AEPD (Spain) - TD/00248/2020

AEPD - R/00183/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 12 GDPR Article 13 GDPR Article 15 GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:
Published:	26.05.2021
Fine:	None
Parties:	CONSEJERÍA DE EDUCACIÓN, ***IES B.B.B.
National Case Number/Name:	R/00183/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD decision (in ES)
Initial Contributor:	n/a

The Spanish DPA held that, for an access request to be valid, it should be done through the appropriate channel (in this case, the DPO), and should be properly documented.

English Summary

Facts

A data subject made an access request to an educational institution, asking for course programs, statistical data of the grades and number of students, information about how disproportionate results were corrected, a copy of their son past and future exams, as well as any works done by him, and a copy of the measures that have been implemented to help low-grades students overcome their difficulties.

When not complied with the petitioned, the data subject lodged a complaint with the Spanish DPA (AEPD) that was dismissed, that gave rise to an administrative appeal.

The school argued that most of the request data were not personal data and were therefore not included in Article 15 GDPR. They claimed that such data (educational data) were regulated by different norms. They also remarked that the responsible for the students had met the data subject and shown them the exams and gave the appropriate explanations, according to the norms regulating the matter.

The claimant brought forward the CJEU Nowak ruling, asking for a copy of the exams and other examinations, as well as psycho-pedagogic reports and psychometric tests, including teacher's reports.

Holding

The AEPD noted that the right to access from the GDPR was different from the right to access to the educational record, that is regulated by a different norm, and that is also different from rights such as public transparency.

The authority recognized, anyway, that according to the CJEU case law, exams and examinations are considered personal data, and therefore the data subject has the right to access them and obtain a copy.

However, the AEPD held that the access request had not been made following the appropriate channel, as it has been made through an access to the educational record, and not as a GDPR access request. The AEPD therefore compelled the data subject to first make an access request through the educational institution's DPO, and to lodge a complaint if, once made, it was not properly answered.

The AEPD also remarks that, when lodging such complaint, it should be accompanied by a copy of the access request and by the documentation providing justification about the legitimacy to represent the actual data subject (the son of the complainant).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                 1/8








     File Nº: TD / 00248/2020



                               RESOLUTION NO: R / 00183/2021


Considering the appeal for reconsideration issued by the Director of the Agency
Spanish of Data Protection by which the Resolution of this is contested

Agency with reference number E / 08949/2020 dated November 17, 2020
that the claim presented by Dª A.A.A., in front of the COUNCIL OF
EDUCACIÓN, *** IES B.B.B., for neglecting the exercise of access

The procedural actions provided for in Title VIII of the Law have been carried out.
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of

digital rights (hereinafter LOPDGDD), the following have been verified


                                       FACTS


FIRST: D. A.A.A. (hereinafter, the complaining party) claims that he exercised the right
of access in front of the MINISTRY OF EDUCATION, *** IES B.B.B. (hereinafter, the
claimed), without your request having received the legally established reply.

The complaining party provides various documentation related to the claim made

before this Agency and on the different requests raised before the claimed one, as well
such as requests for a copy of your child's school records, resolutions of the
educational authority and appeals before said authority.

With dates January 20, February 11, March 3 and July 2, 2020, request before the
claimed:

                                                                                     0
  Copy of the Didactic Schedules of the Physics and Chemistry area of 3 C,
    corresponding to the academic year 2019-2020.
  Statistical data of the academic results of the subject of Physics and

    Chemistry, from the first evaluation of the current academic year, and from the second and
    third when they occur, including the number of students presented and
    approved, disaggregated by groups (A, B, C, ..).
  Information on the measures adopted by the Department of Physics and Chemistry
    to correct disproportionate pass and fail results between

    the different groups.
  Copy of the initial evaluation carried out on your child in the subject of Physics and Chemistry,
    as well as the exams taken during the first term of the course
    academic 2019/2020, and those that take place during the school year
    2019-2020. As well as a copy of the rest of the documents and evaluation instruments

    educational (oral presentations, evaluation of the notebook, etc.), which have been
    used by the teacher who teaches said subject, and that serve to evaluate their
    learning indicating the grade assigned in each of them.
  Copy of the educational reinforcement measures and, where appropriate, curricular adaptation

    that your child's teacher has adopted to help him overcome difficulties
    shown in the different evaluation tests carried out.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/8









SECOND: Successively transferred the claim and the defense briefs
that occurred in the processing of this file, and for the purposes of

the resolution of this claim is of interest, in summary, the
following allegations:

The defendant manifests in the allegations made after the request of
information made by this Agency, which in the multiple answers the sus
briefs accompanying the voluminous documentation presented in this

claim refer to issues that have nothing to do with personal data,
but with the didactic methodology and general data of the center in which your child attends
studies.

The documentation that may refer to your child's personal data, although in a

instrumental, such as the different copies of current documents and those that can be
do in the future, they are not part of the regulations regulated in art. 15 of the GDPR.

That the right of access is independent of the right of access to the file, to the
information and documentation, which is governed by other regulations. Compliant with regulations
of data protection, there is no obligation to provide a copy of the school record, without

prejudice to access to information within the framework of sectoral legislation.

That all requests have been answered, as is proven with the
documentation provided by the complaining party and that at no time
denies access to the child's exams, but is told what the

sectoral regulations for the application, as well as request the necessary clarifications
for the operating framework established in the center, and the time of
attention of the teacher in question, access to the information has not been denied, but
that the established normative method is indicated.


That the teacher received the mother at the center, showed her the evaluation tests and
clarifications were given in this regard.

Other issues are raised related to mentoring appointments.

That the assessment instruments used by the teaching staff do not appear as

elements of the administrative file of the students, nor does it exist.

Issues of internal processes and documents of educational processes are alleged
and it is concluded that the center continuously provides all the means
established by the sectoral norm for access to information on the process of

teaching and learning of their children, and many more, being rejected in various
occasions.

The complaining party states in the allegations made, which were made
different requests, some for personal data and others for documents

administrative public information.




C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/8








That it corresponds to this Agency, as a specialized and control body, to determine
which information among the requested is of the character of "personal" and which is not,
stating in its appeal that it takes into account, among others, the

Nowak judgment of the Court of Justice of the European Union (CJEU)
reference in it, and that has resulted in the admission for processing of the claim.

The petition seeks to obtain a copy of the examinations and other proofs of
evaluation, including teacher notes made on them, and
other documentation, which is considered treatment of personal data.


That, as stated in the "Citizen's Guide" of this Agency, the right to
access to personal data implies, among others, the right to obtain
copy of these.


Allegations are made regarding tutoring and that the
access to certain required information, such as Reports
Psychopedagogical, but no response has been given to the request for access to the
personal information or psychometric tests performed on your daughter, or
examinations and other assessment tests, including evaluations of the
faculty.


That a contentious appeal was filed on December 22, 2020
administrative law before the Administrative Litigation Chamber of the National Court,
against the resolution of this Agency for stating that the Ministry of Education has already
provided a copy of said tests.


                           FOUNDATIONS OF LAW

FIRST: The Director of the Spanish Agency for
Data Protection, in accordance with the provisions of section 2 of article 56 in

in relation to paragraph 1 f) of article 57, both of Regulation (EU) 2016/679 of the
European Parliament and of the Council of April 27, 2016 on the protection of
natural persons with regard to the processing of personal data and the free
circulation of these data (hereinafter, GDPR); and in article 47 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD).


SECOND: Article 12 of Regulation (EU) 2016/679, of April 27, 2016,
General Data Protection (RGPD), provides that:

"1. The person responsible for the treatment will take the appropriate measures to facilitate the

interested party all information indicated in articles 13 and 14, as well as any
communication in accordance with articles 15 to 22 and 34 regarding the treatment, in the form
concise, transparent, intelligible and easily accessible, with a clear and simple language, in
particular any information directed specifically to a child. Information
will be provided in writing or by other means, including, if applicable, by means

electronic When requested by the interested party, the information may be provided
verbally provided that the identity of the interested party is proven by other means.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/8








2. The person responsible for the treatment will facilitate the exercise of their rights to the interested party
by virtue of articles 15 to 22. In the cases referred to in article 11, paragraph
2, the person in charge will not refuse to act at the request of the interested party in order to exercise

your rights under Articles 15 to 22, unless you can show that you are not
is in a position to identify the interested party.
3. The person responsible for the treatment will provide the interested party with information regarding their
proceedings on the basis of a request pursuant to Articles 15 to 22, and, in
In any case, within one month of receipt of the request. Saying
The term may be extended for another two months if necessary, taking into account the

complexity and number of requests. The person in charge will inform the interested party of
any of said extensions within a period of one month from the receipt of the
request, stating the reasons for the delay. When the interested party presents the
request by electronic means, the information will be provided by electronic means
when possible, unless the interested party requests that it be provided otherwise.

4. If the person responsible for the treatment does not comply with the request of the interested party,
inform without delay, and no later than one month after receipt of the
request, the reasons for not acting and the possibility of submitting a
claim before a control authority and to exercise legal actions.
5. The information provided by virtue of articles 13 and 14 as well as all
communication and any action carried out pursuant to articles 15 to 22 and 34

they will be free of charge. When the requests are manifestly unfounded or
excessive, especially due to its repetitive nature, the person responsible for the
treatment may:
a) Charge a reasonable fee based on the administrative costs incurred for
facilitate information or communication or perform the requested action, or

b) refuse to act on the request.
The data controller will bear the burden of proving the character
manifestly unfounded or excessive of the request.
6. Without prejudice to the provisions of article 11, when the person responsible for the treatment
have reasonable doubts in relation to the identity of the natural person taking the

application referred to in articles 15 to 21, you may request that the
additional information necessary to confirm the identity of the interested party.
7. The information that must be provided to the interested parties by virtue of articles 13
and 14 may be transmitted in combination with standard icons that allow
provide in an easily visible, intelligible and clearly legible way a suitable
overview of the planned treatment. Icons presented in the format

electronic will be machine readable.
8. The Commission is empowered to adopt delegated acts in accordance with the
Article 92 in order to specify the information to be submitted through
icons and procedures for providing standard icons. "


THIRD: Article 15 of the RGPD provides that:

"1. The interested party will have the right to obtain from the person responsible for the treatment
confirmation of whether or not personal data concerning you is being processed and, as such
case, right of access to personal data and the following information:

a) the purposes of the treatment;
b) the categories of personal data in question;



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/8








c) the recipients or categories of recipients to whom they were communicated or will be
communicated personal data, in particular recipients in third parties or
international organizations;

d) if possible, the expected period of conservation of personal data or, if not
if possible, the criteria used to determine this period;
e) the existence of the right to request from the person responsible the rectification or deletion of
personal data or the limitation of the processing of personal data relating to the
interested party, or to oppose said treatment;
f) the right to file a claim with a supervisory authority;

g) when the personal data have not been obtained from the interested party, any
information available on its origin;
h) the existence of automated decisions, including profiling, to which
referred to in article 22, paragraphs 1 and 4, and, at least in such cases, information
significant on the applied logic, as well as the importance and consequences

provided for said treatment for the interested party.
2. When personal data is transferred to a third country or to an organization
international, the interested party will have the right to be informed of the guarantees
appropriate under Article 46 relating to the transfer.
3. The person responsible for the treatment will provide a copy of the personal data object of
treatment. The person in charge may receive for any other copy requested by the

interested a reasonable fee based on administrative costs. When the
interested party submit the request by electronic means, and unless he requests
otherwise provided, the information will be provided in an electronic format of
Common use.
4. The right to obtain a copy mentioned in section 3 shall not negatively affect

to the rights and freedoms of others. "

FOURTH: Article 13 of the LOPDGDD determines the following:

"1. The right of access of the affected party will be exercised in accordance with the provisions of the

Article 15 of Regulation (EU) 2016/679.
When the controller processes a large amount of data related to the affected person and this
exercise your right of access without specifying whether it refers to all or part of the
data, the person in charge may request, before providing the information, that the affected
specify the data or processing activities to which the request refers.
2. The right of access will be understood to be granted if the person responsible for the treatment

provide the affected party with a system of remote, direct and secure access to data
that guarantees, permanently, access to its entirety. Such
effects, the communication by the person in charge to the affected party of the way in which he may
Accessing said system will be enough to consider the request to exercise the
right.

However, the interested party may request from the person in charge the information referred to the
extremes provided for in article 15.1 of Regulation (EU) 2016/679 that are not
be included in the remote access system.
3. For the purposes established in article 12.5 of Regulation (EU) 2016/679,
may consider the exercise of the right of access repetitive on more than one occasion

during the period of six months, unless there is legitimate cause for it.




C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/8








4. When the affected party chooses a means other than the one offered that entails a cost
disproportionate, the request will be considered excessive, so that said affected
You will assume the excess costs that your choice entails. In this case, it will only be

The satisfaction of the right of access is required from the person responsible for the treatment without
undue delay. "


FIFTH: The exercise of the right of access, like the rest of the rights, is
a very personal right, consists of the right of the citizen to obtain

information about the treatment that is being made of your data, the possibility of
obtain a copy of the personal data that concerns you and that is being
object of treatment, as well as information, in particular, on the purposes of the
treatment, the categories of data, the recipients, the possible assignments, the term
planned conservation, the possibility of exercising other rights, the information

available on the origin of the data (if these have not been obtained directly from
owner) or the existence of automated decisions, including profiling,
without affecting third party data.

In the specific case, the complaining party has requested copies of documents
related to their children's school records and a copy of certain

documentation and information related to educational processes and activity
teacher.

Examining the documentation in the file, it is observed that the claim
of the complaining party is to obtain copies of documents, in this regard we must

point out that, in accordance with data protection regulations, the party
claimant can only request their own personal data, or of those persons
whose representation is, in particular, said documents may contain other
data that do not constitute personal data of the claimant.


The right of access is the right that those interested have to know what data
are being treated by public administrations or the Body
administrative responsible for the treatment, the data object of the treatment, the
purpose of this, the origin of the data and if they have or will be communicated to third parties.

The right of access is independent of the right of access to public information

that regulates Law 19/2013, of December 9, on transparency, access to
public information and good governance. It is also independent of the right of access
to documentation in an administrative procedure, regulated by Law 39/2015, of
October 1, of the Common Administrative Procedure of the administrations
Public (LPACAP) or access to documents that are part of a file

school, except for those documents that contain health data, which enables the
obtaining them based on data protection regulations in correlation
with the Patient Autonomy Law (LAP)








C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/8








Furthermore, it is observed that, in the various requests made by the
complaining party, no mention is made or the right of access to data is requested
personal data of your children with the prescriptive requirements in the RGPD, in its article 15

"Right of access of the interested party" regarding the processing of personal data
related to the person in charge, but rather to obtaining the documents of a
school record, which has its own regulations for obtaining said
documentation.

As recognized by the jurisprudence of the CJEU, access to copies of the examinations

if they are part of the content of the right of access to personal data,
However, as has already been said, the request was made by accessing the
educational record and not as one of the rights recognized in the RGPD, for
Therefore, the complaining party may make the request addressed to the Delegate for the Protection of
Data, using the means made available by the person in charge for the exercise

of the rights recognized in the RGPD, and the receipt of
requests through other contact channels other than those expressly
planned.

The rights may be exercised directly or through a legal representative or
voluntary. The supporting documentation must necessarily be provided that the

affected has expressly authorized the applicant to exercise on his behalf the
Rights.

When you cannot get your rights to be taken care of and you want the intervention of this
Agency shall, once the period of one month from receipt of the

request, file a new claim, providing a copy of the request
processed by a means that allows proof of shipment and, if possible, receipt
by the person responsible for the treatment, as well as the answer received, if applicable.

In relation to the guide of this Agency on the exercise of the right of access to

personal data, which implies, among others, the right to obtain a copy of
These, in this regard it should be noted that, refers to the provision of a copy of the data
that are subject to treatment and those data that are related to your
person, but not to obtain a copy of specific documents, except those already
specified ups above.


The rest of the questions raised by the parties do not result from the competence of
this Agency, having to settle and resolve by the corresponding instances.

Considering the cited precepts and others of general application,
the Director of the Spanish Data Protection Agency RESOLVES:


FIRST: DISMISS the claim made by Ms. A.A.A. Front of
COUNCIL OF EDUCATION, *** IES B.B.B ..

SECOND: NOTIFY this resolution to Ms. A.A.A. and to the COUNCIL OF

EDUCATION, *** IES B.B.B ..

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/8










Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the

Director of the Spanish Agency for Data Protection within a month to
counting from the day after the notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of

the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.



                                                                               1037-100919
Mar Spain Martí

Director of the Spanish Agency for Data Protection










































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es