Search results

the processing of personal data? BUT C.6 Is defined and implemented training and training available on data protection and data protection privacy for all

(EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD) and Organic Law 3/2018, of December 5, on Data Protection Personal and guarantee of digital

the arts. 47, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), the Director

an access request related to same personal data? The Spanish DPA held that even though the personal data of the data subject were the same for the City

the Spanish Data Protection Agency. Likewise, article 63.2 of the LOPDGDD determines that: “The procedures processed by the Spanish Agency for Data Protection

the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: On May 5, 2022, the Director of the Spanish Agency for Data Protection

arts. 47 and 48.1 of Organic Law 3/2018, of 5/12, on Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD), the Director of

48.1, 64.2 and 68.1 of the Organic Law 3/2018, of December 5, on Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is

prohibited by article 21.1 of the LSSI (Spanish Law on Information Society Services and Electronic Commerce, which transposes into Spanish law the Directive 2000/31/EC

initiated when Organic Law 15/1999, on the Protection of Personal Data (LOPD) was in force. In this sense, it must be indicated, on the one hand, that the

by the Spanish Agency for Data Protection and based on the following FACTS FIRST: On May 18, 2020, the Director of the Spanish Agency for Data Protection

confidentiality, availability and resilience of data personal Communications and recipients of personal data. All personal data derived from the provision of the service

adaptation of Spanish Law to theEuropean regulations on data protection - regulation in force since07/31/2018 until its repeal by Organic Law 3/2018, of December

automated personal data processing activity; and (iii) the commercial interests of a data controller must yield to the legitimate data protection interests

the arts. 47, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), the Director

services. On the back of the first page there is a section entitled “Basic information on Data Protection ”: which contains the following: " Personal data will

by the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: On 02/04/2019 the Director of the Spanish Agency for Data Protection

new conditions regarding the protection of personal data, specifically that regarding the transfer of their personal data to all the companies of the CaixaBank

of the personal data. The data subject requested the access and the erasure of their personal data from the list of insolvent persons. The data was initially

48.1, 64.2 and 68.1 of the Organic Law 3/2018, of December 5, on Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is

of the Spanish Protection Agency of data. Likewise, article 63.2 of the LOPDGDD determines that: "The Procedures processed by the Spanish Data Protection

47, 48.1, 64.2 and 68.1 of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is

47, 48.1, 64.2 and 68.1 of the LOPDGDD, The Director of the Agency is competent to initiate and resolve this procedure. Spanish Data Protection. Likewise

control and as established in articles 47, 64.2 and 68.1 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate this procedure

articles 47, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on Data Protection Personal and digital rights guarantee (hereinafter LOPDGDD), the Director

48.1, 64.2 and 68.1 of the Organic Law 3/2018, of December 5, on Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is

47 and 48.1 of the Law Organic 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is competent

Article 10 of Organic Law 3/2018, of December 5, on Data Protection Personal and guarantee of digital rights (hereinafter, LOPDGDD): data processing of a criminal

of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) and Law 34/2002, of July 11, Information Society Services and

the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: On June 7, 2021, the Director of the Spanish Agency for Data Protection

and 9.” The Organic Law 3/2018, on the Protection of Personal Data and Guarantee of the Digital Rights (LOPDGDD) in its article 72.1.b) qualifies this infraction

the LOPDGDD, the Director of The Spanish Data Protection Agency is competent to resolve this process. II Article 85 of Law 39/2015, of October 1, on the

legislation (article 64.3 of Organic Law 3/2018, of December 5, on Data Protection Personal Rights and Guarantee of Digital Rights -LOPDGDD), dated 06/11/2020

the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: On May 3, 2022, the Director of the Spanish Agency for Data Protection

the LOPDGDD, the Director of The Spanish Data Protection Agency is competent to resolve this process. II Article 85 of Law 39/2015, of October 1, on the

Organic Law 3/2018, of 5 December, of Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), the Director of the Spanish Agency

article 65.4 of Organic Law 3/2018, of 5 December, Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), said claim was transmitted

processing of personal data. A voice is a personal attribute unique to each person and thus falls under the definition of personal data in Article 4(1)GDPR. Furthermore

the LOPDGDD, the Director of The Spanish Data Protection Agency is competent to resolve this process. II Article 85 of Law 39/2015, of October 1, on the

article 65.4 of Organic Law 3/2018, of 5 December, Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), said claim was transferred

the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: On June 24, 2021, the Director of the Spanish Agency for Data Protection

48.1, 64.2 and 68.1 of the Organic Law 3/2018, of December 5, on Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is

the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: On July 27, 2021, the Director of the Spanish Agency for Data Protection

Processing of Personal Data and the Free Circulation of these Data (RGPD) and Organic Law 3/2018, of December 5, on Data Protection Personal and Guarantee

before the Catalan Data Protection Authority and on 10/26/2022 the Said Authority notified the Spanish Agency for Data Protection on 10/26/2022 for being

the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: On July 9, 2021, the Director of the Spanish Agency for Data Protection

complaint of the data subject. The DPA considered that it was allowed to continue the investigation on its own since Article 64.2 LOPDGDD (Spanish Data Protection

and 68.1 of the Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of the digital rights (hereinafter, LOPDGDD), is competent

articles 47, 64.2 and 68.1 of the Organic Law 3/2018, of December 5, Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), for the violation

December 5, Protection of Personal Data and guarantee of rights digital (hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection is competent

violating the Spanish data protection law (Art.22 LOPDGDD) in force. The data subject therefore filed a complaint with the Spanish DPA. The Spanish DPA recalled

the Spanish Agency for Data Protection offers through its website [https://www.aepd.es] access to the legislation on the protection of personal data, including

regulations of Data Protection. No response to these letters has been received. THIRD: On 08/23/2021 the Director of the Spanish Protection Agency Data agreed

arts. 47, 64.2 and 68.1 of Organic Law 3/2018, of December 5, Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), Sections 1) and 2),

Organic Law 3/2018, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD), the director of the Spanish Data Protection Agency

48.1, 64.2 and 68.1 of the Organic Law 3/2018, of December 5, on Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is

December 5, on Data Protection Personal and guarantee of digital rights (hereinafter LOPDGDD), indicates what: "1. In accordance with the provisions of

47, 48.1, 64.2 and 68.1 of the LOPDGDD, The Director of the Agency is competent to initiate and resolve this procedure. Spanish Data Protection. Likewise

arts. 47, 64.2 and 68.1 of the Law Organic 3/2018, of December 5, Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), Sections 1) and 2)

arts. 47, 64.2 and 68.1 of the Law Organic 3/2018, of December 5, Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), Sections 1) and 2)

the LOPDGDD, the Director of the Agency Spanish Data Protection is competent to resolve this procedure. II The RGPD defines data processing in article 4.2

and 48 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and to solve this procedure. II Organic Law 3/2018, of

47, 48.1, 64.2 and 68.1 of the Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is

forth in the data protection regulations, in accordance with the Article 65.4 of Organic Law 3/2018, of December 5, on Data Protection Personal and guarantee

articles 47, 48.1, 64.2 and 68.1 of LOPDGDD, it is competent to initiate and resolve this procedure the Director of the Agency Spanish Data Protection. Likewise

the Spanish Data Protection Agency. Likewise, article 63.2 of the LOPDGDD determines that: “The procedures processed by the Spanish Data Protection Agency

processed the personal data of the data subject and/or third parties in violation of the content of art. 5 (1) GDPR, which provides that personal data shall be

the Spanish Data Protection Agency. Likewise, article 63.2 of the LOPDGDD determines that: "The procedures processed by the Spanish Data Protection Agency

established in articles 47, 48.1, 64.2 and 68.1 of the Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights

5,6,7 and 9. " Organic Law 3/2018, on Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) in its article 72.1.b) qualifies this infringement

and 48.1 of the Organic Law 3/2018, of December 5, on Protection of Personal Data and guarantee of rights. digital rights (hereinafter, LOPDGDD), is competent

regarding the processing of personal data, a copy of all documents is requested employees to report on the protection of personal data other than the privacy

for Data Protection, directed against the claimed. The The reason is the publication on the website *** URL.1, of personal data of the complainant without

established in articles 47, 48.1, 64.2 and 68.1 and 68.2 of Organic Law 3/2018, of December 5, on Data Protection Personal and guarantee of digital rights

article 65.4 of Organic Law 3/2018, of 5 December, of Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), said claim was transferred

of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and against the Law 34/2002, of July 11, on Information Society

of the Spanish Data Protection Agency. Likewise, article 63.2 of the LOPDGDD determines that: "Procedures processed by the Spanish Data Protection Agency

article 65.4 of Organic Law 3/2018, of 5 December, of Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), said claim was transferred

the art. 47, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), the Director

articles 47 and 48.1 of Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of rights (hereinafter, LOPDGDD), is competent to initiate

article 65.4 of Organic Law 3/2018, of 5 December, of Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), said claim was transferred

with articles 5,6,7 and 9. " Organic Law 3/2018, on Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) in its article 72, under the heading

47, 48.1, 64.2 and 68.1 of the Organic Law 3/2018, of December 5, Protection of Personal Data and Guarantee of Digital Rights (hereinafter, LOPDGDD), is

47, 48.1, 64.2 and 68.1 of the Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is

18/99 FIRST: First notification of personal data breach 1.-Notifications of personal data breach made by I-DE: A) On March 18, 2022, the Innovation Division

(General Data Protection Regulation, hereinafter RGPD), grants each control authority and as established in articles 47, 48.1, 64.2 and 68.1 of the Organic

with articles 5,6,7 and 9. " Organic Law 3/2018, on Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) in its article 72, under the heading

article 65.4 of Organic Law 3/2018, of 5 December, of Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), said claim was transferred

48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on Data Protection Personal Rights and Guarantee of Digital Rights (hereinafter, LOPDGDD), the

LISTS OF TYPES OF DATA PROCESSING THAT REQUIRES EVALUATION OF IMPACT RELATING TO DATA PROTECTION of the Agency Spanish Data Protection, implies an obligation

article 66 of the LOPDGDD: "1. Except in the cases referred to in article 64.3 of this organic law, the Spanish Agency for Data Protection must, prior to

the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: D.A.A.A. (hereinafter, the claiming party), dated ***DATE.1, filed

specially protected personal data, in accordance with article 9.1 of the RGPD, where the following is indicated: “The processing of personal data that reveals

transactions associated with their products ”and is broken down into points 1.1.1, 1.1.2 and 1.1.3. In all of them appears as option "No". SECOND: In view of the

and 48.1 of LOPDGDD. II Defines article 4.2 of the RGPD: "treatment": any operation or set of operations made on personal data or personal data sets, either

47, 48.1, 64.2 and 68.1 of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), the

47 and 48.1 of the Law Organic 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is competent

arts. 47, 64.2 and 68.1 of the Law Organic 3/2018, of December 5, Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). Sections 1) and 2)

assisting the data processor to ensure compliance with its obligations in the protection of personal data, and the deletion of personal data after the processor’s

by the Spanish Data Protection Agency and based to the following BACKGROUND FIRST: On December 29, 2023, the Director of the Spanish Agency of Data Protection

by the Spanish Data Protection Agency and based to the following BACKGROUND FIRST: On December 29, 2023, the Director of the Spanish Agency of Data Protection

Organic Law 3/2018, of December 5, on Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is competent to initiate and resolve

and h) of this Law (…). and what is established in the articles 47, 48.1, 64.2 and 68.1 of the LOPDGDD, While article 63.2 of the LOPDGDD determines that:

contains the section on basic information on Data Protection and the link to additional information and detailed information on Data Protection, as well as a

article 31 of Law 40/2015, of October 1, on the Regime Law of the Public Sector and in article 57 of the Law of Law 39/2015, of October 1, of the Common

which introduces Organic Law 3/2018, of 5/12, on the Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD) and that “article 22

article 72.1.e) of the LOPDGDD. “ "For the purposes specified in the art. 64.2 b) of Law 39/2015, of 1/10, on Procedure Common Administrative Law of Public

65.4 of the Organic Law 3/2018, of 5/12, on the Protection of Personal Data and guarantee of digital rights (in hereinafter, LOPDGDD), which consists of

of the Spanish Data Protection Agency. Likewise, article 63.2 of the LOPDGDD determines that: “The procedures Data processed by the Spanish Data Protection

public safety, defense, security national law and criminal law, and public authorities' access to data personal data, as well as the application of said legislation

Processing of Personal Data and the Free Circulation of these Data (GDPR), Organic Law 3/2018, of December 5, on Data Protection Personal and Digital Rights

defendant on March 30, 2021, in accordance with the provisions in article 65.4 of the Organic Law 3/2018, of December 5, on Data Protection Personal and guarantee

the Spanish Data Protection Agency. Likewise, article 63.2 of the LOPDGDD determines that: “The procedures processed by the Spanish Data Protection Agency

Agency for Data Protection and based on to the following BACKGROUND Of the actions carried out by the Spanish Data Protection Agency before the entity, BANKIA

48.1, 64.2 and 68.1 of the Organic Law 3/2018, of December 5, on Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is

of the Spanish Data Protection Agency. Likewise, article 63.2 of the LOPDGDD determines that: "Procedures processed by the Spanish Data Protection Agency

collection, storage, use, disclosure of data) provided for by law limits the right to the protection of personal data, irrespective of whether such a limitation

THIRD: On September 9, 2021, in accordance with the then current article 64.3 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and

3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, (LOPDGDD), and based on: FACTS FIRST: On 04/16/20, three writs of

65 (4) of Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), GLOVOAPP was informed

FOURTH: On February 1, 2019, the Spanish Data Protection Agency gave transfer of the complaints described in the previous points to Data Protection Commission

by the Spanish Agency for Data Protection and based on the following: BACKGROUND FIRST: On July 6, 2020, the Director of the Spanish Agency of Data Protection

article 73.t) of the LOPDGDD” "For the purposes specified in the art. 64.2 b) of Law 39/2015, of 1/10, on Procedure Common Administrative Law of Public Administrations

the Organic Law 3/2018, of December 5, on the protection of personal data and guarantee of the rights chos digital, ("LOPDGDD"). THIRD: On 10/09/19, the

failed to conduct data protection impact assessments for the fingerprint data, which is a special category of data under Article 9(1) GDPR. In addition

system etc. Article 9.1 of the RGPD indicates: "Treatment of special categories of personal data" 1. The processing of personal data that reveals ethnic

contained in points 26.1 and 26.4. "26.1 Processing of personal data in order to manage Commercial Relations. The personal data of the Holder, both those

aforementioned GDPR and 72.1.m) of the LOPDGDD.” "For the purposes specified in the art. 64.2 b) of Law 39/2015, of 1/10, on Procedure Common Administrative