When the topic of data protection arises, people almost always think of banks, medical clinics, or online stores—rarely of urban planning files or environmental authorizations. Yet, such files contain names, addresses, cadastral references, formal submissions from neighbors, complaints, and administrative decisions that identify specific individuals. All of this constitutes personal data, and its processing is subject to specific rules.
The challenge lies in the fact that administrative tradition and privacy regulations often pull in different directions. The principle of public access is long-standing and sound: a general urban plan or a project with an environmental impact is opened for public consultation because those affected have a right to be informed and to express their views. However, “public access” does not mean that everything contained in a file should be visible to anyone, nor that it should remain accessible indefinitely.
Consider a common scenario: an individual submits a formal objection to an urban planning instrument or files a complaint regarding an activity that causes them distress. This document becomes part of the administrative file, which may then be accessible to other interested parties. But how far does this right of access extend? Should it include the individual’s full name, home address, or telephone number? The answer varies depending on who is requesting access, the purpose of the request, and the stage of the administrative procedure.
The publication of administrative acts and notifications via public notice (edict) presents its own set of complexities. Organic Law 3/2018 includes an additional provision regarding the identification of affected parties when information is published in an official gazette or on a public notice board—specifically to prevent names from appearing alongside full identification document numbers unnecessarily. This rule is not widely known and is violated far more often than is acknowledged.
Then there is the realm of environmental information, where the balance is even more delicate. Law 27/2006 establishes a broad right of access to environmental information, and the Transparency Law (Law 19/2013) does the same for public information in general. However, both laws identify the protection of personal data as a limitation that must be weighed—on a case-by-case basis—against the public interest in disclosure. There is no mechanical formula; one must evaluate what data is being requested, for what purpose, and whether that objective can be achieved without identifying any individuals.
In the Basque Country, it is also important to know which authority oversees what. The Basque Data Protection Agency handles files and data processing within the Basque public sector, while private companies fall under the jurisdiction of the Spanish Data Protection Agency. A single project involving both a local government authority and a private developer may therefore fall under the purview of both agencies.
In practical terms, what should those who manage these files do? Nothing extraordinary. They should know what personal data is involved in each procedure and why. They must exercise sound judgment to decide what should be published, what should be anonymized, and what should be disclosed only to those who can demonstrate a legitimate interest. They should also review contracts with companies that provide technical services and handle such information. Furthermore, they should keep a record of their decisions—because when a complaint arises, what matters is the ability to explain why a particular course of action was taken.
Data protection does not hinder administrative or urban planning activities; rather, it requires that such actions be justified. Those who can provide a solid justification for their decisions generally encounter fewer issues—both with supervisory authorities and before the courts.