Ayuntamiento de Mejorada del Campo – Complaint Upheld (Spain, 2020)

The complainant filed a complaint before the Spanish DPA because the municipal council in question, "Ayuntamineto de Mejorada del Campo" does not have a data protection officer. Ayuntamiento de Mejorada del Campo did not contest the facts. Does the absence of a data protection officer in a municipal council implicate a violation of Article 37(1)(a) GDPR? The Spanish DPA (AEPD) held that public authorities such as the municipal council in question often act as data controllers. They must therefore abide by the principle of accountability and have other obligations under the GDPR. The Spanish DPA held that one of those obligations consists in naming a data protection officer (DPO) and to notify the Spanish DPA of his existence. This is an obligation imposed on public authorities under Article 37(1) GDPR. This obligation is also within Article 34(1) and (3) of the Spanish data protection law (LOPDGDD). The Spanish DPA therefore imposed a warning sanction on Ayuntamiento de Mejorada del Campo for a violation of Article 37(1) GDPR and asked the council to designate a DPO within a month.