Consejería de Economía, Conocimiento y Empleo – Complaint Upheld (Spain, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Spain's data protection authority upheld a complaint against a government department for requiring unnecessary personal data on a form. This matters because it shows that even public institutions must respect privacy rules. Small businesses should learn to only collect data that is absolutely necessary.
What happened
The Spanish DPA found that a government form required unnecessary personal data about gender.
Who was affected
Individuals submitting forms to the Canary Islands’ Department of Economy, Knowledge and Employment.
What the authority found
The DPA ruled that the government department exceeded its legal basis for collecting personal data.
Why this matters
This case reinforces the principle of data minimization, urging all organizations to collect only the information they truly need. It serves as a caution for businesses to review their data collection practices.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
On 31 January 2022, a complaint was filed with the Spanish DPA concerning a government webpage that required certain personal data to submit a form for conciliation of labour disputes to the Canary Islands’ Department of Economy, Knowledge and Employment (controller). In particular, the form included a question concerning sex/gender that obliged a response of man, woman, or nonbinary. The data subject argued that the nonbinary response required disclosure of personal data related to sexual orientation and that such data is beyond the scope of the controller’s legal basis and the form’s purpose. The controller argued that there was no violation of Article 5(1)(c) or 9(1) GDPR and that it was in fact required to collect such information under Spanish law. In particular, Article 26 of Law 12/89 and Article 20(a) of Law 3/2007 obliges public institutions to collect sex/gender information in all administrative forms for statistical purposes. The DPA found that the controller exceeded its legal basis for processing under Article 6(1)(c) GDPR, violated the data minimisation principle under Article 5(1)(c) GDPR, and improperly processed a special category of information under Article 9(1) GDPR. First, in finding a violation of Article 6(1)(c) GDPR, the DPA determined that the controller exceeded their legal basis for processing under Spanish legal requirements. A number of Spanish laws including [https://www.boe.es/buscar/act.php?id=BOE-A-2007-6115 Article 20 of Law 3/2007] and [https://www.boe.es/buscar/doc.php?id=BOE-A-1989-10767 Article 26 of Law 12/1989] require public institutions to collect data about the applicant’s sex/gender for statistical purposes and monitoring of gender equality. [https://www.boe.es/buscar/doc.php?id=BOE-A-1989-10767 Article 26 of Law 12/1989] specifies ‘woman’ and ‘man’ as the responses to inquiries about sex. On the other hand, the DPA noted that no Spanish laws obliging sex/gender to be documented require the nonbinary response to be in
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Consejería de Economía, Conocimiento y Empleo in ES
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Consejería de Economía, Conocimiento y Empleo - Spain (2024). Retrieved from cookiefines.eu
Last updated: