APDCAT advises Catalan draft law transposing EU 2019/1153 lacks data minimization and
Status Not cited by any decision here yet
Original title: APDCAT (Catalonia) - PD 6/2021
Holding
In the about general issues, the DPA pointed out that the law proposal does not clearly state which personal data of the financial ownership file will be accessible for the competent authorities as well as which data will be excluded, and that some necessary definitions are missing. In the next sections, it is pointed out that Article 7(1) does not concur with the principle of data minimization, so a new redaction is proposed. It is also mentioned that a remark regarding that the sharing of information shall be carried out with the implementation of the necessary technical and organizational measures to guarantee the security of the data needs to be added for every article. With regards to the data protection section, the DPA laid down an amendment changing the sentence “when necessary” for “when indispensable”, in order to strengthen the exceptionality for the processing of special categories of personal data. Another amendment remarking the individualization and the technical training of the people who will process the data is lastly suggested.
From GDPRhub’s case note — a summary of the decision, not its own words. Read it in the text ↓
Case note 3 findings
Case note by GDPRhub — an account of the decision, not the decision itself. Read the decision
Facts — The Catalan DPA issued an opinion at the request of the Ministry of the Interior in order to evaluate the Law proposal that will transpose the Directive (EU) 2019/1153, laying down rules facilitating the use of financial and other information for the prevention, detection, investigation or prosecution of certain criminal offences. Holding — In the about general issues, the DPA pointed out that the law proposal does not clearly state which personal data of the financial ownership file will be accessible for the competent authorities as well as which data will be excluded, and that some necessary definitions are missing. In the next sections, it is pointed out that Article 7(1) does not concur with the principle of data minimization, so a new redaction is proposed. It is also mentioned that a remark regarding that the sharing of information shall be carried out with the implementation of the necessary technical and organizational measures to guarantee the security of the data needs to be added for every article.
With regards to the data protection section, the DPA laid down an amendment changing the sentence “when necessary” for “when indispensable”, in order to strengthen the exceptionality for the processing of special categories of personal data. Another amendment remarking the individualization and the technical training of the people who will process the data is lastly suggested. Holding — In the about general issues, the DPA pointed out that the law proposal does not clearly state which personal data of the financial ownership file will be accessible for the competent authorities as well as which data will be excluded, and that some necessary definitions are missing. In the next sections, it is pointed out that Article 7(1) does not concur with the principle of data minimization, so a new redaction is proposed. It is also mentioned that a remark regarding that the sharing of information shall be carried out with the implementation of the necessary technical and organizational measures to guarantee the security of the data needs to be added for every article.
With regards to the data protection section, the DPA laid down an amendment changing the sentence “when necessary” for “when indispensable”, in order to strengthen the exceptionality for the processing of special categories of personal data. Another amendment remarking the individualization and the technical training of the people who will process the data is lastly suggested. Comment — Share your comments here!