Purpose of the processing
During the Spanish Presidency of the Council of the European Union, from July 1 to December 31, 2023, as well as regarding the preparation of inter-parliamentary activities during the first half of 2024, the personal details of participants in parliamentary meetings shall be collected, together with information regarding their visit.
The participants’ information is required to organize the meetings, for example to prepare the materials for the meetings and the identification badges with photos, the recording of the meetings and the preparation of publications. The webcasting of the sittings, as well as the participants’ names and countries shall be published online in the following web: https://parleu2023.es
Legitimation of data processing
Consent of the interested party (granted when registering online)
Article 6.1.a) of the GDPR (EU 2016/679)
Performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Article 6.1.e) of the GDPR (EU 2016/679)
Categories of personal data subject to processing
Personal details collected in the participants’ online registration shall include one or all of the following: name and surname of the participant, gender, country, e-mail, phone number, academic degree, profession, organization, political party, postal address, passport number and food allergies.
Recipients or categories of recipients of personal data
Personal data shall be communicated solely to the staff involved in the organization of the meetings, according to the terms necessary for the organization and holding of the meetings pursuant to the stated purposes.
Personal data shall be processed by the staff of the Cortes Generales entrusted with organizing the visits, as well as with its online publication.
Data transfer to third countries
Personal data shall not be transferred outside the European Union or the European Economic Area.
Personal data storage and profiling
Personal data shall be stored as long as necessary for the organization of the meetings.
Personal data shall not be used for automated profiling.
Rights of data subjects
Data subjects have the right to know their personal data included in the file. Pursuant to the General Data Protection Regulation (GDPR), those responsible for the processing must respond to requests regarding the exercise of the rights of data subjects within 1 month of receiving the request.
Data subjects may exercise the following rights:
Data subjects have the right to know which data are being processed.
Data subjects have the right to have their inaccurate or uncomplete personal data rectified. The individual requesting the rectification must submit the documentation justifying the request.
The data subject has the right to restrict the processing provided one of the following requirements is met:
The data subject challenges the accuracy of the personal data, whilst the controller verifies its correction.
The processing is unlawful, and the individual opposes erasure and requests restriction instead.
The controller no longer needs the personal data for the processing purposes, but the data subject needs them to establish, exercise or defend a claim.
The data subject has the right to have his/her personal data erased without any undue delay in any of the following circumstances:
Personal data are no longer necessary for the purposes for which they were collected or are processed otherwise.
The data subject withdraws the consent for the processing and there is no other lawful basis.
The individual opposes the processing, and there is no overriding legitimate interest to continue it.
Personal data have been processed unlawfully.
Personal data must be suppressed in order to comply with a legal obligation imposed on the controller.
The data subject has the right to receive the personal data provided to the controller and to transfer them directly to another processing controller, provided the processing is automated and based on the consent of the data subject or a contract.
The data subject has the right to object to the processing of his/her data for reasons related to their particular situation, when the processing is based on a task conducted for reasons of public interest or in the exercise of official authority. The controller may not continue with the processing of personal data, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the individual or if the processing is necessary for the establishment, exercise or defence of legal claims.
The data subject has the right to lodge a complaint before the competent data protection authority if he/she considers that the processing of his/her data has breached the applicable data protection regulation.
Contact details of the competent authority in Spain for data protection:
Agencia Española de Protección de Datos
Calle Jorge Juan, 6
28001 – Madrid, España
Phone number: 900 293 183
E-office: sedeagpd.gob.es
Controllers:
The bodies responsible for the personal data processing are the Congress of Deputies and the Senate:
Congreso de los Diputados
Plaza de las Cortes, 1
28071 – Madrid, España
Phone number: (0034) 91 390 62 96
E-mail: informacion@congreso.es
E-mail of the Delegate for Data Protection: dpd@congreso.es
Senado
Calle Bailén, 3
28071 – Madrid, España
Phone number: (0034) 91 538 18 53
E-mail: informacion@senado.es
E-mail of the Delegate for Data Protection: dpd@senado.es