes: “It must therefore be concluded that although the rights of access and cancellation of the personal data in the files of the Security Forces and Bodies of the State related to the investigation of allegedly criminal acts may be limited for security reasons, not to impair the purpose of the investigation or to preserve the security or data of affected third parties, these restrictions will have to be specific and motivated, without simply refusing to provide your information or the generic statement that its content has been referred to the "judicial authority" without specifying it. The person in charge of this file, when exercising the right of access urged by the interested party to know the personal data contained in the files police, specifically those referring to certain police reports in which appeared as a denounced, you must justify and justify the reasons that prevent you from giving know these data or why the content of such information should be limited. " Once this procedure has been initiated, the respondent has responded to the right to cancellation, indicating the reasons why it is not appropriate to carry out said cancellation. However, it cannot be accepted that the corresponding response may manifest itself on the occasion of a mere administrative procedure, such as the formulation of allegations on the occasion of this procedure. Therefore, the complained party must send the complaining party a communication about the decision that has been adopted regarding the claim, indicating the causes for which the cancellation of the police record in the people file. Based on the foregoing, considering that the present procedure is intended to object that the guarantees and rights of those affected are duly restored, combining the information in the file with the regulations referred to in the preceding paragraphs, the claim that originated the present procedure, since no copy of the necessary communication to be addressed to the complaining party informing them of the decision that you have adopted in connection with the claim. It should be noted that this Agency is not competent to analyze and assess the need or not for the maintenance of said data by DG Police. Considering the cited precepts and others of general application, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: ESTIMATE the claim made by D. A.A.A. and urge DIRECTION GENERAL DE LA POLICÍA with NIF S2816015H, so that, within ten business days following notification of this resolution, send to the party claimant certification stating that he has complied with the right exercised for this, where it is motivatedly denied, indicating the reasons why it is not C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/6 the requested cancellation proceeds. The actions carried out as a consequence of This Resolution must be communicated to this Agency within the same period. The Failure to comply with this resolution could lead to the commission of the offense considered in article 72.1.m) of the LOPDGDD, which will be sanctioned, in accordance with art. 58.2 of the GDPR. SECOND: NOTIFY this resolution to A.A.A. and to GENERAL MANAGEMENT FROM THE POLICE. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the Interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month to counting from the day after the notification of this resolution or directly contentious-administrative appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within two months from the day following notification of this act, as provided in article 46.1 of the referred Law. 1034-080719 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es