Anyone who has worked as a data protection officer for a public administration will know that the question most often raised by senior management is correct way to notify those administrative acts that contain personal data.
To resolve this issue we must go to the seventh additional provision of Organic Law 3/2018, on the protection of personal data and guarantee of digital rights, which deals with the “Identification of those interested in notifications through advertisements and publications. of administrative acts” where three possible assumptions are mentioned:
- On the one hand, when it is necessary to publish an administrative act that contains personal data, will be identified by first and last name, adding four random numerical figures from the national identity document, foreigner's identity number, passport or equivalent document.
- On the other hand, in accordance with article 44 of Law 39/2015 on Common Administrative Procedure, we know that when the parties interested in a procedure are unknown, the place of notification is unknown or, once this was attempted, it could not have been carried out, the notification will be made through an advertisement published in the "Official State Gazette". Likewise, previously and on an optional basis, the Administrations may publish an announcement in the official bulletin of the Autonomous Community or the Province, on the bulletin board of the Town Hall of the last address of the interested party or of the Consulate or Consular Section of the corresponding Embassy.
In these cases, the affected person will be identified exclusively by the complete number of their national identity document, foreigner's identity number, passport or equivalent document.
- Failing that, when the owner lacks any of the aforementioned documents In the two previous paragraphs, the affected person will be identified only by their first and last name.
Therefore, as general ruleIn no case should the name and surname be published together with the complete number of the national identity document, foreigner's identity number, passport or equivalent document.
It is about paying special attention to these cases since they involve the publication of personal data that will be accessible to an indeterminate number of people who, a priori, are not authorized and, therefore, rights and freedoms regarding the protection of data may be violated. data.
