Skip to main content
Information for the interested party on data protection

5.100. Social aid

Description of the activity

Processing of personal data of public employees and, where applicable, of members of their family unit for the management of the file that is initiated, at the request of the interested party, to request aid from the social action plan of the State Tax Administration Agency.

Purpose

Comply with the Social Action Plan of the State Tax Administration Agency, in accordance with the general and specific requirements set out in the general and specific bases of each of the grants.

Legitimation

The processing is carried out in accordance with article 6.1.e of Regulation 2016/679 (EU), as it is necessary for the exercise of the public powers conferred on the Tax Agency by article 103 of Law 31/1990, of December 27, on the General State Budget for 1991.

Additionally, Article 17.1 of Law 35/2006 on Personal Income Tax states as follows: “ All compensation or benefits, whatever their name or nature, monetary or in kind, that derive, directly or indirectly, from personal work or from the employment or statutory relationship and do not have the character of income from economic activities will be considered full income from work.”

Consequently, social action aid would be monetary compensation derived from the service relationship of public employees with the Administration.

Article 6.1.b of Regulation 2016/679 (EU) states that “The processing shall be lawful if at least one of the following conditions is met: (…) b) the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to a contract (…)”.

Pursuant to this provision, data processing is lawful and does not require consent from the interested party, provided that the data relates to the interested party or to minors under 14 years of age who are under the interested party's parental authority, as well as to persons under the interested party's guardianship, when the data processing is carried out for the fulfilment of contractual relations of an employment nature.

In order to fulfil its obligations in relation to public employees, the Administration must sometimes process certain data referred to in Article 9 of the EU Regulation as “ categories of ”.

Article 9.1 of the Regulation states that “The processing of data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data intended to uniquely identify a natural person, data relating to the health or data relating to a natural person's sex life or sexual orientation shall be prohibited.”

However, in section 2, a series of exceptions are established in which such data may be processed. Specifically, letter b) of this section 2 indicates the following: “Paragraph 1 shall not apply where one of the following circumstances applies: (…) b) the processing is necessary for the fulfilment of obligations and the exercise of specific rights of the controller or the data subject in the field of labour law and social security and protection (…)”.

For the management of social action aid in which the processing of data of family members of public employees is required, except for minors under 14 years of age and/or persons subject to their guardianship, the employee must provide data of a third party, who is no longer linked by a service relationship with the Tax Agency.

Therefore, for the processing of data of family members who are over 14 years of age, and those who are not under the guardianship of the public employee, the consent of the data owner is necessary, the basis for legitimacy being article 6.1.a and article 9.2.a of the GDPR.

Article 6. 1. The treatment will only be lawful if at least one of the following conditions is met:

  1. the interested party gave his/her consent to the processing of his/her personal data for one or more specific purposes ;

Article 9. 2. Paragraph 1 shall not apply where one of the following circumstances applies:

  1. the data subject has given explicit consent to the processing of those personal data for one or more of the specified purposes, except where Union or Member State law provides that the prohibition referred to in paragraph 1 cannot be lifted by the data subject;

Interested parties

  • Public employees of the AEAT
  • Members of the family unit of said public employees.

Details

  • Health (data collected and processed with the express consent of the interested parties)
  • NIF/DNI, Name and Surname
  • Contact information (Address, Telephone, Mobile, Email)
  • Date of birth, age, sex.
  • Employment data (job position, history)
  • Family information (marital status, number of children, dependent ascendants, etc.)
  • Academic and professional data
  • Economic and financial data

Treatments

  • Collection
  • Record
  • Storage
  • Structuring
  • Modification
  • Update
  • Copy
  • Analysis
  • Enquiry
  • Extraction
  • Promotion
  • Interconnection
  • Limitation
  • Suppression
  • Destruction
  • Other

Recipients

  • Social Security, MUFACE
  • The public employees of the Deputy Subdirectorate of Equality and Social Policies (a small number of user managers have access to the documentation)
  • Medical staff of the Occupational Risk Prevention Service.

International transfers

Not foreseen

Profiling

No profiles will be created using personal data, without prejudice to the fact that they may be used, after anonymization so that the interested party is not identified or identifiable, to carry out the studies and data analysis that are necessary to assist in the evaluation of the HR policies of the State Tax Administration Agency (AEAT) and in decision-making.

Technical/organizational measures

All data processed has been evaluated through a risk analysis, obtaining the list of technical and organizational measures to be applied.

These measures have been applied in accordance with the approved adaptation plan.