Article 20 of Organic Law 15/1999, of 13 December, on the Protection of Personal Data, states that the creation, modification or deletion of the files of the Public Administrations may be made only by means of general provision published in the "Official State Gazette" or in the official journal concerned.

For its part, the Regulation on the Development of Organic Law 15/1999 of 13 December on the Protection of Personal Data, approved by Royal Decree 1720/2007 of 21 December, provides in Article 52 that the creation, the modification or deletion of the files of public ownership can only be made by general arrangement or agreement published in the "Official State Gazette" or corresponding official journal. In addition, in Article 53, it determines that where the provision relates to entities or bodies which are linked or dependent on the General Administration of the State, it may take the form of a decision of the holder of the entity or body. corresponding.

In order to comply with the provisions of the aforementioned Organic Law, and thus assure the managed exercise of their legitimate rights, the list of files managed by the Carlos III Health Institute is completed. with the creation of new files set out in the Annex to this Resolution.

Those affected may exercise the right of access, rectification, cancellation and opposition of the personal data contained in these files, in accordance with the provisions of Law 15/1999, of December 13, Protection of Personal Data and its Implementing Regulation.

In its virtue, I have:

First. Creating files.

The personal data files listed in the Annex to this resolution are created in the terms and conditions set out in Organic Law 15/1999 of 13 December on the Protection of Data of Character Personal, and its Development Regulation approved by Royal Decree 1720/2007, of 21 December.

Second. Responsible administrative bodies.

The administrative organs responsible for the files shall take the necessary measures to ensure the confidentiality, security and integrity of the data, as well as the conduct of the other guarantees, obligations and rights recognised in the applicable rules.

Third. Registration of the files in the General Data Protection Register.

In compliance with Article 55 of the Regulation of the Organic Law 15/1999 of 13 December on the protection of personal data, approved by Royal Decree 1720/2007 of 21 December, the files will be notified to the Spanish Data Protection Agency for registration in the General Register of Data Protection within thirty days of the publication of this Order in the "Official Gazette of the State".

Single end disposition. Entry into force.

This Resolution shall enter into force on the day following that of its publication in the "Official State Gazette".

Madrid, January 23, 2017. -Director of the Carlos III Health Institute, Jesús Fernández Crespo.

ANNEX

New Create Files

1. Name of file: Management of patient consultations on rare diseases.

a) Body responsible for the file: Rare Disease Research Institute.

b) Uses and purposes: Manage received queries and provide information and follow up on them. Epidemiological Studies.

c) Affected people and collectives: Citizens.

d) Data collection procedures: Forms to be filled by citizens.

e) Basic structure, personal data types: NIF/DNI, first and last names, Social Security/Mutual Security number, Health Card, address, telephone, email, image/voice, health, racial or ethnic origin.

f) Treatment system: Automated.

g) Data data: Other Spanish health agencies.

h) Service or unit to which the rights of access, rectification and cancellation can be exercised: Institute of Health Carlos III-Research Institute of Rare Diseases. Avenida Monforte de Lemos, n. º 5, 28029 Madrid.

i) Data transfers to other countries: Not foreseen.

j) Required level for security measures: High.

2. File name: Undiagnosed rare disease program.

a) Body responsible for the file: Rare Disease Research Institute.

b) Uses and Purposes: To provide a multidisciplinary approach to the diagnosis of patients with very complex cases of long history without diagnosis.

c) Affected people and groups: Patients.

d) Data collection procedures: Clinical information and genetic analysis.

e) Basic structure, personal data types: NIF/DNI, first and last names, Social Security/Mutual Security number, Health Card, address, telephone, email, image/voice, health, racial or ethnic origin.

f) Treatment system: Automated.

g) Data Cefunes: Other Healthcare Agencies.

h) Service or unit to which the rights of access, rectification and cancellation can be exercised: Institute of Health Carlos III-Research Institute of Rare Diseases. Avenida Monforte de Lemos, n. º 5, 28029 Madrid.

i) Data transfers to other countries: Health agencies of the European Union, the United States and other countries with adequate level of protection to which the Organic Law 15/1999 provides.

j) Required level for security measures: High.