Personal Data
Disclosure
A recent case involved an administrative remedy pursued by the legal representative of Bilbao-Vizcaya Bank against a resolution of the Data Protection Agency whereby the bank was ordered to pay a sanction of Pta1 million. This process was decided in the light of the Spanish Act 5/1992 on the Protection of Personal Data, which was derogated in January 2000. The processing of personal data is now regulated by Act 15/1999.
The bank disclosed the banking account to a third party, who knew the data subject as well as the amount of money deposited in the account.
The court's decision analyzes the concepts of personal data and disclosure.
Personal Data
According to the court 'personal data' is defined as "any information concerning an identified or identifiable person". The most important issue of the decision refers to the scope of the act. The court states that the act preserves the secrecy of all data that, if connected with other relevant data, can offer a personal description of the subject.
In this case the disclosed data was a banking account number. The court considered it to be personal data since once this was connected with other data about the subject (eg, the number and the name of the holder and the number of the account), anyone could derive a description of the personality and economic profile of the holder of the account.
The court stated that any revelation of information concerning the data subject is to be understood as disclosure. In other words, there is no strict concept of disclosure, nor gradation of 'disclosures'. Any information revealed to a person other than the data subject is considered as disclosure under the act.
For further information on this topic please contact Gonzalo de Ulloa or Jose Carlos Erdozain at Gomez-Acebo & Pombo by telephone (+34 91 582 9100) or by fax (+34 91 582 92 82) or by e-mail ([email protected] or [email protected]).
The materials contained on this web site are for general information purposes only and are subject to the disclaimer