APDCAT (Catalonia) - IAI 43/2022
|APDCAT - IAI 43/2022|
|Relevant Law:||Article 5(1)(a) GDPR|
Article 6(1)(c) GDPR
Article 6(3) GDPR
Article 15(1)(g) GDPR
Article 86 GDPR
Llei 19/2014, de 29 de desembre, de transparència, accés a la informació pública I bon govern
|National Case Number/Name:||IAI 43/2022|
|European Case Law Identifier:||n/a|
|Original Language(s):||Catalan, Valencian|
|Original Source:||APDCAT (in CA)|
The Catalonian DPA issued an opinion regarding a request for access to the investigation file of a bullying case in a school. The request was made by the parent of the minor who reported the bullying. The DPA held that the information should be disclosed to the extent that it balances the interests at stake.
English Summary[edit | edit source]
Facts[edit | edit source]
The data subject’s parent requested access to an anti-bullying investigation protocol. Specifically, the parent wanted to access the file containing the investigation conducted by the school (the controller) regarding a case of bullying against the data subject. This request was submitted following the controller's decision to close the case and conclude that there was no bullying (and no punishment) for the minors involved.
The controller denied the request because the requested information contained personal data of other minors and their parents, the school staff, and other documents containing sensitive data. Therefore, the disclosure of this information could affect the minor’s personality development in the future. The parent further complained to the Commission for the Guarantee of the Right to Access Public Information who requested the Catalonian DPA to formulate an opinion regarding this matter.
Holding[edit | edit source]
The Catalonian DPA started by analysing the legal basis for that processing according to Article 5(1)(a) of the GDPR. The supervisory authority stated that for Article 6(1)(c) GDPR to be applicable (processing needed for compliance with a legal obligation), the obligation must be established by law, as foreseen in Article 6(3) GDPR and its counterpart of the national law, Article 8 of Ley Orgánica 3/2018. On the other hand, Article 86 of the GDPR foresees the disclosure of personal data contained in public documents should be balanced with the right to data protection of others.
The DPA concluded that the information regarding the alleged bullying case was considered public (since the investigation and application of the anti-bullying protocol were performed by a public administration). Furthermore, the DPA stated that the parent had the right to access the information related to the minor as their legal representative.
In relation to the special categories of data within the documents requested, the regional law for transparency and public information access states that express consent from the data subject is needed otherwise the information cannot be disclosed. Therefore, in case the documents contain special categories of data of third parties, they could be disclosed to the parent of the data subject.
Concerning the information contained in the file about employees who participated in the investigation, the regional law for transparency and public information access allows disclosure only of their identification data (name, last name, role, grade, functions, and work contact details) unless there are circumstances that make it necessary a prevalence of the right to data protection which were not observed by the DPA in the present case. However, the authority highlighted the prohibition of disclosing other identification data such as ID number, and signature taking also into consideration the principle of data minimisation in relation to the purpose of the processing.
Subsequently, the DPA stated that other data (meaning data not related to the data subject, no special category of data, not related to public employees), but data from other school staff who are not public employees. The DPA considered that the function they perform is probably already known to the parent. Therefore, the affection for their privacy is low and the disclosure of their identification data is predominant.
In relation to data about other minors’ parents (alleged bullying students) and third parties, the DPA considered the motivation of the request for access which was “the option of complaining about the school's negligence in the investigation of the bullying case”. The DPA stated that accessing that information could be relevant since their testimonies could have influenced the school's decision about the existence or not of bullying, as well as giving the petitioner the possibility to challenge them according to Article 24 of the Constitution about the right to self-defence. Notwithstanding the above, the DPA decided that a preliminary hearing to determine if there were personal circumstances or reasons to justify the protection of their identity was necessary, as foreseen in the regional law. Otherwise their names, last names, and statements (no contact details) can be disclosed.
In conclusion, the DPA allowed access to the documents related to the data subject; the identification data of public employees involved in the investigation; the identification data of involved employees; and the names, last names, and statements by third parties unless the preliminary hearing shows a justification to limit their identification.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Catalan, Valencian original. Please refer to the Catalan, Valencian original for more details.
Ref.: IAI 43/2022 Report issued at the request of the Commission for the Guarantee of the Right of Access to the Public Information in relation to the claim against the denial of access in the file of the application of the protocol against school bullying in the case of a minor. The Commission for the Guarantee of the Right of Access to Public Information (GAIP) requests a the Catalan Data Protection Authority (APDCAT) that issues a report on the claim, presented in relation to the denial of access to the application file of the protocol against school bullying in the case of a minor. Analyzed the request, which is accompanied by a copy of the processed administrative file before the GAIP, in accordance with the report of the Legal Counsel, I report the following: Background 1. On September 13, 2022, a citizen sends a letter in which he requests the following public information: "For all the above, exercising my right of access to public information I request that the charter school (...) provide me with the following documentation and information. • The integrity of the documentation that makes up the protocol application file against harassment and cyberbullying among peers in the case of my daughter(...). • Correspondence with the affected parties. • The minutes of the different interviews: o With harassed minors where it is explored what the harassment episodes consisted of with the corresponding collection of graphic evidence that supported his story. o With the harassing minors and their means of proof. or With the observers o With the families (persecutors and harassed) and provision of documentation/evidence. • The constitution of the assessment team, which lists its members considerations they arrived at. • Documentation and evidence on which the director of the center bases her assessments, listing the alleged cases of indirect harassment and because it does not mention the cyberbullying that my daughter was suffering (from which the management of the center was knowledgeable). • Because the protocol does not mention one of the minors reported as harasser, who is precisely the daughter of a center worker? • Because the protocol does not mention that a center worker and mother of one of the harassing girls (the one that the protocol does not include) approached my daughter in the street to try to persuade her to report the harassment situation. • Based on which information and arguments the school adds a child (PS) as a suspect stalker in the protocol. A child that neither the minor harassed nor the family had never mentioned 1/9 • If the defamatory letter signed by several fathers and mothers of the harassing families it was part of the protocol. • That we be informed, as stated in the valuation report, at what time and with whom means the evaluation of the protocol was communicated to the EAP. This statement is false, prove it of this is that Education has on several occasions reprimanded the school for not reporting to the EAP • That the management of the school clarify the statement "some specific moments are appreciated of harassment to EC and IV students, but not harassment as such". 2. On October 11, 2022, the requested Department issues a resolution by which it is rejects the request for access to the requested public information. The rejection is is based on "the fact that the requested documentation contains information on minors and data considered particularly protected. In addition, the disclosure of this information may affect the free development of personality in the future of these minors of age. (Foundation of law 8). 3. On October 12, 2022, the applicant submits a claim to the GAIP against the Department for the denial of access to the file relating to the harassment of the his daughter In the claim, it states that you want access to: "Access to the documentation of the application file of the protocol against the harassment in the case of my daughter. (...)" 4. On October 25, 2022, the GAIP sends the claim to the Department requesting the issuance of a report on which to base their positions, as well as the complete file regarding the request for access to public information and the identification of third parties people who are affected by the requested access. It is not included in the documentation sent the corresponding report from the Department or the complete file related to the request for access to information.. 5. On October 25, 2022, the claimant sent an email to the GAIP where declares, in relation to his claim, that it is not his intention to have access to data personal and much less if it is the data of minors. In this sense requests that the information is provided to you in an anonymized manner. 6. On November 3, 2022, the GAIP requests this Authority to issue the report provided for in article 42.8 of Law 19/2014, of December 29, on transparency, access to the public information and good governance, in relation to the claim presented. Legal Foundations I (...) II The claim is filed against the denial by a Department of access to the documentation of the application file of the protocol against harassment and cyberbullying 2/9 between equals, relating to the claimant's daughter. Point out that the object of the claim is coinciding with that of a previous claim, which was the subject of IAI report 37/2022 of this Authority, dated September 30, 2022. In the present claim, the file is not included among the documentation sent by the GAIP complete application of the claimed protocol. It only states, provided by the claimant himself, the protocol application assessment report signed by the director of the center. Although not if the complete file is available, it can be expected that it will contain personal data both of the claimant's daughter and of the other minors involved, as well as of their parents and those responsible for processing the file, among others. To the extent that this information contains personal data, the RGPD will apply. Article 4.2) of the RGPD considers “treatment”: any operation or set of operations carried out on personal data or sets of personal data, either by automated procedures or not, such as collection, registration, organization, structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of enabling access, comparison or interconnection, limitation, suppression or destruction." The RGPD provides that all processing of personal data must be lawful (Article 5.1.a)) and, in this sense, establishes a system of legitimization of data processing that is based in the need for one of the legal bases established in article 6.1 to apply. Specifically, section c) provides that the treatment will be lawful if “it is necessary for the fulfillment of a legal obligation applicable to the person in charge of the treatment”. As can be seen from article 6.3 of the RGPD and expressly included in article 8 of the Law organic 3/2018, of December 5, on protection of personal data and guarantee of rights digitals (LOPDGDD), data processing can only be considered based on this legal basis of article 6.1.c) of the RGPD when so established by a rule with rank of law For its part, article 86 of the RGPD provides that "the personal data of documents officials in possession of some public authority or public body or entity private for the performance of a mission in the public interest may be communicated by said authority, organism or entity in accordance with the Law of the Union or of them Member States that apply them in order to reconcile public access to documents officials with the right to the protection of personal data by virtue of this Regulations." Law 19/2014, of December 29, on transparency, access to public information and good government (LTC), aims to regulate and guarantee the transparency of public activity. Article 18 of the LTC recognizes the right of people to “access public information, a referred to in article 2.b, in an individual capacity or in the name and representation of any person legally constituted legal entity" (section 1). Article 2.b) of the LTC defines “public information” as “the information prepared by the Administration and what it has in its power as a result of its activity or of the exercise of its functions, including that supplied by the other obliged subjects in accordance with the provisions of this law". 3/9 For its part, article 53.1 of Decree 8/2021, of February 9, on transparency and right of access to public information (RLTC), specific that it is public information subject to the right of access "all the information, any data or documents that the administrations public have prepared, possess, or can legitimately demand from third parties as a consequence of their activity or the exercise of their duties." The information available to the Department related to the case of alleged harassment school of the claimant's minor daughter object of claim is information public for the purposes of article 2.b) of the LTC and, therefore, remains subject to the provided access regime in this regulation, which establishes, as a general criterion, that the right of access to the public information can only be denied or restricted for express reasons established by law (article 20 et seq. LTC). Specifically, and with regard to the right to the protection of personal data, it is necessary to take into account that established in articles 23 and 24 of the LTC, as well as the principles of the regulations for the protection of personal data. III The resolution of the Department of Education that denies access to the information subject to the claim is based on the fact that the information contains special categories of relative data to minors Regarding the special categories of data, article 23 of the LTC establishes the following: "Requests for access to public information must be denied if the information that you want to obtain contains specially protected personal data, such as relatives to ideology, union membership, religion, beliefs, racial origin, health and life sexual, and also those relating to the commission of criminal or administrative offenses that are not lead to a public reprimand to the offender, unless the affected party expressly consents by means of a writing that must accompany the request." In the event that the claimed file contains special categories of data of the daughter of claimant, insofar as she is a minor and the claimant is the holder of the power parental, it must be taken into consideration that article 15 of the RGPD recognizes the right of access to the own personal information in the following terms: "1. The interested party will have the right to obtain from the person in charge of the treatment confirmation of whether or not personal data concerning you are being processed and, in such case, right of access to personal data and the following information: a) the purposes of the treatment; b) the categories of personal data in question; c) the recipients or the categories of recipients to whom they will or will be communicated communicated personal data, in particular recipients in third parties u international organizations; d) if possible, the expected retention period for personal data or, if not if possible, the criteria used to determine this period; 4/9 e) the existence of the right to request from the person responsible the rectification or suppression of personal data or the limitation of the processing of personal data related to interested, or to oppose said treatment; f) the right to present a claim before a control authority; g) when the personal data has not been obtained from the interested party, any person available information about its origin; h) the existence of automated decisions, including the creation of profiles, to which referred to in article 22, sections 1 and 4, and, at least in such cases, information significant about applied logic, as well as the importance and consequences provisions of said treatment for the interested party. 2. (…) 3. The person responsible for the treatment will provide a copy of the personal data object of treatment The person in charge may receive any other copy requested by him interested a reasonable fee based on administrative costs. When the interested party submits the request by electronic means, and unless this request is made that is provided otherwise, the information will be provided in an electronic format common use 4. The right to obtain a copy mentioned in section 3 will not be negatively affected to the rights and freedoms of others.” As this Authority has done on previous occasions (among others, in the IAI reports 9/2021, IAI 21/2021, IAI 51/2021 or IAI 3/2022, which can be consulted on the Authority’s website), based on article 15 of the RGPD, the person making the claim has the right to know the direct information about your person who is being treated by the Department and who is part of a file or that is included in the documentation or information you request. And this includes (article 15.1.g) RGPD) the identification of the source of the information. In addition, article 12.6 of the LOPDGDD provides that "the holders of parental authority may to exercise in number and representation of minors under fourteen the rights of access, rectification, cancellation, opposition or any other that could match them in the context of this organic law". By application of the aforementioned regulations, the person making the claim, to the extent that he is the owner of parental authority, has the right to know the information about his minor daughter dealing with the Department and that it is recorded in the file on the application of the harassment protocol peer school, which is part of said documentation. In the event that the file claimed contained data on other minors other than the daughter of claimant, or other people who require special protection in accordance with the article 23 LTC, access to this information should be denied. IV It is to be expected that the requested file also contains information relating to the authorities or public workers who have intervened due to the functions assigned to them, in its processing. With respect to this information, the forecasts of article 24.1 of the LTC, which provides the following: 5/9 “1. Access to public information must be given if it is information directly related to the organization, operation or public activity of the Administration that contains merely identifying personal data unless, exceptionally, in the specific case the protection of personal data or other rights must prevail constitutionally protected.” This article of the LTC allows access to the merely identifying data of people that intervene due to their functions in the different procedures or actions public works carried out by the Administration, unless specific circumstances arise that justify the prevalence of the right to data protection of the person or persons affected or other constitutionally protected rights. Article 70.2 of the RLTC specifies what is meant by merely identifying personal data in the following terms: "For the purposes of what is provided for in article 24.1 of Law 19/2014, of December 29, are personal data merely identifying those consisting of the first and last name, the position or position held, body and scale, the functions performed and the telephone and the addresses, postal and electronic, of professional contact, referring to the staff at the service of the public administrations, high-ranking officials and management personnel of the public sector of public administrations. In cases where the publication or access to an administrative document requires the identification of the author, the data of must be deleted, in particular location, the number of the national identity document or equivalent document and the handwritten signature If the signature is electronic, the electronically signed document must be published from so that it is not possible to access the properties of the electronic certificate used for the signature. Location data should be deleted in case it is not the data merely identifiers of the author in his position of position or staff in the service of public administrations." With regard to the transcribed articles, facilitate the access of the person making the claim to the data merely identification of the people who, in attention to the responsibilities or functions that have been assigned, have participated in the application of the school bullying protocol between equals in their daughter's school and/or in their control, in the terms indicated, a a priori would not be contrary to the right to the protection of personal data. That, unless exceptionally, in a specific case the protection of personal data must prevail or other constitutionally protected rights, which is not included in the present case. As indicated in article 70.2 of the RLTC, it is not relevant in these cases to facilitate other identification data of employees or public positions - such as the ID number or the handwritten signature - which may appear in the documentation subject to access, given that these data, from the point of view of the principle of minimization (article 5.1.c) RGPD), are unnecessary for the intended purpose, that is so that the citizen can identify them authorities and the staff at the service of the public administrations that attend to him in his 6/9 performance before the Public Administration and/or under whose responsibility the procedures Consequently, the DNI number and the handwritten signature should be removed authorities and public employees that may appear in the requested documentation. v With regard to the rest of the information that may be contained in the file claiming that it does not have the consideration of special categories of data in terms of article 23 LTC will be required apply article 24.2 of LTC according to which: "2. If it is other information that contains personal data not included in article 23, access to the information can be given, with prior reasoned weighting of the interest public in the disclosure and the rights of the affected persons. To carry out this weighting must take into account, among others, the following circumstances: a) The elapsed time. b) The purpose of the access, especially if it has a historical, statistical purpose or scientific, and the guarantees offered. c) The fact that it is data relating to minors. d) The fact that it may affect the safety of people. (...).” First of all, it is necessary to make a consideration regarding the data that may be included in the file, relating to the teachers, tutors or the director of the institute, for having intervened in the processing of the file. Given that the school that processed the claimed file is a concerted center, its workers will not, in principle, have the status of civil servants or public employees In this case, the weighting of article 24.2 LTC must have in consideration, on the one hand that the functions performed by these workers are, in principle, the same as those that would correspond to the public employees in respect of which article 24.1, provides, as has been explained, that access to your data must be given identifiers, as well as the privacy expectations that these workers may have regarding the actions carried out in the exercise of their functions. On the other hand, it is it is likely that this information is already known to the claimant and therefore prejudices him that can occur in their privacy must be considered minor. In attention to these considerations, the weighting must be favorable to the right of access to identifying data of these people. Regarding the rest of the information that contains personal data of the claimant or his daughter, the first element to be taken into consideration in the weighting of article 24.2 LTC is the right recognized in article 15 RGPD, which as explained in the foundation IV thereof report gives the claimant the right to know the information about his minor daughter is being treated by the Department following the application of the school bullying protocol between the same and that forms part of the claimed file. 7/9 The existence of this right, recognized by data protection regulations, is decisive necessarily the weighting referred to in article 24.2 of the LTC in favor of access to the data itself contained in the claimed documentation, which would include the data of the his daughter The right of access to one's own information also includes, among other aspects, the right to know the origin of this information (Article 15.g) RGPD). In the accompanying writings the claim, the person making the claim refers to the fact that interviews were carried out with the parents of the allegedly harassing minors. In the event that the file states information related to interviews or statements made by third parties such as they could be the statements of other minors of the claimant's daughter or theirs parents, from the perspective of article 24.2 of the LTC, and in relation to article 15.4 of RGPD, it is necessary to consider whether the person claiming would have the right to know both the identity of these people such as the statements made. To this end, although article 18.2 of the LTC provides that the exercise of the right of access to the public information "is not conditioned on the concurrence of a personal interest, nothing else subject to motivation and does not require the invocation of any rule", know the motivation of the request may be a relevant element to consider. In accordance with the statements made by the person claiming in their claim the purpose of the intended access is "to be able to prosecute the malpractice of the school (...) and of the Educational inspection in the application of the anti-harassment protocol in my case daughter". In this sense, to know the origin of the information that affects the person making the claim and his daughter may be relevant to be able to refute certain facts or situations described by these third parties, to the extent that they have been able to influence the center's decision school about the existence or not of signs of school bullying of the minor. It should be borne in mind that in accordance with the provisions of article 24 of the Spanish Constitution, all people have the right to obtain effective protection from judges and courts in the exercise of their rights, as well as, among others, they have the right to use the evidentiary elements that are relevant to your defense. In this context, for the purposes of guaranteeing the appropriate exercise of the right to judicial protection effective (Article 24 EC), it cannot be ruled out that the person claiming must be able to access to that information that is necessary for the defense of their rights and interests, or those of his minor daughter, including personal information. In this case, know which ones people attribute to the minor daughter of the claimant and also to herself facts and/or actions that would harm your interests, could be relevant to yours right of defense In addition, it cannot be ruled out, given the context in which the reported events took place, that the identity of these people (or some of them), may be known by the person claiming From the point of view of the affected persons, disclose identity information of these third parties who have been able to provide information about the person claiming and the their daughter, it may affect them to the extent that they are people with 8/9 who, both they and their children, shared the school environment. The revelation of whatever they are able to say or not say about the person making the claim, the daughter and the facts reported could end negatively affecting the relationships that these people can still maintain. For this reason, this Authority has noted the special relevance it has in these cases comply with the hearing procedure provided for in article 31 of the LTC, and find out if they exist personal circumstances or reasons that would justify preserving their identity. As this Authority has previously highlighted, for the purposes of limiting it access, it is necessary to prove specific circumstances that allow us to appreciate a clear damage due to the fact that the person making the claim can access their identity or other personal data people Thus, for example, the mere manifestation of the refusal of the affected person to access their data. In attention to the concurrent circumstances in the present case in view of the information of what is available, and without prejudice to what may result from the aforementioned hearing procedure, a priori can be identified with the name and surname of the third parties who have facilitated information about the claimant and his daughter, which may be included in the file, as well as the information provided. However, other identifying data of these people should be deleted (numbers of ID, signature) and contact details, in accordance with the principle of data minimization (article 5.1.c) RGPD), to be irrelevant for the intended purpose of the access. conclusion The data protection regulations would not prevent the claimant from accessing the information contained in the application file of the anti-bullying protocol, relating to his person and his minor daughter to the extent that he is the holder of the power parental There would also be no problem in simply facilitating access to the data identifiers of public employees or public officials in charge of the processing of the harassment file, nor of the teachers, tutors or the headmistress of the center where they went produce the facts, which may be contained therein. Likewise, access to the data could be facilitated IDs of the people who have provided information about the claimant's daughter and the information that they contributed to the file, unless following the hearing procedure there is some reason that justifies its limitation. In the event that the file contains special categories of data from other different people of the claimant's daughter access to this information should be denied. Barcelona, November 24, 2022 9/9