Secretaría General de Instituciones Penitenciarias – Court Ruling (Spain, 2026)

Secretaría General de Instituciones Penitenciarias (the controller) is an organ under the Spanish Ministry of Inner Affairs. The controller is responsible for coordinating and monitoring penitentiary institutions in Spain. In 2019, an employee of a penitentiary center (the data subject) brought a complaint to the DPA. The data subject provided a medical note to justify three days of sick leave, however the controller also demanded them to provide the diagnosis or medical treatment in order to justify the sick leave. The controller later reduced the data subject’s pay in relation to the three days for refusing to provide this information, as it considered that the sick leave was not justified. In 2021, the DPA issued a reprimand for the controller, stating that it had violated the principle of data minimisation (Article 5(1)(c) GDPR). The DPA noted that the controller did not have a legal basis to demand this information under Articles 6(1) and 9 GDPR.See decision number PS/00088/2020, https://www.aepd.es/documento/ps-00088-2020.pdf The DPA also dismissed the internal appeal filed by the controller, on the grounds that it had not provided any new facts or legal arguments.See appeal number RR/00103/2021 (same decision number), https://www.aepd.es/documento/reposicion-ps-00088-2020.pdf The controller appealed the DPA’s decision to the High Court in 2021. According to the controller, the data subject did not inform anyone before taking the sick leave, and did not respond to calls attempting to contact them. The controller argued that demanding additional documentation was justified under suspicions of false illness, as unplanned absences from employees can pose a security risk in the context of managing penitentiary centres. The court stated that the controller did not process personal data, because it had simply requested it from the data subject and not collected it. Therefore, the court upheld the appeal and overturned the decision of the DPA. The DPA appealed the decision to the Supreme Court in 2025. The DPA requested the court to overturn the decision of the lower court, and establish in case law that the definition of “processing” under the GDPR is broad and includes situations in which a party requests data in accordance with CJEU case law.See cases C-175/20 Valsts ieņēmumu dienests (Processing of personal data for tax purposes), link to GDPRhub summary, [https://infocuria.curia.europa.eu/tabs/affair?lang=en&sort=AFF_NUM-DESC&searchTerm=%22C-175%2F20%22&publishedId=C-175%2F20 link to Curia]. C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer, link to GDPRhub summary, [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CA0034 link to judgment]. C-659/22 Ministerstvo zdravotnictví (COVID19 mobile application), link to GDPRhub summary, [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CA0659 link to judgment]. C-548/21 Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CA0548 link to judgment]. The court first clarified that the controller did process personal data, because the definition of processing under Article 4 GDPR is broad. This means that the controller processed personal data when requesting data from the data subject, even if the controller does not receive it. According to the court, the lower court took a literal interpretation of Article 4 GDPR, and concluded that processing of personal data begins when it is collected. The court argued that this literal interpretation does not align with the intention of the legislator or with CJEU case law.See C-175/20, margins 34, 35, 37 and C-659/22, margins 27, 28, 32 Furthermore, the court argued that it is only possible to ensure an effective protection of the fundamental right to privacy and data protection (both under the [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8 CFREU] and [https://www.boe.es/buscar/act.php?id=BOE-A-1978-31229 Article 18 of the Spanish Constitution]) if a controller has the obligation to to comply with the GDPR at the moment of requesting data from a data subject. This includes assessing whether the personal data requested are limited to what is necessary for the purpose(s) for which they are collected. The court then stated that the controller must ensure compliance with the principles under the GDPR (Article 5 GDPR) when requesting the data, including the principle of data minimisation. The court noted that national lawLaw 41/2002, of November 14, 2002, basic law regulating patient autonomy and rights and obligations regarding clinical information and documentation (Ley 41/2002, de 14 de noviembre, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica), https://www.boe.es/buscar/act.php?id=BOE-A-2002-22188 establishes additional protections related to obtaining clinical information and documentation. The court stated that preventing fraud and employee absenteeism are legitimate aims. However, the controller had enough information to achieve these aims with the medical note from the data subject. For short term sick leave, the court considered it unnecessary for the controller to request additional information, especially information that has additional protections under national law. Therefore, the controller processed this data without a legal basis (Article 6(1) GDPR) and in violation of the principle of data minimisation (Article 5(1)(c) GDPR). The court overturned the decision of the lower court, and upheld the decision of the DPA.