Spanish DPA Rules on Limits to Sharing Doctors' ID Data for Disability Control

Key Takeaways

• The Spanish Data Protection Agency (AEPD) issued an opinion limiting a medical college's transfer of members' national ID numbers (DNI) and dates of birth to a regional health service for temporary disability control purposes.
• The ruling confirms that only data on doctors actually competent to issue disability reports within the requesting authority's territory may be shared, and that DNI (not date of birth) is the only additional identifier proportionate to the stated purpose.
• This decision offers a useful precedent on data minimization and purpose limitation for any organization sharing professional registry data with public administrations.

Deep Dive

This AEPD legal opinion addresses a data-sharing request from Extremadura's health service (SES) to a professional college of physicians, seeking additional personal data (national ID numbers or dates of birth) beyond what had already been transferred (name, surname, membership number) to improve administration of temporary disability (TD/IT) reporting. The case illustrates the application of core LOPD (Spanish data protection law, predecessor framework referenced alongside GDPR principles) concepts—lawful basis, purpose limitation, and data minimization—to inter-administrative data transfers involving regulated professionals.

The AEPD's key finding is twofold. First, data transfers must be limited strictly to those professionals who are actually within the scope of the requesting authority's competence—here, doctors capable of issuing TD reports with effect in Extremadura. Doctors with purely private practices, or registered but practicing elsewhere, fall outside this purpose and their data should not be transferred. Second, on the principle of data quality (proportionality), the AEPD distinguishes between DNI and date of birth: DNI is deemed an adequate, non-excessive identifier because it uniquely distinguishes individuals, whereas date of birth is rejected as disproportionate since it does not reliably individualize a person and multiple colleagues could share the same birth date, making it less suitable and more invasive relative to the stated administrative purpose.

For compliance teams—particularly those in regulated professional bodies, healthcare administrations, or any entity handling inter-institutional data-sharing agreements—this opinion reinforces that data sharing arrangements, even when underpinned by statutory authority or collaboration agreements (such as the INSS-Extremadura TD control agreement), must still pass a case-by-case necessity and proportionality test for each data element requested. Blanket requests for additional identifiers should be scrutinized against the specific legal competence and functional need of the requesting party, not merely administrative convenience (e.g., avoiding manual data entry errors).

Recommended actions include: (1) reviewing any existing data-sharing protocols with public administrations to ensure that transferred data fields are justified against documented legal powers and specific purposes; (2) implementing filtering mechanisms so that only data subjects within scope of the recipient's competence are included in transfers; (3) favoring unique, purpose-fit identifiers (like ID numbers) over broader identifiers (like birth dates) when proportionality is in question; and (4) documenting the legal basis (statutory competence, collaboration agreement) for each category of data shared. Failure to apply these minimization principles creates regulatory risk, including potential sanctions for excessive or unlawful processing, and reputational risk for entities perceived as careless custodians of professional and health-adjacent data.

Source: Spanish Data Protection Agency (Agencia Española de Protección de Datos)