Skip to main content
Information for the interested party on data protection

5.76. AEAT staff and provision of positions

Description of the activity

Processing of data of public employees: current position data, data on previously held positions, data on job provision processes, time control data, data on licenses and permits (including temporary, permanent and absolute disability), economic data, certain health data, family data (for payroll management, for the application of “reconciliation”, etc.).

In terms of the provision of positions, the treatment also extends to non-AEAT personnel and to the relatives of participants for whom merits for conciliation are assessed for the management of the file that begins with the application for participation.

Purpose

Management of personnel, civil servants and employees, assigned to the AEAT, so that this entity can comply with its legal obligations in personnel matters (payment of salaries, granting of permits and licenses, awarding of jobs through the procedures provided for by law, change of administrative situations and other actions provided for by current legislation, which do not have a differentiated treatment in the AEAT Registry of Processing Activities).

Management of employees assigned to the AEAT, so that this entity can carry out actions to control compliance with the obligations of the personnel in its service. 

In terms of filling positions, for all internal and external officials of the AEAT in order to comply with the assessment of merits included in the Bases and Rules of each process called.

Legitimation

The processing is carried out in accordance with article 6.1.e of Regulation 2016/679 (EU), as it is necessary for the exercise of the public powers conferred on the Tax Agency by article 103 of Law 31/1990, of December 27, on the General State Budget for 1991.

Additionally, Article 6.1.b of Regulation 2016/679 (EU) states that “The processing shall be lawful if at least one of the following conditions is met: (…) b) the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract (…)”.

Under this provision, data processing is lawful and does not require consent when the data processing is carried out for the fulfillment of contractual relationships of an employment or administrative law nature.

This provision would also cover the processing of data of public employees, even if their relationship is not contractual in the strict sense.

Sometimes, in order to comply with its obligations in relation to public employees, the Administration must process certain data referred to in the EU Regulation, in its article 9, as “special categories of data".

Thus, Article 9.1 of the aforementioned Regulation states that “The processing of data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data aimed at uniquely identifying a natural person, data relating to the health or data relating to a natural person's sex life or sexual orientation shall be prohibited.”

However, in section 2, a series of exceptions are established in which such data may be processed. Specifically, letter b) of this section 2 indicates the following: “Paragraph 1 shall not apply where one of the following circumstances applies: (…) b) the processing is necessary for the fulfilment of obligations and the exercise of specific rights of the controller or the data subject in the field of labour law and social security and protection (…)”. 

However, for the management of the files for the provision of posts in which the processing of data of relatives of the participating public employee is required, what must be provided is data from a third party, and that third party is no longer bound by a relationship of service or interest in a procedure.

Therefore, the consent of the data owner is necessary, the basis for legitimacy being article 6.1.a of the GDPR: “ The treatment will only be lawful if at least one of the following conditions is met: a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; …

As well as article 9.2.a, in the case of a special category of data: “ the data subject has given explicit consent to the processing of those personal data for one or more of the specified purposes, except where Union or Member State law provides that the prohibition referred to in paragraph 1 cannot be lifted by the data subject;”

Interested parties

Public employees (civil servants and employees who provide services to the AEAT)

Heirs of employees and, where applicable, their legal representatives.

Recipients of retirement benefits (SVA).

Recipients of alimony payments whose payment corresponds to AEAT employees.

Spouses of public employees with family status 2 in the Personal Income Tax.

Regarding the provision of positions, participants in the processes and family members for whom an assessment of conciliation merits is requested.

Details

  • NIF/DNI, SS/Mutuality number, Name and Surname, Personal Registration Number, Image/Voice (photograph), vehicle data
  • Contact information (address, telephone, mobile, email, date and place of birth), to facilitate and ensure contact with employees.
  • Family information (marital status, number of children, dependent ascendants, etc.)
  • Academic and professional data
  • Labor data
  • Economic and financial data
  • Insurance data
  • Health data
  • In terms of filling positions, in addition: data collected and processed with the express consent of the interested parties relating to affiliation, age, health, address, dependency/disability, civil capacity and all those that may prove the assessment of merits through conciliation.

Treatments

  • Collection
  • Record
  • Storage
  • Structuring
  • Modification
  • Update
  • Copy
  • Analysis
  • Enquiry
  • Extraction
  • Promotion
  • Interconnection
  • Limitation
  • Suppression
  • Destruction
  • Other

Recipients

  • Social Security, MUFACE, ISFAS, passive classes, Hacienda Orphanage, medical personnel of the Prevention Service
  • Financial Institutions
  • AGE Pension Plan Control Commission
  • Intervention (Delegated and General)
  • Court of Auditors
  • Courts and Tribunals
  • INE
  • Trade unions
  • HR Managers of the different central and territorial units of the Tax Agency or of other organizations to which personnel occupying positions in the AEAT are assigned

International transfers

Not foreseen

Profiling

No profiles will be created using personal data, without prejudice to the fact that they may be used, after anonymization so that the interested party is not identified or identifiable, to carry out the studies and data analysis that are necessary to assist in the evaluation of the HR policies of the State Tax Administration Agency (AEAT) and in decision-making.

Technical/organizational measures

All data processed has been evaluated through a risk analysis, obtaining the list of technical and organizational measures to be applied.

These measures have been applied in accordance with the approved adaptation plan.

It should be noted that a feature has been enabled on the corporate Intranet so that, where appropriate, incomplete or inaccurate personal contact data can be completed or rectified.