Regulation and data
GDPR
The GDPR is Regulation (EU) 2016/679, the EU rule that governs the processing of personal data. It has applied directly since 25 May 2018, and in Spain the LOPDGDD completes it. It binds a colegio mayor, a private student residence and a coliving in exactly the same way.
Also known asGeneral Data Protection Regulation · Regulation (EU) 2016/679 · RGPD
What it asks of a centre
It does not distinguish between legal figures: what counts is who decides what the data are processed for, and that is the controller, whether non-profit or not. For an accommodation centre, the regulation comes down to a handful of obligations that keep coming back:
- A legal basis for every processing operation (art. 6). Housing, billing and providing the service rest on the contract, not on consent.
- More care with health data (art. 9): a food allergy is a special category and needs a basis under art. 9.2.
- A contract with every supplier that processes data on the centre's behalf: the DPA of art. 28.
- A record of processing activities: the ROPA of art. 30.
- Answering data-subject rights —access, rectification, erasure, objection— within one month, extendable by two more if the request is complex (art. 12.3).
The LOPDGDD, Spain's Organic Act 3/2018 on data protection, adds rules of its own: processing a minor's data can only rest on their consent when they are over fourteen (art. 7), and camera footage is deleted within one month at most, unless it is needed to prove an incident (art. 22.3). How all of this lands in a residence, with the basis for each category of data, is in the guide to the GDPR in student residences.
Sources
Related terms
- Controller and processorThe controller is whoever decides what personal data are processed for and how; the processor is whoever processes them on the controller's behalf. In a residence, the centre is the controller of its residents' data, and the software supplier or the caterer that handles them for it is a processor.
- DPA (data processing agreement)A DPA (data processing agreement) is the contract that art. 28.3 of the GDPR requires between the controller and each processor: it sets out the subject matter, duration, nature and purpose of the processing, the type of data and of data subjects, and each party's obligations and rights.
- ROPA (record of processing activities)The ROPA, or record of processing activities, is the document art. 30 of the GDPR requires of controller and processor: what data are processed, what for, whose, who receives them, whether they leave the EU, when they are deleted and under what security measures. It goes to the supervisory authority on request.
- Right to erasureThe right to erasure, or right to be forgotten, lets a person have the controller delete their personal data without undue delay if they are no longer needed, if the consent they rested on is withdrawn, if the person objects to the processing or if they were processed unlawfully. Art. 17 of the GDPR governs it.