AEPD - R/00183/2021
|AEPD - R/00183/2021|
|Relevant Law:||Article 12 GDPR|
Article 13 GDPR
Article 15 GDPR
|Parties:||CONSEJERÍA DE EDUCACIÓN, ***IES B.B.B.|
|National Case Number/Name:||R/00183/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD decision (in ES)|
The Spanish DPA held that, for an access request to be valid, it should be done through the appropriate channel (in this case, the DPO), and should be properly documented.
English Summary[edit | edit source]
Facts[edit | edit source]
A data subject made an access request to an educational institution, asking for course programs, statistical data of the grades and number of students, information about how disproportionate results were corrected, a copy of their son past and future exams, as well as any works done by him, and a copy of the measures that have been implemented to help low-grades students overcome their difficulties.
When not complied with the petitioned, the data subject lodged a complaint with the Spanish DPA (AEPD) that was dismissed, that gave rise to an administrative appeal.
The school argued that most of the request data were not personal data and were therefore not included in Article 15 GDPR. They claimed that such data (educational data) were regulated by different norms. They also remarked that the responsible for the students had met the data subject and shown them the exams and gave the appropriate explanations, according to the norms regulating the matter.
The claimant brought forward the CJEU Nowak ruling, asking for a copy of the exams and other examinations, as well as psycho-pedagogic reports and psychometric tests, including teacher's reports.
Holding[edit | edit source]
The AEPD noted that the right to access from the GDPR was different from the right to access to the educational record, that is regulated by a different norm, and that is also different from rights such as public transparency.
The authority recognized, anyway, that according to the CJEU case law, exams and examinations are considered personal data, and therefore the data subject has the right to access them and obtain a copy.
However, the AEPD held that the access request had not been made following the appropriate channel, as it has been made through an access to the educational record, and not as a GDPR access request. The AEPD therefore compelled the data subject to first make an access request through the educational institution's DPO, and to lodge a complaint if, once made, it was not properly answered.
The AEPD also remarked that, when lodging such complaint, it should be accompanied by a copy of the access request and by the documentation providing justification about the legitimacy to represent the actual data subject (the son of the complainant).
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/8 File Nº: TD / 00248/2020 RESOLUTION NO: R / 00183/2021 Considering the appeal for reconsideration issued by the Director of the Agency Spanish of Data Protection by which the Resolution of this is contested Agency with reference number E / 08949/2020 dated November 17, 2020 that the claim presented by Dª A.A.A., in front of the COUNCIL OF EDUCACIÓN, *** IES B.B.B., for neglecting the exercise of access The procedural actions provided for in Title VIII of the Law have been carried out. Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD), the following have been verified FACTS FIRST: D. A.A.A. (hereinafter, the complaining party) claims that he exercised the right of access in front of the MINISTRY OF EDUCATION, *** IES B.B.B. (hereinafter, the claimed), without your request having received the legally established reply. The complaining party provides various documentation related to the claim made before this Agency and on the different requests raised before the claimed one, as well such as requests for a copy of your child's school records, resolutions of the educational authority and appeals before said authority. With dates January 20, February 11, March 3 and July 2, 2020, request before the claimed: 0 Copy of the Didactic Schedules of the Physics and Chemistry area of 3 C, corresponding to the academic year 2019-2020. Statistical data of the academic results of the subject of Physics and Chemistry, from the first evaluation of the current academic year, and from the second and third when they occur, including the number of students presented and approved, disaggregated by groups (A, B, C, ..). Information on the measures adopted by the Department of Physics and Chemistry to correct disproportionate pass and fail results between the different groups. Copy of the initial evaluation carried out on your child in the subject of Physics and Chemistry, as well as the exams taken during the first term of the course academic 2019/2020, and those that take place during the school year 2019-2020. As well as a copy of the rest of the documents and evaluation instruments educational (oral presentations, evaluation of the notebook, etc.), which have been used by the teacher who teaches said subject, and that serve to evaluate their learning indicating the grade assigned in each of them. Copy of the educational reinforcement measures and, where appropriate, curricular adaptation that your child's teacher has adopted to help him overcome difficulties shown in the different evaluation tests carried out. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/8 SECOND: Successively transferred the claim and the defense briefs that occurred in the processing of this file, and for the purposes of the resolution of this claim is of interest, in summary, the following allegations: The defendant manifests in the allegations made after the request of information made by this Agency, which in the multiple answers the sus briefs accompanying the voluminous documentation presented in this claim refer to issues that have nothing to do with personal data, but with the didactic methodology and general data of the center in which your child attends studies. The documentation that may refer to your child's personal data, although in a instrumental, such as the different copies of current documents and those that can be do in the future, they are not part of the regulations regulated in art. 15 of the GDPR. That the right of access is independent of the right of access to the file, to the information and documentation, which is governed by other regulations. Compliant with regulations of data protection, there is no obligation to provide a copy of the school record, without prejudice to access to information within the framework of sectoral legislation. That all requests have been answered, as is proven with the documentation provided by the complaining party and that at no time denies access to the child's exams, but is told what the sectoral regulations for the application, as well as request the necessary clarifications for the operating framework established in the center, and the time of attention of the teacher in question, access to the information has not been denied, but that the established normative method is indicated. That the teacher received the mother at the center, showed her the evaluation tests and clarifications were given in this regard. Other issues are raised related to mentoring appointments. That the assessment instruments used by the teaching staff do not appear as elements of the administrative file of the students, nor does it exist. Issues of internal processes and documents of educational processes are alleged and it is concluded that the center continuously provides all the means established by the sectoral norm for access to information on the process of teaching and learning of their children, and many more, being rejected in various occasions. The complaining party states in the allegations made, which were made different requests, some for personal data and others for documents administrative public information. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/8 That it corresponds to this Agency, as a specialized and control body, to determine which information among the requested is of the character of "personal" and which is not, stating in its appeal that it takes into account, among others, the Nowak judgment of the Court of Justice of the European Union (CJEU) reference in it, and that has resulted in the admission for processing of the claim. The petition seeks to obtain a copy of the examinations and other proofs of evaluation, including teacher notes made on them, and other documentation, which is considered treatment of personal data. That, as stated in the "Citizen's Guide" of this Agency, the right to access to personal data implies, among others, the right to obtain copy of these. Allegations are made regarding tutoring and that the access to certain required information, such as Reports Psychopedagogical, but no response has been given to the request for access to the personal information or psychometric tests performed on your daughter, or examinations and other assessment tests, including evaluations of the faculty. That a contentious appeal was filed on December 22, 2020 administrative law before the Administrative Litigation Chamber of the National Court, against the resolution of this Agency for stating that the Ministry of Education has already provided a copy of said tests. FOUNDATIONS OF LAW FIRST: The Director of the Spanish Agency for Data Protection, in accordance with the provisions of section 2 of article 56 in in relation to paragraph 1 f) of article 57, both of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and the free circulation of these data (hereinafter, GDPR); and in article 47 of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). SECOND: Article 12 of Regulation (EU) 2016/679, of April 27, 2016, General Data Protection (RGPD), provides that: "1. The person responsible for the treatment will take the appropriate measures to facilitate the interested party all information indicated in articles 13 and 14, as well as any communication in accordance with articles 15 to 22 and 34 regarding the treatment, in the form concise, transparent, intelligible and easily accessible, with a clear and simple language, in particular any information directed specifically to a child. Information will be provided in writing or by other means, including, if applicable, by means electronic When requested by the interested party, the information may be provided verbally provided that the identity of the interested party is proven by other means. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/8 2. The person responsible for the treatment will facilitate the exercise of their rights to the interested party by virtue of articles 15 to 22. In the cases referred to in article 11, paragraph 2, the person in charge will not refuse to act at the request of the interested party in order to exercise your rights under Articles 15 to 22, unless you can show that you are not is in a position to identify the interested party. 3. The person responsible for the treatment will provide the interested party with information regarding their proceedings on the basis of a request pursuant to Articles 15 to 22, and, in In any case, within one month of receipt of the request. Saying The term may be extended for another two months if necessary, taking into account the complexity and number of requests. The person in charge will inform the interested party of any of said extensions within a period of one month from the receipt of the request, stating the reasons for the delay. When the interested party presents the request by electronic means, the information will be provided by electronic means when possible, unless the interested party requests that it be provided otherwise. 4. If the person responsible for the treatment does not comply with the request of the interested party, inform without delay, and no later than one month after receipt of the request, the reasons for not acting and the possibility of submitting a claim before a control authority and to exercise legal actions. 5. The information provided by virtue of articles 13 and 14 as well as all communication and any action carried out pursuant to articles 15 to 22 and 34 they will be free of charge. When the requests are manifestly unfounded or excessive, especially due to its repetitive nature, the person responsible for the treatment may: a) Charge a reasonable fee based on the administrative costs incurred for facilitate information or communication or perform the requested action, or b) refuse to act on the request. The data controller will bear the burden of proving the character manifestly unfounded or excessive of the request. 6. Without prejudice to the provisions of article 11, when the person responsible for the treatment have reasonable doubts in relation to the identity of the natural person taking the application referred to in articles 15 to 21, you may request that the additional information necessary to confirm the identity of the interested party. 7. The information that must be provided to the interested parties by virtue of articles 13 and 14 may be transmitted in combination with standard icons that allow provide in an easily visible, intelligible and clearly legible way a suitable overview of the planned treatment. Icons presented in the format electronic will be machine readable. 8. The Commission is empowered to adopt delegated acts in accordance with the Article 92 in order to specify the information to be submitted through icons and procedures for providing standard icons. " THIRD: Article 15 of the RGPD provides that: "1. The interested party will have the right to obtain from the person responsible for the treatment confirmation of whether or not personal data concerning you is being processed and, as such case, right of access to personal data and the following information: a) the purposes of the treatment; b) the categories of personal data in question; C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/8 c) the recipients or categories of recipients to whom they were communicated or will be communicated personal data, in particular recipients in third parties or international organizations; d) if possible, the expected period of conservation of personal data or, if not if possible, the criteria used to determine this period; e) the existence of the right to request from the person responsible the rectification or deletion of personal data or the limitation of the processing of personal data relating to the interested party, or to oppose said treatment; f) the right to file a claim with a supervisory authority; g) when the personal data have not been obtained from the interested party, any information available on its origin; h) the existence of automated decisions, including profiling, to which referred to in article 22, paragraphs 1 and 4, and, at least in such cases, information significant on the applied logic, as well as the importance and consequences provided for said treatment for the interested party. 2. When personal data is transferred to a third country or to an organization international, the interested party will have the right to be informed of the guarantees appropriate under Article 46 relating to the transfer. 3. The person responsible for the treatment will provide a copy of the personal data object of treatment. The person in charge may receive for any other copy requested by the interested a reasonable fee based on administrative costs. When the interested party submit the request by electronic means, and unless he requests otherwise provided, the information will be provided in an electronic format of Common use. 4. The right to obtain a copy mentioned in section 3 shall not negatively affect to the rights and freedoms of others. " FOURTH: Article 13 of the LOPDGDD determines the following: "1. The right of access of the affected party will be exercised in accordance with the provisions of the Article 15 of Regulation (EU) 2016/679. When the controller processes a large amount of data related to the affected person and this exercise your right of access without specifying whether it refers to all or part of the data, the person in charge may request, before providing the information, that the affected specify the data or processing activities to which the request refers. 2. The right of access will be understood to be granted if the person responsible for the treatment provide the affected party with a system of remote, direct and secure access to data that guarantees, permanently, access to its entirety. Such effects, the communication by the person in charge to the affected party of the way in which he may Accessing said system will be enough to consider the request to exercise the right. However, the interested party may request from the person in charge the information referred to the extremes provided for in article 15.1 of Regulation (EU) 2016/679 that are not be included in the remote access system. 3. For the purposes established in article 12.5 of Regulation (EU) 2016/679, may consider the exercise of the right of access repetitive on more than one occasion during the period of six months, unless there is legitimate cause for it. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/8 4. When the affected party chooses a means other than the one offered that entails a cost disproportionate, the request will be considered excessive, so that said affected You will assume the excess costs that your choice entails. In this case, it will only be The satisfaction of the right of access is required from the person responsible for the treatment without undue delay. " FIFTH: The exercise of the right of access, like the rest of the rights, is a very personal right, consists of the right of the citizen to obtain information about the treatment that is being made of your data, the possibility of obtain a copy of the personal data that concerns you and that is being object of treatment, as well as information, in particular, on the purposes of the treatment, the categories of data, the recipients, the possible assignments, the term planned conservation, the possibility of exercising other rights, the information available on the origin of the data (if these have not been obtained directly from owner) or the existence of automated decisions, including profiling, without affecting third party data. In the specific case, the complaining party has requested copies of documents related to their children's school records and a copy of certain documentation and information related to educational processes and activity teacher. Examining the documentation in the file, it is observed that the claim of the complaining party is to obtain copies of documents, in this regard we must point out that, in accordance with data protection regulations, the party claimant can only request their own personal data, or of those persons whose representation is, in particular, said documents may contain other data that do not constitute personal data of the claimant. The right of access is the right that those interested have to know what data are being treated by public administrations or the Body administrative responsible for the treatment, the data object of the treatment, the purpose of this, the origin of the data and if they have or will be communicated to third parties. The right of access is independent of the right of access to public information that regulates Law 19/2013, of December 9, on transparency, access to public information and good governance. It is also independent of the right of access to documentation in an administrative procedure, regulated by Law 39/2015, of October 1, of the Common Administrative Procedure of the administrations Public (LPACAP) or access to documents that are part of a file school, except for those documents that contain health data, which enables the obtaining them based on data protection regulations in correlation with the Patient Autonomy Law (LAP) C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/8 Furthermore, it is observed that, in the various requests made by the complaining party, no mention is made or the right of access to data is requested personal data of your children with the prescriptive requirements in the RGPD, in its article 15 "Right of access of the interested party" regarding the processing of personal data related to the person in charge, but rather to obtaining the documents of a school record, which has its own regulations for obtaining said documentation. As recognized by the jurisprudence of the CJEU, access to copies of the examinations if they are part of the content of the right of access to personal data, However, as has already been said, the request was made by accessing the educational record and not as one of the rights recognized in the RGPD, for Therefore, the complaining party may make the request addressed to the Delegate for the Protection of Data, using the means made available by the person in charge for the exercise of the rights recognized in the RGPD, and the receipt of requests through other contact channels other than those expressly planned. The rights may be exercised directly or through a legal representative or voluntary. The supporting documentation must necessarily be provided that the affected has expressly authorized the applicant to exercise on his behalf the Rights. When you cannot get your rights to be taken care of and you want the intervention of this Agency shall, once the period of one month from receipt of the request, file a new claim, providing a copy of the request processed by a means that allows proof of shipment and, if possible, receipt by the person responsible for the treatment, as well as the answer received, if applicable. In relation to the guide of this Agency on the exercise of the right of access to personal data, which implies, among others, the right to obtain a copy of These, in this regard it should be noted that, refers to the provision of a copy of the data that are subject to treatment and those data that are related to your person, but not to obtain a copy of specific documents, except those already specified ups above. The rest of the questions raised by the parties do not result from the competence of this Agency, having to settle and resolve by the corresponding instances. Considering the cited precepts and others of general application, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: DISMISS the claim made by Ms. A.A.A. Front of COUNCIL OF EDUCATION, *** IES B.B.B .. SECOND: NOTIFY this resolution to Ms. A.A.A. and to the COUNCIL OF EDUCATION, *** IES B.B.B .. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 8/8 Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the Interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month to counting from the day after the notification of this resolution or directly contentious-administrative appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within two months from the day following notification of this act, as provided in article 46.1 of the referred Law. 1037-100919 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es