DPA case PD 6/2021 – Violation Found (Spain, 2021)

The Catalan DPA issued an opinion at the request of the Ministry of the Interior in order to evaluate the Law proposal that will transpose the Directive (EU) 2019/1153, laying down rules facilitating the use of financial and other information for the prevention, detection, investigation or prosecution of certain criminal offences. In the about general issues, the DPA pointed out that the law proposal does not clearly state which personal data of the financial ownership file will be accessible for the competent authorities as well as which data will be excluded, and that some necessary definitions are missing. In the next sections, it is pointed out that Article 7(1) does not concur with the principle of data minimization, so a new redaction is proposed. It is also mentioned that a remark regarding that the sharing of information shall be carried out with the implementation of the necessary technical and organizational measures to guarantee the security of the data needs to be added for every article. With regards to the data protection section, the DPA laid down an amendment changing the sentence “when necessary” for “when indispensable”, in order to strengthen the exceptionality for the processing of special categories of personal data. Another amendment remarking the individualization and the technical training of the people who will process the data is lastly suggested.