CTPDA (Andalusia) - RPS-2023/001
From GDPRhub
| CTPDA - RPS-2023/001 | |
|---|---|
 | |
| Authority: | CTPDA (Andalusia) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 6 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 03.07.2020 |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | City Council of Jerez de la Frontera |
| National Case Number/Name: | RPS-2023/001 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | CTPDA (in ES) |
| Initial Contributor: | Bernardo Armentano |
Based on presumption of common property, the controller initiated a debt recovery proceding against a data subject that was married under full separation regime and illegally disclosed the spouse's debt information to them. The DPA issued a reprimand.
English Summary
Facts
During a debt recovery procedure, the City Council of Jerez de la Frontera (the controller) requested financial data of the data subject's from the National Social Security Institute. The controller erroneously assumed that the data subject was jointly liable for a debt relating to a property acquired by their spouse. However, the data subject was married under a full separation of property regime. After receiving a notice of seizure of the pension paid by the National Social Security Institute, the data subject filed a complaint with the DPA arguing that they received personal information concerning their spouse without their consent. The data subject further alleged that the controller obtained access to their economic and property information without having a legal basis to do so. In response, the controller claimed that the data processing was based on the public interest and on the exercise of its administrative, fiscal and accounting powers. However, it did not check whether the spouses were indeed married in community of property, initiating a seizure procedure against the data subject based on a legal presumption.
Holding
The DPA stressed that, according to the GDPR, information relating to debts is considered personal data as it concerns an identified or identifiable person. In the specific case, the notification sent to the data subject contained not only their full name and ID number, but also those of their spouse. The DPA noted that the processing of the personal data referred to by the data subject was twofold. The first consisted in disclosing the debtor's personal data to a third party, in this case, their spouse. The second consisted in obtaining personal data from the National Social Security Institute. The DPA observed that the controller based these processings on a erroneous "presumption of joint ownership" instead of checking the actual marital status of the data subject, which was easily available to it in the Civil Register. According to the DPA, before engaging in such activities, the controller must make sure that the processing is in compliance with data protection regulations. Therefore, the controller should have carried out the relevant consultations in order to prevent unlawful processing of personal data. The non-observance of basic data verification measures, which the controller had at its disposal, represented an obvious risk to the data subjects. Based on the above, the DPA issued a reprimand for breach of Article 6 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Resolution RPS-2023/001
[Proc. PS-2022/003 - File. RCO-2020/045]
RESOLUTION OF SANCTIONING PROCEDURE
Subject: Resolution of disciplinary procedure against the City Council of Jerez de la
Frontera for an alleged infringement of the personal data protection regulations.
BACKGROUND
First. On July 3, 2020, a claim was filed with the Council for Transparency and
Protection of Data of Andalusia (hereinafter, the Council) against the City Council of Jerez de
la Frontera (hereinafter, the organ claimed), for an alleged infringement of the regulations of
personal data protection.
The said complaint stated, among other issues, the following:
"I attach notifications received today, regarding the embargo on the pension
that I receive from the I.N.S.S. (one notice is in the name of [own name cited], my
wife, and another notification in my name, each one by name and in separate envelopes and
closed) I have my wife's authorization to provide a copy of her notification.
Attached deed of separation of property, formalized before getting married, and
registered in the civil registry, as can be verified in the last page of the aforementioned
writing, as proof of my claim against the Hon. City Hall of Jerez de la
Border.
I denounce that the aforementioned consistory has notified me a debt and information about my
wife, without her consent, as you can see in the attached notice,
which I am the addressee.
I denounce that the aforementioned consistory has requested personal data of the
subscribes, financial information on assets, according to the content of the notification that
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 1 of 19 Document suitable for publication in the Portal del Co www.ctpdandalucia.es I have received, I am not part of that administrative procedure, I do not owe anything
of IBI, I am not the owner, the house was bought by my wife in the year [yyyy], we
we got married [later] on [yyyy], [other personal descriptive data] on
Property separation regime, which I demonstrate by attaching the deeds.
Having said this, some official of the aforementioned consistory, making use of the power to access
the personal data of citizens, has made inquiries that did not
proceed, has requested information in the property registry for which he comments
in the notification, and has requested information from the INSS, having received
information in this regard, when they try to seize the pension that I receive, the INSS
has provided information, which it should not, and the official of the consistory, has
requested my information from who knows how many administrations, without it being appropriate, since
I can never be a part of that proceeding, since I don't own the home, and
just as they have found out that we are married, they must also know that we are
married under the separation of property regime, and said deeds are registered in the
civil registry, so the consistory has the means to obtain, first of all,
this information, not only that we are married, but in the regime that we have
contracted marriage, before beginning to request information about me,
SKIPPING ALL MY RIGHTS REGARDING DATA PROTECTION, reason
so I go to this data protection agency, and request the opening of
disciplinary file, so that these violations in terms of protection of
data is not repeated in the future, neither with me, nor with any other citizen. [...]”.
Attached to the claim:
- Copy of the prenuptial agreement deed, dated [dd/mm/yy], registered in the
Civil Registry dated [dd/mm/yy].
- Copy of the notification of the remuneration garnishment proceeding sent to the
claimant by the City Council of Jerez de la Frontera for a debt of his wife.
- Copy of the notice of wage garnishment sent to the wife
of the claimant by the City Council of Jerez de la Frontera for a debt in his name.
Second. On July 20, 2020, another claim with the same
object presented by the claimant in the Spanish Agency for Data Protection, on 3
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 2 of 19 Document suitable for publication on the C Portal www.ctpdandalucia.es July 2020, giving this transfer to this Council, as it is the competent control authority
in its processing.
The same documentation was attached to the claim as that provided by the claimant to the
Advice.
Third. On July 28, 2020, by virtue of the provisions of article 57 of the Law
39/2015, of October 1, of the Common Administrative Procedure of the Administrations
Public (hereinafter, LPACAP) the director of the Council agreed to the accumulation and processing
joint of both procedures by keeping these a substantial identity.
Room. By virtue of articles 37 and 65 of Organic Law 3/2018, of December 5, of
Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), the
On July 30, 2020, the claim was transferred to the Data Protection Delegate of the
Jerez de la Frontera City Council (hereinafter, DPD) or, where appropriate, the person in charge of the
treatment so that, within a maximum period of one month, he communicated the response given to the
claim and, where appropriate, the actions taken in relation to it.
Fifth. On August 6, 2020, a writ of extension of
the claim presented by the claimant where the following was stated:
“I request that this extension of the claim be upheld.
As irrefutable proof of the irregularities committed by the Hon. City hall
of Jerez de la Frontera, attached notification received, in which it notifies the cancellation of
embargo on the INSS pension that I receive.
It is proven that they have provided me with information about my wife that they never owed me
inform, violating the duty of confidentiality included in both the GDPR and the
LOPDGDD, in addition, to consult my data in other administrations, because otherwise
In this way, said body would not be aware that I am receiving a pension from the INSS”.
[…]”.
The claimant attached the notice of cancellation of the wage garnishment
sent by the requested body.
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 3 of 19 Document suitable for publication on the www.ctpdandalucia.es Portal On September 8, 2020, the Council transferred to the DPD this new documentation sent by
the claimant.
Sixth. On October 7, 2020, the claimant directed a new extension of his
claim to this Council where he reported, among other issues, the following:
“Attached, response received today, from the DPD of the consistory of my town.
1º They answer once my claim has been received before you, for which reason my complaint was not addressed.
right of access in due time and form, if applicable, I request the opening of the file
sanctioning system, with the sole purpose that it serve so that, in the future, they attend to
correctly to citizens who exercise their right of access.
2º Without taking any steps, and as stated in their writing, they presumed that we were
married in community property, for which they misused the machinery of the
public administration, I still do not know, because they do not say anything about it, what information
they requested the INSS about me, but they communicated to third parties, a debt that I did not care about at all
affects, nor am I responsible for it. If this bad abuse, of the machinery of the
administration, which allows obtaining information from citizens, and the power granted to them
of being able to carry out embargoes on pensions or bank accounts, will remain without being penalized
by this "Andalusian Data Protection Transparency Council" it will not be avoided that,
in the future continue to violate the rights of citizens...
Please consider that this extension of claim has been submitted, the file of which corresponds to
to reference RCO-2020/045, keep in mind that not only was my right to
access, until I have knowledge of my claim before you, and that in a
deliberately, they notify me of a debt of my wife, and they inform the INSS that I am a debtor of
a debt, which is not true or truthful, for these reasons, I reiterate before you, in my
request that they open disciplinary proceedings against said consistory; For information purposes,
I inform you that in view of what happened on the part of the consistory, they proceeded to request help from a
family, to satisfy the debt claimed by the consistory, to avoid, that they continue
disclosing my wife's file to third parties."
It attached a report sent by the DPD to the claimant dated October 7, 2020 where
stated, among other things:
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 4 of 19 Document suitable for publication in the Portal del Co www.ctpdandalucia.es "[...] Once the file for the embargo of
remuneration of the person who brings this claim, it is verified that it was the
[claimant's wife] who communicated his identity as her husband in writing
presented by the Jerez City Council on 01/14/2020. An extract of the letter is attached.
[…]
In this regard, once the existence of this marriage was known, by the Collection
Municipal, the presumption of profit of the assets existing in the
marriage that includes the Civil Code in its article 1,361, and therefore the character of
joint debtor of the debtor's husband.
Pursuant to article 94 of Law 58/2003, General Taxation, the Collector
Municipal proceeded to request the INSS data on the pensions they could receive
the members of the marriage, action for which the authorization of
the debtors. It is not necessary either, applying the presumption of profit,
the authorization of the debtor to notify the husband of the seizure of property
remunerations.
If you were not given access to the requested file, it was because you were transferred to the
Collection of the City Council of Jerez de la Frontera of 5 documents presented by the
You dated 07/03/2020: 2 to the Jerez City Council and the other 3 to the I.N.S.S., to the
A.E.A.T. and to the Diputación de Cádiz, who in turn transferred them to the City Council of
Sherry.
Given such repetition of writings, the embargo was canceled without further delay.
failing to provide a response to your request for access.”
Seventh. Once the claim began its processing in accordance with the procedure
established in Title VIII of the LOPDGDD, and by virtue of article 67.1 thereof, dated
October 20, 2020, the director of the Council ordered the start of preliminary proceedings of
investigation for the purpose of achieving a better determination of the facts and circumstances
that justify the processing of a possible disciplinary procedure.
Eighth. After carrying out the report of conclusions corresponding to the previous actions
of investigation, on April 27, 2022, the director of the Council issued the Agreement to Start the
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 5 of 19 Document suitable for publication in the Portal del Co www.ctpdandalucia.es disciplinary proceedings against the City Council of Jerez de la Frontera, with NIF P1102000E,
for the alleged infringement of article 6 GDPR, classified in article 83.5.a) GDPR, and punishable
with warning in accordance with article 77.2 LOPDGDD.
Nineth. Notified the initiation agreement to the requested body, this, on May 13, 2022,
submitted a pleadings brief in which, in summary, it stated the following:
“[...] First, that the processing activity that encompasses the claim that
gives rise to this proceeding is included in 'collection' as stated in
the response to the requirement with reference [reference is cited] made before this
Council on October 7, 2020. In the same way, the review and
publication of the Registry of Treatment Activities (RAT) on the website of the
City Hall of Jerez de la Frontera.
Second, that the community property regime was effectively presumed in
where the claimant and his wife were, and that once the
regulatory considerations, this Council has established a protocol of
verification of the data before the workers in charge of the collection area of the
City hall".
Tenth. On July 3, 2020, another claim was filed against the Jerez City Council for
similar facts that were included in the claim mentioned in the previous Background. With
dated December 13, 2022, the Director of the Council for Transparency and Data Protection of
Andalusia, agreed to the accumulation to the present disciplinary procedure, of both
claims to keep substantial identity with respect to the claimed facts; it, of
in accordance with the provisions of article 31 of Law 40/2015, of October 1, on the Regime
Law of the Public Sector and in article 57 of the Law of Law 39/2015, of October 1, of the
Common Administrative Procedure of Public Administrations, and with the purpose of
maintain a single procedure that determines the possible sanction on the facts, which have already
had been considered in the corresponding Initiation Agreement of this procedure
sanction issued against the requested body.
Eleventh. Once the instruction of the procedure was completed, the corresponding
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 6 of 19 Document apt to be published on the Co Portal www.ctpdandalucia.es resolution proposal, which was notified to the alleged offender on December 15, 2022
establishing a term of ten working days for the formulation of allegations, in accordance
with article 89.2 LPACAP and in relation to article 73.1 thereof.
On December 21, 2022, the allegations of the body entered into this Council
initiated the proposal for a resolution formulated by the instructor of the file, in which the
indicates:
“First.- That, being the claimant herself the one who provided the corporation with the data of
her husband by writing dated 01/14/2020, the City Council, has not obtained the
data of [XXXXX] in a way contrary to the data protection regulations,
likewise, in the same letter mentioned, it is recorded that the husband of the
debtor was aware of the debt that is the subject of the claim.
Second.- That, in this regard, once the existence of this marriage was known, for
the Municipal Collection, the presumption of profit of the assets was applied
existing in the marriage that includes the Civil Code in its article 1,361, and therefore
the character of joint debtor of the husband of the debtor. Not being until a moment
later, when it is proven that the economic regime of the debtor is the
separation of assets, the City Council applies the presumption of profit of the
assets existing in the marriage, therefore, firstly, the City Council
acts in accordance with what is established in the Civil Code.
Third.- That, finally, it should be noted that the City Council, once it receives the
claim by the debtor's husband, and check the deeds of
prenuptial capitulations of the claimant, acts diligently making the
cancellation of the embargo as soon as the regime is detected and verified
matrimonial economy”.
PROVEN FACTS
From the documents in the file and the actions carried out, they can
considered as proven facts that:
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 7 of 19 Document suitable for publication on the C Portal www.ctpdandalucia.es Primero. According to the inventory of processing activities published by the body
1
claimed, in application of article 31.2 LOPDGDD and article 6 bis of Law 19/2013, of 9
December, on transparency, access to public information and good governance, the person in charge of
treatment "Collection" is the City Council of Jerez de la Frontera.
The purpose of said treatment is "purposes of public interest based on current legislation,
accounting, fiscal and administrative management”.
Second. On July 3, 2020, the claimant received from the respondent body a notification of
Proceedings of seizure of the pension that he received from the National Institute of Social Security
for a debt incurred by his wife.
Third. In the first clause of the deed of prenuptial capitulations of the claimant,
dated [dd/mm/yy] and registered in the Civil Registry, on [dd/mm/yy], is established as a regime
economic of marriage, the system of absolute separation of property.
Room. The Jerez de la Frontera City Council did not verify whether the spouses were married
in the community property regime or in the separation of property regime and in application of a
"presumption of profit" proceeded to initiate an attachment process against the claimant
as a consequence of a debt contracted by his wife, communicating the data of the
debtor to the now complainant.
Fifth. The City Council of Jerez de la Frontera requested economic and patrimonial data from the
claimant to the National Institute of Social Security after wrongly considering it as
part of a debt collection procedure contracted by a third party and as
alleged joint debtor with respect to his wife's debt.
FUNDAMENTALS OF LAW
First. The competence to resolve the disciplinary procedure for possible
1 https://www.jerez.es/fileadmin/Documentos/lopd/
CITY COUNCIL_OF_JEREZ_DE_LA_FRONTERA_REGISTRO_DE_ACTIVIDADES_COMO_RT__PUBLICO_.pdf
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 8 of 19 Document suitable for publication on the Portal of www.ctpdandalucia.es Breach of personal data protection regulations, in relation to the facts
described, corresponds to the director of the Board by virtue of the provisions of articles 43.1 and
48.1.i) of Law 1/2014, of June 24, on Public Transparency of Andalusia (hereinafter,
LTPA), in articles 10.3.b) and 10.3.i) of the Statutes of the Council of Transparency and
Data Protection of Andalusia (approved by Decree 434/2015, of September 29) and in
articles 57 and 64.2 LOPDGDD.
The Council, as the regional authority for the protection of personal data, and within its
jurisdiction, exercises the functions and powers established in articles 57 and 58
GDPR.
Second. Article 1.1 of the GDPR states that "[t]he present Regulation establishes the rules relating to
the protection of individuals with regard to the processing of personal data and
the rules relating to the free circulation of such data”. According to article 4.1 GDPR it is understood
by “personal data”, “[a]ll information about an identified or identifiable natural person (“the
interested"); An identifiable natural person shall be considered any person whose identity can be
be determined, directly or indirectly, in particular by means of an identifier, such as
a name, an identification number, location data, an online identifier, or one or
various elements of physical, physiological, genetic, psychological, economic, cultural or
of said person”.
For its part, article 2.1 of the GDPR provides with respect to its scope of application that “[t]he
This Regulation applies to fully or partially automated data processing
personal data, as well as the non-automated processing of personal data contained or intended
to be included in a file”, defining the concept of “treatment” in article 4.2 GDPR
as "any operation or set of operations carried out on personal data or
sets of personal data, whether by automated procedures or not, such as the collection,
recording, organization, structuring, conservation, adaptation or modification, extraction,
consultation, use, communication by transmission, diffusion or any other form of authorization
of access, collation or interconnection, limitation, deletion or destruction”.
In accordance with the previous definitions, and in relation to the case at hand, the data of
a person referring to the name and surnames, DNI, economic and patrimonial data and debt
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 9 of 19 Document suitable for publication on the C Portal www.ctpdandalucia.es contracted by a third party, must be considered personal data subject to the provisions of
the GDPR, since it deals with information about an identified or identifiable natural person
(The names, surnames and ID of the claimant and his wife appear, which
allows clear identification) to those undergoing treatment. Consequently, both the
personal data processed as the treatment that is carried out of the same must be submitted to
the provisions of the regulations on protection of personal data.
The treatments that are observed in relation to the personal data to which it makes
reference to the claimant are two: the first, the one made by the organ claimed, from
information for which it is responsible as a collection body, a consequence of the management
of debt collection to the City Council itself, communicating the data of the debtor to the
claimant as part of a procedure in which he is not considered an interested party;
and the second, the request by the City Council for economic data on the
claimant to another administration (the INSS) after wrongly considering it as part of the
aforementioned collection procedure.
Third. Article 6.1 GDPR establishes the conditions that give rise to the legality of a
processing of personal data:
Processing will only be lawful if at least one of the following conditions is met:
a) the interested party gave his consent for the processing of his personal data for one
or various specific purposes;
b) the treatment is necessary for the execution of a contract in which the interested party is
party or for the application at his request of pre-contractual measures;
c) the processing is necessary for compliance with a legal obligation applicable to the
responsible for the treatment;
d) the processing is necessary to protect the vital interests of the data subject or of another
Physical person;
e) the treatment is necessary for the fulfillment of a mission carried out in the interest
public or in the exercise of public powers conferred on the data controller;
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 10 of 19 Document suitable for publication in the Portal del Cowww.ctpdandalucia.es f) the processing is necessary to satisfy the legitimate interests pursued by the
responsible for the treatment or by a third party, provided that such interests are not
the interests or fundamental rights and freedoms of the data subject prevail
require the protection of personal data, in particular when the data subject is a child.
The provisions of letter f) of the first paragraph shall not apply to the treatment carried out
by public authorities in the exercise of their functions.
As far as this motion for a resolution is concerned, mention must be made of the provisions of
Article 141 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector (in
hereinafter, LRJSP) regarding the "Duty of collaboration between Public Administrations", which
provides the following:
1. Public Administrations must:
a) Respect the legitimate exercise by the other Administrations of their powers.
b) Consider, in the exercise of its own powers, all public interests
involved and, specifically, those whose management is entrusted to the other
Administrations.
c) Provide other Administrations with the information they need about the activity that
develop in the exercise of their own powers or that is necessary for the
citizens can fully access information on a matter.
d) Provide, within its own scope, the assistance that the other Administrations could
request for the effective exercise of its powers.
e) Comply with the specific obligations derived from the duty of collaboration and the rest
that are established by law.
2. The required assistance and collaboration may only be refused when the public body or
the entity from which it is requested is not empowered to provide it in accordance with the provisions of
its specific regulations, does not have sufficient means to do so or when, to do so,
cause serious damage to the interests entrusted to the guardianship or to the fulfillment
of their own functions or when the information requested is confidential or
reserved. The refusal to provide assistance will be communicated with reasons to the
Applicant administration.
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 11 of 19 Document suitable for publication on the Council Portal www.ctpdandalucia.es 3. The General Administration of the State, those of the Autonomous Communities and those of the
Local Entities must collaborate and assist each other in the execution of their acts that have
to be carried out or have effects outside their respective territorial areas. The possible
costs that the duty of collaboration may generate may be passed on when so
agree”.
Room. Article 94 "Authorities subject to the duty to inform and collaborate" of Law 58/2003,
of December 17, General Tax, establishes that:
"1. The authorities, whatever their nature, the heads of State bodies,
of the autonomous communities and local entities; [...] and those who, in general, exercise
public functions, they will be obliged to provide the Tax Administration with as many
data, reports and records with tax significance is collected by
provisions of a general nature or through specific requirements, and to provide, to it
and to its agents, support, assistance, assistance and protection for the exercise of their functions. [...]
4. [...] The bodies of the Tax Administration may use the information
provided for the regularization of the tax situation of the obligors in the course of the
verification or inspection procedure, without it being necessary to carry out the
requirement referred to in section 3 of the previous article.
5. The transfer of personal data that must be made to the Administration
in accordance with the provisions of the previous article, in the previous sections of this
article or in another norm of legal rank, will not require the consent of the affected party. In this
scope, the provisions of section 1 of article 21 of the Organic Law shall not apply
15/1999, of December 13, Protection of Personal Data."
On the other hand, article 170 "Diligence of embargo and preventive annotation" of the aforementioned
Law 58/2003 dictates that:
"1. Each action of embargo will be documented in diligence, which will be notified to the person
with which said action is understood.
Once the assets or rights have been seized, the procedure will be notified to the obligor
tax and, where appropriate, to the third party owner, possessor or depositary of the assets if it is not
carried out the actions with them, as well as the spouse of the obligor
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 12 of 19 Document apt to be published on the Portal del Consej www.ctpdandalucia.es tax when the seized assets are community property and co-owners or co-owners
thereof".
Article 1361 of the Civil Code establishes that:
"The assets existing in the marriage are presumed to be joint property until it is proven that
belong exclusively to one of the two spouses".
Fifth. Article 4 "Registrable Facts" of Law 20/2011, of July 21, on the Civil Registry,
indicates that:
"They have access to the Civil Registry the facts and acts that refer to the identity, marital status and
other circumstances of the person. They are, therefore, registrable:
1st The birth.
[...]
7th Marriage. Separation, annulment and divorce.
8. The legal or agreed matrimonial property regime.
[...]."
On the other hand, article 8.2 of the aforementioned Law 20/2011, establishes that:
"All Administrations and public officials, in the exercise of their powers and
under their responsibility, they will have access to the data contained in the single Civil Registry
with the exceptions relating to specially protected data provided for in this Law.
Said access will also be carried out through electronic procedures with the
requirements and technical prescriptions that are established within the National Scheme of
Interoperability and the National Security Scheme".
Sixth. In the Agreement to initiate the disciplinary procedure, this Council indicated that, with the
information in the file, it had not been possible to determine specifically the
treatment activity in which the Jerez de la Frontera City Council had framed the
management of embargoes or the request for information as a collection agency to other
administrations. Nor had it been possible to obtain said information by consulting the
inventory of treatment activities through the website of the aforementioned City Council,
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 13 of 19 Document suitable for publication on the Council Portal www.ctpdandalucia.es since it was not available there, despite the fact that it should be subject to
publication in application of article 31.2 LOPDGDD and, also as part of the Advertising
Assets of the entity, by virtue of article 6 bis of Law 19/2013, of December 9, on
transparency, access to public information and good governance. In this regard, the body
claimed, in his brief of allegations of May 13, 2022, has informed this Council
that the processing activity that encompasses the claim that gives rise to this
procedure is included in 'Collection', as well as that it has proceeded to review and
publication of the Registry of Treatment Activities of the City Council of Jerez de la
Border on the website of the aforementioned Town Hall. This point has been confirmed by this
Advice.
Likewise, in the aforementioned pleadings brief, the requested body confirms to this body
that effectively presumed the community property regime in which the
claimant and his wife, and that, therefore, a verification protocol has been established for the
data to the workers in charge of the collection area of the City Council.
Therefore, in accordance with all of the foregoing, the allegations presented in relation to the
Initiation Agreement do not distort the essential content of the infringement that is declared committed
nor do they imply sufficient justification or exculpation.
Seventh. Notified the resolution proposal to the requested body and as indicated in the
background, he presented a brief of allegations, in which -essentially- he returned to
reproduce allegations made throughout the procedure; in any case, said
Allegations were analyzed and it is considered that they do not distort the essential content of the
an infraction that is declared committed, nor do they imply sufficient justification or exculpation,
regardless, furthermore, of whether the cancellation of the
embargo.
Eighth. From the documentation in the file, and as already stated in the
section Proven Facts, it has been proven that on July 3, 2020, the claimant
received from the City Council of Jerez de la Frontera a notice of seizure of
his pension received from the National Institute of Social Security for a debt contracted by
his wife. Likewise, it has been accredited that in the deed of capitulations
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 14 of 19 Document suitable for publication on the Portal of www.ctpdandalucia.esprenupciales, dated [dd/mm/yy], in the first clause they establish "the separation system
property as economic regime of their marriage", deed registered in the
Civil Registry on [dd/mm/yy].
The organ claimed, therefore, in application of a "presumption of profit" proceeded
therefore to communicate personal data of a third person to the claimant and to initiate against
This is an embargo process as a consequence of the existence of a debt of which it was
that third person responsible, after accessing their data in the INSS. All this, when I had
accessible, through the existing information in the Civil Registry, the marital situation of the
claimant and the regime of said marriage.
Therefore, this Council understands that the requested body, before proceeding to communicate a
debt contracted by another person to the claimant, a third party unrelated to the procedure of
debt collection, and based on the requirements of the principle of active responsibility in
regarding compliance with data protection regulations, he had to carry out the
procedures or pertinent consultations in order to find out if the spouses were married in
community property regime or property separation regime; all this prior to
the application of the "presumption of profit" invoked, which would have avoided the incorrect
communication of personal data (without there being a cause of legitimacy for it) and the
commencement of the procedure for seizure of the claimant's pension, husband - under
separation of assets- of the person holding the debt. The non-observance of some measures
basic methods of data verification, which the City Council also has at its disposal, supposes
an obvious risk in relation to the processing of personal data in cases such as the one
concerns us and would facilitate the inappropriate communication of said data.
Regarding the second processing denounced by the claimant, the request for data
assets of the same to the INSS, if the organ claimed, in accordance with the
provided in article 141 LRJSP already referenced, would have consulted, for example, the Registry
Civil in order to find out if the spouses were married in community property or in
property separation regime, it would not have been necessary to request information on data
of the claimant to the National Institute of Social Security, within a
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 15 of 19 Document suitable for publication on the Portal www.ctpdandalucia.es debt collection procedure or, consequently, communicate a debt contracted
for his wife.
Consequently, in relation to the facts that are the subject of the claim, the conduct of the body
claimed, as responsible for the treatment, when consulting the National Institute of
Social Security personal data of the claimant and communicate personal data of the wife
of the claimant related to a private debt of the latter, failed to comply, due to the circumstances
previously exposed, the aforementioned article 6 GDPR, given the absence of legitimacy both for
Consultation of the claimant's data at the National Institute of Social Security (since it is not
joint and several debtor for having married under a separate property regime) as well as for the
Communication of the personal data of said person to the claimant.
Regardless of the above, it is also appropriate to value the measures that with
subsequently the City Council has taken, with a view to better compliance with the regulations.
Nineth. Failure to comply with "the basic principles for treatment, including the
conditions for consent under articles 5, 6, 7 and 9" of the GDPR contemplates
as an infringement of the personal data protection regulations in article 83.5.a) GDPR;
the aforementioned conduct is also contemplated, for prescription purposes, as
very serious infraction in article 72.1 b) LOPDGDD:
"b) The processing of personal data without the fulfillment of any of the legal conditions
of the treatment established in article 6 of Regulation (EU) 2016/679”.
In the present case, the infringing circumstances provided for in article 83.5.a) concur.
GDPR transcribed.
Tenth. Article 58.2 GDPR provides that:
"Each control authority will have all the following corrective powers indicated
next:
[...]
b) send a warning to any person in charge or person in charge of the treatment when the
processing operations have infringed the provisions of this Regulation;
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 16 of 19 Document apt to be published on the Portal of www.ctpdandalucia.es [...]
d) order the controller or processor that the processing operations
comply with the provisions of this Regulation, where applicable, of a
certain manner and within a specified period of time;
[…]”.
On the other hand, article 77 LOPDGDD establishes the sanctioning regime applicable to
certain categories of controllers or processors; in particular, in his
Section 1.c) includes "[t]he General State Administration, the Administrations of the
autonomous communities and the entities that make up the Local Administration". In the aforementioned
Article, in its section 2, states that:
"When those responsible or managers listed in section 1 commit any of
the infractions referred to in articles 72 to 74 of this organic law, the authority
of data protection that is competent will issue a resolution sanctioning them
with warning. The resolution will also establish the measures to be adopted
so that the conduct ceases or the effects of the infraction that has been committed are corrected".
Thus, in accordance with article 77.2 LOPDGDD, the sanction that should be imposed on the person responsible
of the treatment is the warning, without being able to adopt additional measures due to the fact that
the City Council has already proceeded to its adoption.
Eleventh. In relation to the notification of the resolution of the disciplinary procedure, the
Article 77.2 LOPDGDD provides that "[t]he resolution shall be notified to the person in charge or in charge of the
treatment, to the body on which it depends hierarchically, where appropriate, and to those affected who have
the condition of interested party, if applicable".
In addition, article 77.4 LOPDGDD states that "[s]e must be notified to the authority of
data protection the resolutions that fall in relation to the measures and actions to which
refer to the previous sections", and 77.5 LOPDGDD, which "[w]ill be communicated to the Ombudsman
People or, where appropriate, to similar institutions of the autonomous communities the actions
carried out and the resolutions issued under the protection of this article".
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 17 of 19 Document suitable for publication on the Con Portal www.ctpdandalucia.es By virtue of all of the above and in accordance with applicable legislation, the Director of the Council
of Transparency and Data Protection of Andalusia
RESOLVES
First. Direct a WARNING to the City Council of Jerez de la Frontera, with NIF
P1102000E, for violation of article 6 GDPR, classified in article 83.5.a) GDPR.
Second. That this resolution be notified to the infringing body.
Third. That this resolution be communicated to the Andalusian Ombudsman, of
in accordance with the provisions of article 77.5 LOPDGDD.
In accordance with the provisions of article 50 LOPDGDD, this resolution will be made
public, dissociating the corresponding data, once it has been notified to the
interested.
Against this Resolution, which puts an end to the administrative process, it is possible to file an appeal
optional replacement before this Council, within a month, or file directly
contentious-administrative appeal before the Contentious-administrative Jurisdiction within the term
of two months, in both cases counting from the day following the notification, of
in accordance with the provisions of articles 30.4, 123 and 124 of Law 39/2015, of 1 December
October, of the Common Administrative Procedure of Public Administrations and in the
Articles 8.3, 14.1 and 46.1 of Law 29/1998, of July 13, regulating the Jurisdiction
Contentious-Administrative.
In accordance with the provisions of article 90.3. a) LPACAP, may be provisionally suspended
firm administrative resolution if the interested party manifests before this Council his/her
intention to file a contentious-administrative appeal and transfers to it, once
filed, the documentation that accredits its presentation. If the Council did not have
knowledge of the filing of the contentious-administrative appeal within the term
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 18 of 19 Document apt to be published on the portal www.ctpdandalucia.escorrespondiente or in said appeal the precautionary suspension of the resolution will not be requested,
would terminate the said suspension.
THE DIRECTOR OF THE TRANSPARENCY COUNCIL AND
DATA PROTECTION OF ANDALUSIA
Jesus Jimenez Lopez
Resolution RPS-2023/001 (Proc. PS-2022/003 - File RCO-2020/045)
Page 19 of 19 Document suitable for publication in the Portal del Cowww.ctpdandalucia.es
