The citizen card will cease to be valid for opening organic waste containers in Palma after a report from the Spanish Data Protection Agency that holds the City Council responsible for violating the protection of personal data with the current system.
The Agency's report requires changing the system
The Spanish Data Protection Agency has certified that the Palma City Council incurs in several infringements of the General Data Protection Regulation. The report indicates that the current method, which requires the citizen to enter their citizen card number to open the brown container, constitutes a processing of personal data. That information is stored along with the date and time of the operation and is sent every 24 hours to Emaya's servers, along with the code of the container used.
The Agency opened a file in June 2023 after a complaint filed by lawyers Alberto Bonet and Jorge Morell. The ruling gives the City Council a period of three months to propose changes or discard the current system.
"It violates data protection because it obliges you to communicate to the City Council where you are, who you are, and your routines for taking out the trash" - Alberto Bonet, lawyer
The white card will replace the citizen card
Emaya is already working on the implementation of a white card that will not be personalized and will only serve to activate the opening of the container. According to the public company, this new card will be available within a period of three to six months and can be requested by any interested citizen. The white card will not be associated with any personal data, although Emaya does not rule out that it may be necessary to enter a number to open the container.
The company defends the need to maintain a card-opening system to better control waste separation and avoid over-occupation of the space. The brown containers that open with the citizen card were launched in 2018 and since the beginning of the current mandate, alternatives are being studied to resolve the situation detected by the Agency.
Infractions and municipal response
The Palma City Council has argued during the procedure that there was no processing of personal data and that only statistical data was collected to adjust the frequency of collection or the number of containers per area. However, the Agency rejects that argument and recalls that the citizen card number is a personal identifier. Furthermore, the combination of location and time slots can reveal individual behaviors.
The Agency concludes that Palma has violated several key obligations of the General Data Protection Regulation, specifically the articles related to the lawfulness of processing, the duty of information and transparency, the record of processing activities, the impact assessment, and the limitation of the retention period.
"It is personal data and therefore must be treated as the regulations state. That is, for something specific, with security measures, minimizing risks and only when there is no other option" - Alberto Bonet, lawyer
Other uses of the citizen card
As of April 1, the citizen card will also no longer serve as a transport ticket to travel on EMT buses, as it will be replaced by the new Single Card. However, it will continue to be used to obtain the certificate of residence for online travel or to access municipal sports facilities.
The future white card will be available for all citizens in the coming months, while the City Council and Emaya adjust the system to comply with data protection regulations.