The High Court has ruled that this requirement infringes the protection of personal data.
The Social Chamber has annulled a paragraph of Article 8.2 of the Ordinance of the Bank of Spain. This paragraph obliged its employees to deliver the IRPF declaration in the process of verifying private financial operations.
The IRPF not only allows to know the economic data of the affected, but a whole range of data that appear in the same, as for example, their religion, ideas... data which, according to LOPDP 15/199 of 13 December, are particularly protected.
The court dismissed the appeals for cancellation by BANK OF SPAIN and FEDERATION OF WORKERS COMMISSIONS, against the sentence imposed by the National High Court that declared the nullity of a paragraph of article 8.2 of Ordinance 9/2017, which develops the Code of Conduct for the staff of the Bank of Spain.
The Chamber rejected the Bank of Spain argument that the worker’s consent was not necessary when exercising an entrepreneurial power, adding that the employer’s powers to control the activity of his employees are not omnibus, have the limit that the exercise of this right must respect the dignity of the worker.
It also ensures that the ECB Guidelines 2015/855 and 2015/856, Articles 5 and 3.3 impose on the Eurosystem central banks obligations to monitor compliance with the rules contained in the Guideline and compliance checks, either on a regular or ad hoc basis, but do not generally provide for the Bank to be able to claim from any of its employees their personal income tax returns or tax data.
Thus, it states that what is required is an obligation of supervision but not the way in which it is to be carried out, leaving to the decision of the Bank of Spain the way to carry out the supervision and verification of compliance with the rules of the Guideline. Finally, it considers that the measure required by the Bank of Spain does not exceed the three-fold constitutional requirement of being adequate, necessary and proportionate.
Finally, the Chamber concluded that there is no legal authorization for the Bank of Spain to request from its employees the IRPF declarations for up to four years, nor with the consent of the interested parties, because it infringes the right to the protection of personal data.