DPA case RPS-2023/007 – Complaint Upheld (Spain, 2023)

On 23 December 2020, a data subject filed a complaint with the Andalusian DPA (CTPD) against a Department of Education and Educational Development (the controller). The data subject claimed that since the 2020/2021 school year, all meetings of the educational department were audio recorded. The controller relied on [https://www.boe.es/buscar/act.php?id=BOE-A-2015-10566 Article 18 of Law 40/2015], which calls for minutes to be drawn up for each meeting of the education department, as a legal basis for the audio recordings. It stated that the processing of data was aimed at this law’s instructions, with the purpose of convening the sessions and consulting the matters in the agenda. The controller also claimed that since the beginning of the 2020/2021 school year, a decision by the Head of the Department that was endorsed by all members except the data subject had subjected each meeting to audio recording. Notably, this was done without modifying the Rules of Organization and Operation of the Center Plan until 2 February 2021. The CTPD’s investigation revealed that up until the date of this modification in February 2021, there was no regulation of the recordings of the sessions. The controller affirmed that it had informed those attending the telematics session that the same and subsequent meetings would be recorded, the identity and contact information of the controller and the purpose of the processing. However, the controller did not verify that it had informed the members of the Department that the sessions would be recorded or of other Article 13 GDPR requirements. On 19 July 2022, the CTPD initiated sanctioning proceedings against the controller for violations of Articles 6 and 13 GDPR. The CTPD noted that though [https://www.boe.es/buscar/act.php?id=BOE-A-2015-10566 Article 18 of Law 40/2015] establishes the obligation to draw up minutes of each session held by a collegiate body, it does not require the recording of such sessions by simply stating that “the