The drawing, by the Municipal Plenary Sessions, of the people who will form the electoral tables and the subsequent publication of the Acts with the results, must be carried out respecting the legal dispositions regulating the electoral, local, legal regime and also the relative ones. to the protection of personal data.
In practice, complying with the provisions of these regulations may give rise to doubts as to adequacy or proportionality for the purpose pursued.
Well, the Catalan Data Protection Authority (APDCAT) has recently ruled on this issue in the Opinion CNS 40/2020, of 30 November. The most relevant features of this Opinion are the following:
- The draw to appoint the members of the electoral board is a public act, of which the Minutes of the Municipal Plenary Session must be issued and published on the body's website by legal requirement.
- It is a lawful processing of personal data, although the principles of the RGPD must be observed.
- The identification of people must be based on the name, surname and four random numeric digits of the DNI (or equivalent document), in application of the minimization principle.
- When the draw has taken place and the legislature has elapsed, the purpose of the data processing expires, in application of the limitation of the retention period.
This Opinion of the APDCAT supposes a novelty with regard to the criterion of the AEPD fixed to theReport 0219/2016, which in turn is based on an Agreement of the Central Electoral Board.
In any case, in the case of entities that use the AOC's Open Government service, it must be borne in mind that the Minutes of the Plenary Session are published on the respective Transparency Portals when they are sent to the General Directorate of Local Administration.
The APDCAT indicates that the entities that use this service must communicate to the AOC (in charge of the processing), the actions to be carried out in relation to the protection of those for the protection of personal data. For more information on this issue, see the FAQ What if I detect a full record with personal data?
