Ajuntament de Tiana – Complaint Upheld (Spain, 2021)

A data subject filed a complaint with the Catalan DPA (APDCAT) reporting that a City Council had created a WhastApp group without gathering the explicit consent of the participants and without providing the information required by the GDPR; although two days later, a privacy policy was included in the description of the group. The claimant alleged that the telephone number, name and images of the participants were visible to all of them. The data subject had joined the group via a link that was shared through WhatsApp with a text that indicated that people would receive information related to the city council and that anyone could access the group through the following link if they wanted to join. The APDCAT verified that, when joining the group, the participants were offered information about the identity of the controller, the legal basis fro the processing, the data retention period, the possibility of exercising the data subject's rights, and a link to the city council's web, where one could exercise their rights or contact the DPO (although not about the possibility of filing a complaint with the APDCAT). This information was also included on the description of the group and on the information of the group. On the information of the group, the names, phone numbers and profile pictures of the participants could also be seen. The city council claimed that they were using as a legal basis Article 6(1)(e) GDPR, i.e. processing is necessary for the performance of a task carried out in the public interest, since [https://www.boe.es/buscar/act.php?id=BOE-A-1985-5392 Article 25 of the Law regulating the Bases of the Local Administration Regime (Ley reguladora de las Bases del Régimen Local - LBRL)], that allows city council to engage in institutional communication with their citizens. According to the city council, participants were informed that participants in the group could see names, phone numbers and profile pictures of other participants. However, the city coun