Consejería de Economía, Conocimiento y Empleo – Complaint Upheld (Spain, 2024)

On 31 January 2022, a complaint was filed with the Spanish DPA concerning a government webpage that required certain personal data to submit a form for conciliation of labour disputes to the Canary Islands’ Department of Economy, Knowledge and Employment (controller). In particular, the form included a question concerning sex/gender that obliged a response of man, woman, or nonbinary. The data subject argued that the nonbinary response required disclosure of personal data related to sexual orientation and that such data is beyond the scope of the controller’s legal basis and the form’s purpose. The controller argued that there was no violation of Article 5(1)(c) or 9(1) GDPR and that it was in fact required to collect such information under Spanish law. In particular, Article 26 of Law 12/89 and Article 20(a) of Law 3/2007 obliges public institutions to collect sex/gender information in all administrative forms for statistical purposes. The DPA found that the controller exceeded its legal basis for processing under Article 6(1)(c) GDPR, violated the data minimisation principle under Article 5(1)(c) GDPR, and improperly processed a special category of information under Article 9(1) GDPR. First, in finding a violation of Article 6(1)(c) GDPR, the DPA determined that the controller exceeded their legal basis for processing under Spanish legal requirements. A number of Spanish laws including [https://www.boe.es/buscar/act.php?id=BOE-A-2007-6115 Article 20 of Law 3/2007] and [https://www.boe.es/buscar/doc.php?id=BOE-A-1989-10767 Article 26 of Law 12/1989] require public institutions to collect data about the applicant’s sex/gender for statistical purposes and monitoring of gender equality. [https://www.boe.es/buscar/doc.php?id=BOE-A-1989-10767 Article 26 of Law 12/1989] specifies ‘woman’ and ‘man’ as the responses to inquiries about sex. On the other hand, the DPA noted that no Spanish laws obliging sex/gender to be documented require the nonbinary response to be in