Persónuvernd (Iceland) - 2020010642
From GDPRhub
| Persónuvernd (Iceland) - 2020010642 | |
|---|---|
 | |
| Authority: | Persónuvernd (Iceland) |
| Jurisdiction: | Iceland |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1)(c) GDPR Article 6(1)(e) GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 30.09.2021 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | 2020010642 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Icelandic |
| Original Source: | Icelandic DPA (in IS) |
| Initial Contributor: | Florence D'Ath |
The Icelandic DPA considered that, when an individual reports a case to the Children Protection Committee (CPC), the disclosure of that individual's name by the CPC to her employer, and further processing of her personal data by the employer, are contrary to the GDPR.
English Summary
Facts
The employee of a primary school (the Complainant) called the Icelandic Child Protection Committee (CPC) to orally report the inappropriate behaviors of one of her colleagues towards children under their care. During the phone call, the employee of the CPC wrote down the name of the Complainant, but not the identity of the children concerned. Because this report did not include the name of any children, the CPC considered that it was not competent to investigate the case. Without informing the Complainant about it, the CPC then transmitted the report to the education and leisure department of the competent municipality (the Municipality). The Municipality then started an investigation and interviewed both the Complainant and her colleague. The Complainant had not been informed beforehand that she would be included in this procedure.
The Complainant considered that the disclosure of her name by the CPC to the Municipality without informing her beforehand, and the further processing of her personal data by the Municipality, did not comply with data protection law. The Complainant therefore decided to file a complaint with the Icelandic DPA.
The CPC argued, for its part, that the disclosure of the personal data of the Complainant was necessary and therefore lawful for the performance of a task carried out in the public interest (Article 9(5) of the Icelandic Data Protection Act no. 90/2018 , and Article 6(1)(e) GDPR). The Municipality further argued that the report had been legally shared by the CPC on the basis of Articles 16, 17 or 18 of the Icelandic Child Welfare Act no. 80/2002, and that no provision in that law required the CPC or the Municipality to inform the Complainant about it beforehand.
Holding
The Icelandic DPA reviewed the provisions of the applicable data protection law and of the Child Protection Act, to determine whether the processing of the personal data of the Complainant by the CPC and the Municipality was lawful.
Having regard to the circumstances of the case, the Icelandic DPA found that the disclosure of the Complainant's personal data to the Municipality was not compliant with the GDPR, and in particular with the principle of lawfulness, fairness and transparency (Article 5 GDPR). The Icelandic DPA noted in particular that the Child Protection Act did not contain any provision requiring the CPC to inform the responsible person (in this case, the Municipality) of the identity of the individual who had reported inappropriate behaviors towards children. It was therefore not necessary to disclose the name of the Complainant to comply with a legal obligation (i.e. Article 6(1)(c) GDPR). Furthermore, the Icelandic DPA noted that the CPC and the Municipality would have been able to carry out their mission without disclosing the name of the Complainant. It was therefore not necessary either to disclose the name of the Complainant for carrying a task in the public interest (i.e. Article 6(1)(e) GDPR).
The Icelandic DPA therefore concluded that both the disclosure of the Complainant's name by the CPC, as well as the further processing of the Complainant's personal data by the Municipality were unlawful under the Icelandic data protection act, which implemented the GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
Individuals FAQ complete FAQ electronic monitoring general privacy right to be forgotten right to information about their genotype What is processing? A new privacy legislation 2018Almennt the new legislation other interesting stuff educational booklet: Privacy children's booklet: Private youth booklet: public companies and administration asked and answered all the questions and answers electronic monitoring general privacy access right controllers, processors and vinnslusamningarÁbyrgðarskyldaVinnsluskrárNý Privacy legislation 2018FræðsluefniLög and reglurLög privacy rules and regulations other sacrificed rules and guidelines operating international and European law Solutions Solutions Reviews Licensing Various letters Privacy function Privacy News Mega political process personal data my campaign? How to process personal data in election campaigns? Staff and management for media requests for promotional events policy and gi ldiAnnual Reports201620152014201320122011201020092008200720062005200420032002200120001999Other ContentPrivacy PolicyLegal DisclaimerAccessibilityService DeskTwitterEnglishDecisions
Enter keywords
SolutionsReviewsLicensingMiscellaneous letters
Search for solutions
Year from:
Year to:
Search
Disclosure of the complainant's personal information to the School and Leisure Department and its subsequent processing not in accordance with law
Case no. 2020010642
9/30/2021
The Data Protection Authority has ruled in a case where a complaint was made about the communication of a notification to the child protection committee together with the complainant's personal information without his knowledge, but there was also a complaint about the following processing of the recipient of the information. The complainant reported to the child protection committee about his colleague's inappropriate behavior towards the primary school students who were in charge of both of them without naming the children. The child protection committee forwarded the case to the municipality's school and leisure department together with the complainant's personal information. The Data Protection Authority considered that the Child Welfare Committee's disclosure of the complainant's personal information was not in accordance with the law, especially with regard to the requirement of legality, fairness and transparency. As the Committee received the complainant's notification by telephone, it was obliged, in accordance with the duty of guidance of the Administrative Procedure Act and the special duty of guidance of the child welfare authorities, to instruct the complainant that his notification was deficient and that he considered that his complaint did not fall within its jurisdiction. find. Nowhere in the Child Welfare Act is it stated that the employer must be informed of who has sent a complaint to the child protection committee about inappropriate behavior towards children if such a suggestion is made to him. In view of the fact that the child protection service's dissemination of personal information about the complainant to the school and leisure department did not comply with the law, it cannot be seen that the following processing of the complainant's school and leisure department by the complainant's personal information can be considered lawful.
Ruling At a meeting of the Board of the Data Protection Authority on 24 August 2021, the following ruling was issued in case no. 2020010642 (formerly 2019061248): I. Proceedings 1. Outline of the case On 14 June 2019, the Data Protection Authority received a complaint from [A] (hereinafter referred to as the "complainant") about the child protection committee [X]'s disclosure of his personal information to the school and leisure department [municipality Y] without informing him or educating him about the forwarding. There are also complaints about the following and burdensome processing of the information by the school and leisure department [municipality Y]. 2. More about the complaint in Primary School [Z]. A few days later, the complainant was informed that his notification to the child protection committee had become a personnel matter at the municipality's human resources office. The complainant considers that the municipality handled carelessly sensitive personal information carelessly without his consent and started burdensome processing at his request and without his knowledge. The complaint was accompanied by several accompanying documents. On the one hand, a copy of two transcribed interviews with the complainant, both dated. 21 November 2016, and on the other hand e-mail communication between him and employees [municipality Y], incl. á m. the mayor, the privacy officer and the town clerk.3. Correspondence By letter dated On 4 July 2019, [municipality Y] was invited to provide explanations regarding the complaint. The answer was by letter dated. August 9, s.á. By letter dated At 15:00, the complainant was given an opportunity to comment on the explanations provided by [municipality Y]. The complainant's comments were received by letter dated 20. s.m.Auk [municipality Y] was considered a reason to give the child protection committee [X] the opportunity to object to the case and this was done by letter dated. June 3, 2020. The committee's response was received by letter dated. July 10, s.á. All the above documents have been taken into account in resolving the case, although not all of them are specifically described in the following ruling. he in a call to the child protection committee on [X] reported on the inappropriate behavior of his colleague at Grunnskólinn [Z] towards students who were in charge of both of them. The party who received his notification by telephone introduced himself as an employee of the child protection committee and asked the complainant about the facts of the case. The complainant traced several issues in the call, including communication with named individuals. The Child Protection Committee subsequently and without his consent or knowledge sent the notification, together with his personal information, to the municipality's school and leisure department. [Municipality Y] has since, on the basis of the complainant's notification in question, commenced onerous processing at his request and without his knowledge. The complainant had realized the aforementioned processing when he submitted a request for access to personal information about himself at [municipality Y] in April […]. The complainant is based on the fact that personal information about him, which originated in his notification to the child protection committee, was sent to the municipality's school and leisure department and used to start personnel matters. The complainant had not been formally informed that an administrative case had been established or that his case had been processed by the municipality and he doubted the legality of the processing. He had been given information about the continuation of the case when the head of the welfare department [municipality Y] called for coffee time at the teacher's office, where the complainant worked, and told him that he took the announcement seriously, but it had now become a staff matter. The complainant also finds it strange, in light of the fact that a survey was not conducted on the basis of the notification, that it was considered to provide grounds for notifying the matter to the employer and for initiating an independent investigation there.5. Y] states that the complainant's notification, received by the Child Protection Committee [X] in November […], was submitted to the child protection team, but in view of the fact that the complainant did not name any specific children in his notification to the committee, a decision was taken not to investigation of a case on the basis of the Child Protection Act no. 80/2002, instead forwards the application to the municipality's school and leisure department, with reference to the Administrative Procedure Act no. 37/1993. For that reason, a case has been created in the municipality's documentation system, among other things to keep track of the documents that were created during the processing of the case. If the case has been processed there as human resources and human resources manager as well as the head of the school and leisure department, interviewed both parties to try to inform the case. If the case has ended in such a way that there was no reason to take further action. Following further communication with the complainant, he was sent an explanation by letter dated. 13 May […], on why a complaint which he regarded as a notification to the child protection committee had been sent to the school and leisure department. Among other things, it was referred to that when a notification has been submitted on the basis of Articles 16, 17 or 18. Child Welfare Act no. 80/2002, no information is provided to the notifier on the continuation of the case. 6. Views of the Child Welfare Committee [X] The Child Welfare Committee's letter refers to a reply letter from [municipality Y] from 9 August […] and the committee bases itself on the same views as are stated there and refer to them in that respect. The child protection committee's letter specifically mentions its explanation of the decision to forward the complainant's notification to the municipality's school and leisure department. If the committee refers to the fact that a written complaint is received by the government authority that does not concern its area of responsibility, the complaint must be forwarded to the right place as soon as possible. In view of the fact that no children were named in the notification in question, the child protection committee concluded that the complainant's notification concerned his suggestion of alleged inappropriate behavior by the primary school employee and that it was rather a personnel matter [municipality Y]. The committee could not have initiated an investigation into a child protection case as no children had been named in the notification in question. It was also considered appropriate to investigate further the complainant's allegations against the school employee regarding the alleged behavior in question. In the light of the above, the case has been processed by [municipality Y] as a personnel matter. The Child Protection Committee refers to the fact that the authority of point 5 Article 9 Act no. 90/2018 on the protection of personal data and the processing of personal data was relevant as it involved the processing of information by the government which as such was related to the exercise of public power. The committee also refers to point 3. the same provision in light of the fact that the government is obliged to forward a complaint to the right place, in accordance with law. 90/2018, on personal data protection and the processing of personal data, and Regulation (EU) 2016/679, cf. Paragraph 1 Article 4 of the Act, and thereby the authority of the Data Protection Authority, cf. Paragraph 1 Article 39 of the Act, covers the processing of personal data that is partly or wholly automatic and the processing by other methods than automatic of personal data that are or should become part of a file. identify him, directly or indirectly, with reference to his identity or one or more factors that are characteristic of him, cf. 2. tölul. Article 3 of the Act and point 1. Article 4 of the Regulation. Processing refers to an action or series of actions where personal information is processed, whether the processing is automatic or not, cf. Number 4 Article 3 of the Act and point 2. Article 4 This case concerns, on the one hand, the child protection committee [X]'s dissemination to the school and leisure department [municipality Y] of the complainant's personal information, and on the other hand the subsequent processing of the information by the town's school and leisure department. In this respect and with regard to the above provisions, this case concerns the processing of personal data which falls within the competence of the Data Protection Authority. The person responsible for the processing of personal data complies with Act no. 90/2018 is named the responsible party. According to point 6. Article 3 of the Act refers to an individual, legal entity, government authority or other party who decides alone or in collaboration with other purposes and methods of processing personal information, cf. 7. tölul. Article 4 of the Regulation. As such, the Child Protection Committee [X] is considered to be responsible for the dissemination of personal information about the complainant to the school and leisure department [municipality Y]. The town is, however, considered to be responsible for the following processing of the information.2. Legality of processing2.1.About the authorization to disseminate personal information about the complainant All processing of personal information must be covered by one of the authorization provisions of Article 9. Act no. 90/2018. It may be mentioned that personal data may be processed if the data subject has given his consent to the processing for the benefit of one or more specific purposes, cf. 1. tölul. of the provision, it is necessary to fulfill the legal obligation that rests on the responsible party, cf. Point 3, or it is necessary for work carried out in the public interest or in the exercise of public authority by the responsible party, cf. 5. tölul. In assessing the authorization for processing, the provisions of other applicable laws must also be taken into account at any given time. In that case, it is best to look at the Child Protection Act no. 80/2002 (bvl.) And the Administrative Procedure Act no. 37/1993 (ssl.) According to the first paragraph. Article 17 bvl. is for anyone whose position and work is involved in the affairs of children, and will be in circumstances as described in Article 16. the same law, obliged to notify the child protection committee. Then in the 2nd paragraph. the same provision imposes a special obligation on teachers in view of their situation and work with children to monitor the behavior, upbringing and circumstances of children as far as possible and notify the child protection committee if it can be assumed that the child's situation is as described in 1. mgr. When the child protection committee receives a notification or receives information in another way that the child's physical or mental health or development may be endangered due to negligence, incompetence or misconduct of the parents, violence or disrespectful behavior by others or his or her own behavior, it shall take a position on without delay, and no later than within seven days of receiving notification or information, whether there is reason to initiate an investigation into the case, cf. Paragraph 1 Article 21 bvl.Í 35. gr. bvl. deals with resources for those who work with children. It states that if a child protection committee receives a suggestion that the conduct of a person who is in contact with children due to his work is severely deficient, the committee shall, if it deems it necessary, initiate an investigation of the case in accordance with the provisions of Article 21. of the Act. The decision on the survey shall be notified to the employee in question and his employer, if applicable. The committee shall notify the results of the survey to the employee and his employer and submit proposals for improvement. In the comments in the explanatory memorandum to the bill to bvl. says, among other things, about Article 35. that the provision applies in particular to school staff and such places where children come together or stay for a longer or shorter period of time. The comments also draw attention to the fact that it may be possible to apply the provision even if it is not known whether or which individual children have been harmed. on the procedure for notification, cf. 4th sentence Paragraph 4 Article 21 bvl. It is also stated in the explanatory documents with bvl. that in the case of a case that is reported to the child protection committee not under the child protection committee, the committee decides not to initiate an investigation and the case is then closed. It is also emphasized that the child protection committee is obliged to drop the case at a later stage as soon as it becomes clear that the committee will not start an investigation of the case and if there is no reason for further intervention. In Article 40 bvl. deals specifically with the duty of child protection committees to provide guidance to parents, children and others. It also states the provision in a memorandum with a bill to bvl. that this is a special duty of guidance of child protection committees and that the guidance provisions of the bill are more specific than what can be found in ssl. where there is a special reason to emphasize the child welfare authorities' duty to provide guidance. Article 7 ssl. states that the government shall provide those who seek it with the necessary assistance and guidance regarding matters concerning its field of work. In the second paragraph. Article 7 gr. ssl. states that if a letter is received by a government authority that does not concern its field of work, the message must be forwarded to the right place as soon as possible. In a memorandum with a bill to ssl. states the provision that a party has presented its complaint orally and the request that the law under another authority should guide the party, as far as possible, on where the right authority is located so that he can present his complaint directly . It is known that the child protection committee [X] received the complainant's notification orally, more specifically by telephone in the autumn […]. The complainant's notification concerned the alleged reprehensible conduct of his colleague at Primary School [Z] towards children in the care of both of them. As the Committee considered that the complainant's complaint did not concern its field of work, it also forwarded it to the School and Leisure Department [Municipality Y] on the basis of the second paragraph. Article 7 ssl. As the complainant's complaint was received orally by the Child Protection Committee by telephone to the Committee in the autumn […], the employees of the Child Protection Committee, according to ssl's duty to provide guidance. and a special duty of guidance of the child welfare authorities, to guide the complainant, i.e. in the light of the premise that his statement did not fall within the remit of the Committee. If the complainant's notification was deficient, he should have received information about it together with information about the procedure for the notification, cf. 4th sentence Paragraph 4 Article 21 bvl. If the Child Protection Committee [X] was not the appropriate authority to receive the notification in question, such as because it did not concern the committee's remit, it should instruct the complainant as to where the appropriate authority was located so that the complainant could make his own statement. provide directly. Article 35 also recommends bvl. does not stipulate that the person who sends a tip according to the provision must specify certain children in order for a case to be investigated. As stated above, it is also stated in the explanatory memorandum that such a claim is not made due to such suggestions. It also states that the authority of the child protection committee extends to investigating the matter and reporting the results of the survey to the employer, who then makes further decisions as he deems the results of the survey warrant. It is not stated that it is part of an investigation according to the above and a notification to the employer to inform who sent the child protection committee a suggestion. In view of the above, the Data Protection Authority does not consider that the processing in question has fulfilled the conditions of point 3 or 5. Article 9 Act no. 90/2018 on personal data protection and the processing of personal data.2.2.About transparency, objective purpose and proportionalityIn addition to the authorization according to the above, the processing of personal data must meet all the basic requirements of the first paragraph. Article 8 Act no. 90/2018, Coll. Article 5 Regulation (EU) 2016/679. Among other things, it stipulates that personal information shall be processed in a lawful, fair and transparent manner towards the data subject (point 1); that they shall be obtained for clearly defined, legitimate and objective purposes and not further processed for other and incompatible purposes (paragraph 2) and that they shall be sufficient, appropriate and not in excess of what is necessary for the purpose of the processing (paragraph 3); Transparency according to the above includes requirements for the data subject to know about the processing and receive information about it. On the part of the Child Protection Committee [X], it is clear that the committee forwarded the complainant's notification to another authority, without instructing the complainant about possible improvements to his notification or informing him of the notification procedure in other respects. It must therefore not be accepted that the conditions of the principle of processing personal data on legitimacy, fairness and transparency have been observed, cf. 1. tölul. Paragraph 1 Article 8 Act no. 90/2018. It will not be seen that the communication of the complainant's personal information to the school and leisure department [municipality Y] was carried out for objective purposes and was rather shared for other and incompatible purposes, cf. 2. tölul. Paragraph 1 Article 8 Act no. 90/2018. The Data Protection Authority also considers that point 3 has not been observed. the same provision that in the processing of personal information care is taken to ensure that it is sufficient, relevant and not in excess of what is necessary for the purpose of the processing.2.3.The following processing of personal information about the complainant at the school and leisure department [municipality Y] As above Article 9, all processing of personal data must meet one of the conditions set out in Article 9. Act no. 90/2018. In point 5. that article states that processing is permitted if it is necessary for work carried out in the public interest or for the exercise of official authority by the responsible party. On behalf of [municipality Y] it has been stated that the following processing of the information received from the child protection committee, i.e. information on the complainant's notification to the committee, had been made for the purpose of further investigating the complainant's allegations against the primary school employee. In light of the fact that the child protection committee [X] provided the complainant's personal information to the school and leisure department [municipality Y] did not comply with Act no. 90/2018, it cannot be seen that the following processing by the school and leisure department [municipality Y] of the complainant's personal information can be considered lawful. [municipality Y] on information about him, has not complied with Act no. 90/2018, on personal data protection and the processing of personal data. 90/2018, on personal data protection and the processing of personal data.
Privacy PolicyLegal DisclaimerAccessibilityService DeskTwitter
