Purpose of treatment: Beware!

The purpose of the processing refers to the reasons for processing personal data. It is the purpose or objective that leads us to use personal data.

And this concept is very relevant in the data protection regulations, since the purpose must be informed to the owner of the data (data subject), because processing data for a purpose other than the one informed and without the consent of the data subjects, is likely to become a sanction for your business. (data subject), because processing data for a purpose other than the one informed and without the consent of the data subjects, is likely to become a sanction for your business.

Remember that if your business wants to process personal data, it will act as Data Controller, which is who decides what will be the purpose of the processing of personal data and therefore must comply with the RGPD and the LOPD-GDD, ultimately with the European and Spanish data protection regulations.

General aspects of the purpose of the processing

One of the principles governing any activity related to the processing of personal data is precisely the “purpose limitation”, which, as stated in art. 5.1. b) GDPR, personal data must be collected for a clear, legitimate and specific purpose or purpose, and not be used in a way that contradicts that purpose or purpose.

This does not mean that there cannot be different purposes for the same data processing, but if that is the case, we must inform the data subject and obtain his/her consent.

Therefore, the data subject must be informed of each purpose and consent must be obtained for each of them, according to art. 6.2 LOPD-GDD.

Thus, every Data Controller must create and update its Register of Processing Activities(RAT), where, one by one, the activities and the data processing involved in each of them will be identified, identifying, among other things, the purpose of the processing, as determined in art. 30.1 b) RGPD and 31.1 of the LOPD-GDD.

Actual case of sanction for non-compliance with the purpose of processing

To illustrate in an effective way what was said in previous paragraphs, we share here the content of a judgment issued by the Supreme Court of Castilla y León, which analyzed the dismissal of a female worker as a result of the delivery of her employment history for a selection process in her company.

The company compared the information contained in the employment history report with the CV that the employee submitted at the beginning of her employment relationship, 2 years earlier, and found some discrepancies between both documents, which led to the decision to dismiss the employee, alleging a serious breach of contractual good faith.

In the study of the case, the TSJ considered that the dismissal should be declared unfair because the employee had submitted her work life for the sole purpose of opting for an internal selection process for a position of indefinite duration, and not for the purposes of investigation and disciplinary regime.

The Court determined that this misuse by the company of the personal data provided by the employee for a different purpose, thereby justifying her disciplinary dismissal, constitutes the unlawfulness of the processing and violates the fundamental right to data protection provided for in Article 18.4 of the Spanish Constitution.

In this case, it should also be noted that the company had in its possession the report of the employee’s working life for 3 months from its delivery until the dismissal of the employee, thus exceeding the period (60 days since the company had knowledge of its commission) established in art. 60.2. ET The internal problems of the HR department (the incumbent was on maternity leave and was replaced by another worker) do not justify the delay in the review of the plaintiff’s file (…) nor do they affect the statute of limitations.

In the ruling of the sentence, it is obliged to reinstate the worker or to pay her compensation, not only for damages suffered due to labor issues, but also the amount of 3,000 euros as compensation for moral damages associated with the violation of fundamental rights.

In view of the above, it is important to have well defined the purposes of the processing and to be clear about the limits for the processing of personal data, because we may fall into situations of unlawful processing, thinking that we are acting within the regulatory framework.

Business Adapter® at your service

If you need to determine the purpose of your personal data processing and what are its limits, contact us by email: info@businessadapter.es, you can also call 96 131 88 04, or leave your message in this form:

[su_button url=”https://businessadapter.es/contacto” target=”blank” background=”#f6f903″ color=”#181818″ size=”7″ center=”yes” icon_color=”#000000″]Contact us, we will be pleased to help you.[/su_button]