- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case IAI 50/2022 – Violation Found (Spain, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Catalan Data Protection Authority found that a regional administration did not fully comply with a request for information about gender transition cases. This matters because it shows the importance of having a legal basis for processing personal data. Organizations must ensure they follow the rules when handling sensitive information.
What happened
The regional administration partially fulfilled a request for information about gender transition cases but did not provide all requested details.
Who was affected
An applicant who requested information about gender transition cases from the regional administration.
What the authority found
The Catalan authority ruled that the administration did not have a valid legal basis for how it processed the requested personal data.
Why this matters
This case underscores the need for organizations to have clear legal grounds for processing personal data. It serves as a reminder for public bodies to improve their data handling practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 13 October 2022, the applicant filed an access to information request to the regional administration of Catalonia (the controller), asking for the number of gender transition cases in Catalonia from 2012 to 2021. More specifically, the applicant requested for each gender transition patient (the data subject) the sex, age, and year of care in the traffic unit. The controller partially approved the request and provided the sex and year of treatment of the data subjects. The controller did not provide the age of each data subjects but grouped the patients by age range. Example:Year: 2018 Sex of patient: female/male/unrecorded Age range: AgeThe controller held that because of the very small number of patients treated by the gender transition units within Catalonia, the data should only be disclosed by age range and not year by year. On 17 November 2022, the applicant filed an appeal by the Commission for the Guarantee of the Right of Access to Public Information (Comissió de Garantia del Dret d’Accés a la Informació Pública - GAIP). The GAIP requested the Catalan DPA (Autoritat Catalana de Protecció de Dades - APDCAT) to issue a legal opinion on the lawfulness of the processing of such data. First, the APDCAT recalled that the treatment of personal data such as the one requested by the applicant required a legal basis, Article 6 GDPR. The APDCAT then assessed whether the controller had a legal obligation to proceed to such treatment, Article 6(1)(c) GDPR. At the same time, Article 86 GDPR states that the right to access information is regulated by national law. [https://www.boe.es/buscar/pdf/2015/BOE-A-2015-470-consolidado.pdf Article 18 of Llei 19/2014, de 29 de desembre de 2014, de transparència, accés a la informació i bon govern] (Law 19/2014 of 29 December 2014 on transparency, access to information and good governance - LTC) provides a right for individuals or legal entities to access public information. According to [https://www.boe.es/buscar/pdf/2015/BOE-A-
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case IAI 50/2022 in ES
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case IAI 50/2022 - Spain (2023). Retrieved from cookiefines.eu
Last updated: