The right of access to public information as a limitation to privacy

A fundamental right, not an absolute right

The protection of personal data of natural persons is a fundamental right recognized in article 8.1 of the Charter of Fundamental Rights of the European Union and protected by article 18.4 of our Constitution. Its regulatory development is established in Regulation (EU) 2016/679 General Data Protection (RGPD) and in Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). ).

However, the status of fundamental does not grant it that of an absolute right. Its exercise may be limited by the prevalence of other fundamental rights or by the need to safeguard different objectives such as State security, defense, public safety, prevention, investigation, detection or prosecution of criminal offenses or other important objectives of interest. general public of the Union or of a Member State.

These limiting assumptions, listed in article 23 of the GDPR, must meet three requirements:

• be covered by a legislative measure of Union or Member State law;
• aim to limit the scope of the obligations or rights established in articles 5 and/or 12 to 22 and/or article 34 of the GDPR;
• essentially respect fundamental rights and freedoms and be a necessary and proportionate measure in a democratic society to safeguard the aforementioned objectives.

Exercising this power recognized in the RGPD, our legislator has provided for active advertising and access to public information, a right recognized in article 105.b) of the Spanish Constitution and regulated by Title I of Law 19/2013 , of December 9, on transparency, access to public information and good governance, as one of the supposed limitations of the right to data protection.

Objectives of public transparency

Transparency, access to public information and good governance standards are elements inherent to political action in any democratic State governed by the rule of law. The explanatory memorandum of the Transparency Law correctly states: <<Only when the action of public officials is subjected to scrutiny, when citizens can know how decisions that affect them are made, how public funds are managed or under what criteria our institutions act can we speak of the beginning of a process in which Public powers begin to respond to a society that is critical, demanding and demands participation from public powers.>>.

The justification for the existence of this norm clearly pursues the benefit of a general public interest, expected in any consolidated democracy in accordance with the social and political demands of the moment. 

Two transparency models:

Access to information in our country is regulated from two perspectives that impose different obligations on the administrations and public entities contemplated in the subjective scope of the Transparency Law or the sectoral or regional regulations that regulate the issue.

The existing models are, which I consider it clarifying to call:

• Active advertising: Corresponding to the requirement to periodically publish certain institutional, organizational or planning information, of legal or economic, budgetary and statistical relevance.
• Attention to reactive: Corresponding to the obligation to respond to specific requests for access to information made by citizens.

Both models, of course, must respect the principles of data protection and the regulatory restrictions that make up this institution. However, as you may be deducing, this respect is easier to control in active advertising actions, since they are regulated by law, than in reactive attention to requests for access to public information, which by their nature must be analyzed. case by case by the head of the administrative body or entity that holds the information against which the procedure for the exercise of the right of access has been initiated.

The data protection model adopted

In this way, when the information requested by a citizen contains personal data, the attention of the request will be subject to the provisions of articles 5.3 and 15 of the Transparency Law, the RGPD and the LOPDGDD. A regulatory framework that leaves a wide margin of interpretation in the necessary weighing of the right of access to sufficiently reasoned information of the public interest and the data protection of those affected whose data appears in the requested information.

From this classification we must exclude the provisions of the Transparency Law, which provide legal certainty by clearly establishing the legality interpretation criteria in cases in which the information requested contains personal data that reveals ideology, union membership, religion or beliefs or if the information includes personal data that refers to racial origin, health or sexual life, includes genetic or biometric data or contained data relating to the commission of criminal or administrative infractions that did not entail a public reprimand to the offender; criteria for interpreting proportionality establishing that access will be granted to information that contains merely identifying data related to the organization, operation or public activity of the body; just like him recommended safety criteria based on the dissociation of personal data that prevents the irreversible identification of the affected persons.

Transparency Portal of the General State Administration

If you want to know more about the right of access to public information, I invite you to visit the Transparency Portal of the General State Administration.