When can information related to natural persons be reused? The scope of the interpretive criteria of the Protection Agency

As already mentioned  in an earlier post, a few months ago the Spanish Data Protection Agency published its guidelines on the implications of the aforementioned fundamental right in the context of initiatives and projects for the re-use of public sector information. This is undoubtedly one of the main legal difficulties that arise when providing access to public information, since information is often linked to the identity of natural persons, because it appears collected in administrative files related to the processing of procedures that affect them or because their identification is essential for the fulfillment of the Public Administration purposes.

In general, the Article 6 of the Organic Law 15/1999, of December 13, on the Protection of Personal Data, requires that information related to identified or identifiable natural persons can only be treated prior to informed consent or, failing this,if there is legal authorization in this regard. In fact, the legislation regulating the access and re-use of public sector information has meant an important step forward in this respect, the mere presence of personal data does not necessarily imply a definite impediment to its re-use. Or, in the words of the Working group of Article 29 on Data Protection, it can not constitute an unjustified obstacle to the development of the re-use market at European level, as it is stated in the Verdict 06/2013.

From these premises, the Spanish Agency tries to establish the general criteria to make compatible the protection of personal data with the re-use of the information to which they are linked. In any case, it has to borne in mind that it is simply an interpretation without binding force, so those criteria are not strictly legal norms in the strict sense, nor are they fixed under the authority that this institution has to issue instructions in accordance with the provisions of Article 37 (1) (c) of the aforementioned Organic Law 15/1999.

Nevertheless, it is highly foreseeable that the Agency would rely on the guidance it has made public in the event that it has to exercise its powers, in particular if a sanctioning procedure is initiated, hence the importance of knowing precisely the scope of them. 

First, it must be taken into account that, according to the Agency, the re-use of information can not be prevented by the mere fact that it is linked to a natural person, since such a conclusion would be contrary to the need to consider which of both legal rights must prevail, a requirement derived from the provisions of Article 3.4 of Law 37/2007, of November 16, on the re-use of public sector information. Unless, as indicated in the same provision, the data is disassociated from its owner, which would make us to take into account the specific guidelines that the Agency has published regarding anonymization procedures.

Secondly, the Agency distinguish depending on how the information to be re-used was obtained, starting from the two modalities distinguished in the general legislation on transparency: that is, on the one hand, the so-called active advertising, where the public entity is enforced to disseminate the information or it decides to do so without a legal obligation and, on the other, the case where there is a formal request for access to Information that is in the possession of a subject legally enforced to offer it. The Agency considers  that the mode of access can be decisive as regards the re-use of information that includes personal data in such a way that:

• In the case of freely accessible information through active advertising (eGovernment, website, transparency portals...) in principle there would be an inclination to allow its re-use, although the legality of such treatment would pass through a previous analysis of compatibility between the purpose that justified the diffusion and the guarantee of the fundamental right. In other words, it could be the case that the intended use of the published information was not in accordance with the reason for the publication, in that case anonymization would be necessary.
• On the other hand, when the information is accessed as a result of the exercise of the right of access, the Agency considers that, beyond the compatibility judgment mentioned above, it should be taken  account of the reason justifying the access could also serve to enable the re-use. This approach therefore leads us to accept the possibility that the data linked to its holder may be available but not used for different purposes than those on which access was based and in particular to be re-used for commercial purposes. It is, therefore, an important limitation if we take into account that in the case of Public Administrations the information is treated for the consequence of purposes linked to the general interest and, generally speaking, without the consent of those affected. It would therefore be difficult to accept that it should be used for any other purpose, even in the public domain, since in this case the restrictions specifically provided  by the data protection rules would apply.

Thus, the mere fact of lawfully disposing of information linked to identified or identifiable natural persons does not allow, without further consideration, its re-use in a general way, taking into account the criteria mentioned above. In short, if such budgets are not met and, according to the Spanish Data Protection Agency, the only permissible alternative would be to anonymise the data, to unlink them from the owner, which would ultimately result in the non-application of the restrictions derived from the regulations on the protection of personal data since, if it is carried out in accordance with the demands that it poses, the natural person to which the information refers could no longer be considered identifiable.