UNIVERSIDAD MIGUEL HERNÁNDEZ DE ELCHE(UMH) – Dismissed (Spain, 2021)

Dismissed
Agencia Española de Protección de Datos8 February 2021Spain
final
Dismissed

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

The Spanish Data Protection Authority dismissed a complaint against Universidad Miguel Hernández de Elche. A former student claimed the university didn't provide enough information about their data, but the authority found the request was made in bad faith. This decision highlights the importance of making genuine requests for information.

What happened

A complaint was filed against Universidad Miguel Hernández de Elche for not providing sufficient data to a former student.

Who was affected

The complaint was made by a former student who had multiple roles at the university.

What the authority found

The authority ruled that the former student was abusively exercising their rights, violating the principle of good faith.

Why this matters

This case shows that authorities can dismiss complaints if they believe the request is made in bad faith. It reminds users to ensure their requests are genuine and reasonable.

GDPR Articles Cited
Automatically processed
Art. 12(5) GDPR
View original scraped data
Art. 12(5) GDPR
Art. 13(GDPR)
Art. 15(GDPR)

Original imported citations before automated processing; the processing history does not establish independent verification.

National Law Articles
AI-identified
Art. 7 Spanish Civil Code
Art. 247 Spanish Procedural Civil Act

Source checks

Secondary-source text retrieved.

Automated check recorded — 18 October 2026.

Processing notes: articles corrected, national law identified.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

A data subject filed a complaint with the Spanish DPA (AEPD) against a university where they had had different roles, ("an employee, an employee with disciplinary proceedings, undergraduate student, master's student, course assistant, interested party in administrative procedures, participant in administrative procedures, participant in selection processes, litigant, opposing party, etc."). The university provided the data subject with certain information (partly non-personal data too) and asked them to specify what additional information they required. They rejected the rest of the generic request with grounds on Article 12(5). The university alleged that they had tried to answer to the request on time but that they didn't have the resources, given that they have 26000 students, 1122 teaching and research staff, 521 administrative staff, 269 project staff; with a teaching structure of 7 faculties, 2 schools, 4 research institutes, 27 departments, 33 services and administrative Units, and 4 management centres, and the data subject had had a role in many of them, as an alumni, worker, and litigant. The controller also held that they were implementing a more efficient system to handle data subject request. They claim that the data subject is just trying to diminish the university's functioning via different requests, claims and lawsuits, also in law fields other than data protection. The data subject reiterated the initial request in the same terms. To this, the controller again alleged Article 12(5) GDPR and stated that it constituted an abuse of rights. The AEPD aligned with the controller and found that the data subject was abusively exercising their rights in bad faith. The AEPD brought forward Article 12(5) GDPR, as well as Article 7 of the [https://www.boe.es/buscar/act.php?id=BOE-A-1889-4763 Spanish Civil Code], that states that rights must be exercised in good faith, and that it cannot be done in a way that the natural limits of the right are respect

Outcome

Dismissed

The complaint or investigation was dismissed.

Related Enforcement Actions (0)

No other enforcement actions found for UNIVERSIDAD MIGUEL HERNÁNDEZ DE ELCHE(UMH) in ES

This is the only recorded action for this entity in this jurisdiction.

Details

Decision Date

8 February 2021

Authority

Agencia Española de Protección de Datos

GDPRhub ID

gdprhub-3392

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. UNIVERSIDAD MIGUEL HERNÁNDEZ DE ELCHE(UMH) - Spain (2021). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: