Source: https://iclg.com/practice-areas/data-protection-laws-and-regulations/spain
Timestamp: 2019-04-23 14:30:26+00:00

Document:
Currently, the principal data protection legislation is the Spanish Data Protection Act 15/1999 (the “LOPD”). Royal Decree 1720/2007 (the “RLOPD”) is ancillary to the LOPD and sets out security measures for personal data and further regulation. However, this regulation is set to be modified.
From 25 May 2018, the principal data protection legislation in the EU will be Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”). The GDPR repeals Directive 95/46/EC (the “Data Protection Directive”) and leads to increased (though not total) harmonisation of data protection law across the EU Member States. In Spain, a draft bill (the “Draft LOPD Bill”) is currently before the Spanish Parliament (please note: these answers were written before the Draft LOPD Bill was adopted; consequently, they might not reflect the final adopted text). This bill is intended to repeal the current LOPD and any provisions of equal or inferior category that contradict, oppose or are incompatible with the GDPR and the Draft LOPD Bill. Further, in its current version, the Draft LOPD Bill is intended to enter into force from 25 May 2018.
Organic Law 1/1982 on civil protection of the rights to honour, personal and family privacy and an individual’s own image.
Gross privacy non-disclosure violations might be prosecuted under criminal charges in accordance to Art. 197 of the Criminal Code.
Law 34/2002 on information society services and ecommerce (the “LSSI”). This law covers the e-marketing communications regime, internet service provider (ISP) liability and anti-spam regulation.
(a) Art. 96 of the Spanish Consumer Rights Act Real Decreto Legislativo 1/2007, de 16 de noviembre, por el que se aprueba el texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios y otras leyes complementarias, in connection with Art. 29 of Ley 3/1991 de 10 de enero, de competencia desleal, as modified by Law 29/2009. According to this regulation, marketing phone calls must be clearly identified as such, and fully disclose the identity of the calling company. In every communication, recipients shall be offered the opportunity to oppose to further calling. Human operators are allowed for telemarketing only. Recorded telemarketing campaigns need the prior recipient to opt-in.
(b) Art. 41 of the Spanish Telecoms Act Ley 9/2014, de mayo, General de Telecomunicaciones sets forth privacy standards for telecommunications, including compulsory notifications to the Data Protection Authority (the “DPA”) and to data subjects in the case of breaches or violations of security. Art. 48 further provides that customers’ geolocation information (latitude data) should always be processed anonymously. Nominal customer geolocation is only allowed when strictly necessary and indispensable for the provision of value-added services expressly requested by the customer. In such a case, the customer should be informed about the extent, purpose and duration of this processing.
(c) Insurance legislation such as Real Decreto Legislativo 6/2004, de 29 de octubre, por el que se aprueba el texto refundido de la Ley de ordenación y supervisión de los seguros privados and Ley 26/2006, de 17 de julio, de mediación de seguros y reaseguros privados contains data protection provisions specific to the insurance industry.
(d) Legislation specific to healthcare service provisions sheds light on rights to access health records and mandatory conservation timeframes of such information. The most important piece of legislation is Ley 41/2002, de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica.
(e) Art. 17 of Ley 59/2003 de firma electrónica covers data privacy issues related to electronic signatures.
(f) Real Decreto 1553/2005, de 23 diciembre, por el que se regula la expedición del documento nacional de identidad y sus certificados de firma electrónica covers electronic identity card usage.
(g) Art. 6.2b of Ley 11/2007 de Acceso electrónico de los ciudadanos a los servicios públicos provided the citizens’ right to get in touch with the public administration by electronic means. It has now been derogated by Ley 39/2015, de 1 octubre, del Procedimiento administrativo común de las administraciones públicas. The public administration must ensure security measures when handling a citizen’s data with regards to such communication.
(h) The Spanish Data Retention Act Ley 25/2007, de 18 de octubre, de conservación de datos relativos a las comunicaciones electrónicas y a las redes públicas de comunicaciones. This act governs carrier companies’ obligations to retain traffic and personal data related to such traffic.
(i) Art. 20.3 of Real Decreto Legislativo 2/2015, de 23 de octubre, del Estatuto de los Trabajadores. This article sets out that control measures on employees are permitted.
The main data protection authority is the Agencia Española de Protección de Datos (the “AEPD” or “Spanish DPA”). However, there are also regional data protection authorities in Catalonia and the Basque Country with powers essentially over public entities within their respective territory.
There are no other key definitions to be aware of.
The GDPR applies to businesses that are established in any EU Member State and that process personal data (either as a controller or processor, and regardless of whether or not the processing takes place in the EU) in the context of that establishment.
The GDPR applies to businesses outside the EU if they (either as controller or processor) process the personal data of data subjects who are in the EU in relation to: (i) the offering of goods or services (whether or not in return for payment) to data subjects who are in the EU; or (ii) the monitoring of the behaviour of data subjects who are in the EU (to the extent that such behaviour takes place in the EU).
Further, the GDPR applies to businesses established outside the EU if they monitor the behaviour of data subjects who are in the EU (to the extent such behaviour takes place in the EU).
A data subject has the right to obtain from a controller the following information in respect of the data subject’s personal data: (i) confirmation of whether, and where, the controller is processing the data subject’s personal data; (ii) information about the purposes of the processing; (iii) information about the categories of data being processed; (iv) information about the categories of recipients with whom the data may be shared; (v) information about the period for which the data will be stored (or the criteria used to determine that period); (vi) information about the existence of the rights to erasure, to rectification, to restriction of processing and to object to processing; (vii) information about the existence of the right to complain to the relevant data protection authority; (viii) where the data were not collected from the data subject, information as to the source of the data; and (ix) information about the existence of, and an explanation of the logic involved in, any automated processing that has a significant effect on the data subject.
Data subjects have the right to lodge complaints concerning the processing of their personal data with the competent data protection authority in Spain, if the data subjects live in Spain or the alleged infringement occurred in Spain.
Under the LOPD/RLOPD, businesses must register with/notify the Spanish DPA before creating files containing personal data. They must also notify any modifications or cancellations of such files to the Spanish DPA (see the LOPD/RLOPD).
It must be specific. The specific forms are available on the Spanish DPA’s website and cannot be submitted unless the required information is filled out.
Registrations/notifications are made per legal entity and type of processing.
All of the above must register with the relevant data protection authorities.
Information of the data controller (name, industry, CIF/NIF number and address).
Valid address for exercising rights of access, opposition, rectification and erasure (if different).
Information on relevant data processors (if any).
Categories of data under processing.
Security level (basic, medium or high).
Processing methods (automated, manual or mixed).
Transfer of data to third parties (data surrender or disclosure).
International transfers (for transfers outside of the European Economic Area).
Failing to notify files, or doing so in an inaccurate way, constitutes a minor infringement on the grounds of Art. 44.2.c of the LOPD (and will incur a fine of EUR 900 to EUR 40,000). Failure to notify files after being expressly mandated to do so by the DPA constitutes a serious infringement punishable by a fine of between EUR 40,001 and EUR 300,000.
There is no set renewal obligation for registrations/notifications. However, any modifications to the categories listed under question 6.5 must be notified. Further, a notification must also be submitted when a data processing stops taking place (is discontinued) or when data processing is transferred to a new data controller.
There is no prior approval required for these registrations/notifications. However, please note that prior approval may be required for international transfers.
Yes. They can be completed at the following address: https://sedeagpd.gob.es/sede-electronica-web/. However, please note that the procedure might not be able to be carried out entirely online.
Yes. However, not all information is made available to the public. For example, registration codes and security levels are not available publicly.
Professional associations which are regulated by Law 2/1974.
Educational institutions which are regulated by Law 2/2006.
Entities which exploit networks and provides electronic communications services when they process large-scale regular and systematic personal data.
Society information service providers when they create large-scale profiles of users of the service.
Entities covered by Law 10/2014 (credit entities).
Financial establishments which are regulated by Law 5/2015.
Insurance entities which are regulated by Law 20/2015.
Investment services companies which are regulated by Royal Decree 4/2015.
Electric energy distributors and suppliers as well as natural gas distributors and suppliers.
Entities who are in charge of general files for assessing financial solvency and creditworthiness or general files for managing and preventing fraud, including controllers which are regulated by Law 10/2010.
Entities engaged in advertising activities and commercial research, including commercial and market research, when they carry out processing activities based on preferences of data subjects or when they carry out processing activities which involve profiling of the data subjects.
Health centres which are legally required to keep medical records of patients in accordance with Law 41/2002.
Entities whose purposes include the issuance of commercial reports which could mention natural persons.
Gaming operators whose activity is carried out electronically, telematically and interactively in accordance with Law 3/2011.
Those who carry out activities which are regulated by Law 5/2014 (private security).
Failure to comply with the requirement to designate a Data Protection Officer (when mandatory to do so) is considered a serious infringement under the Draft LOPD Bill.
The appointed Data Protection Officer should not be dismissed or penalised for performing his or her tasks and should report directly to the highest management level of the controller or processor.
The Draft LOPD Bill specifies that the appointed Data Protection Officer cannot be dismissed or penalised for performing his tasks, except in cases of intent or gross negligence.
A single Data Protection Officer is permitted by a group of undertakings, provided that the Data Protection Officer is easily accessible from each establishment.
A Data Protection Officer should be involved in all issues which relate to the protection of personal data. The GDPR outlines the minimum tasks required by the Data Protection Officer which include: (i) informing the controller, processor and their relevant employees who process data of their obligations under the GDPR; (ii) monitoring compliance with the GDPR, national data protection legislation and internal policies in relation to the processing of personal data including internal audits; (iii) advising on data protection impact assessments (“DPIAs”) and the training of staff; and (iv) co-operating with the data protection authority and acting as the authority’s primary contact point for issues related to data processing.
Yes, the controller or processor must notify the data protection authority of the contact details of the designated Data Protection Officer. More specifically, the Draft LOPD Bill indicates that controllers and processors shall notify designations and dismissals of Data Protection Officers within ten (10) days. This applies when the designation of a Data Protection Officer is mandatory as well as when the entity chooses to appoint one voluntarily.
The Data Protection Officer does not necessarily need to be named in the public-facing privacy notice. However, the contact details of the Data Protection Officer must be notified to the data subject when personal data relating to that data subject are collected. As a matter of good practice, the Article 29 Working Party (the “WP29”) recommends that both the data protection authority and employees should be notified of the name and contact details of the Data Protection Officer.
The Spanish DPA has published Guidelines for the Preparation of Contracts between controllers and processors available at: http://www.agpd.es/portalwebAGPD/canaldocumentacion/publicaciones/common/Guias/EN_directricescontratos.pdf (English version).
General opt-in rule: Unsolicited emailing requires previous opting in from the data subject.
Exceptional opt-out rule: Customers can be sent unsolicited emails, provided such unsolicited emailing is advertising similar goods and services to those previously purchased by such customers.
Single click unsubscribe: Such an option at the end of every post is mandatory.
The Robinson List: Must be checked before sending electronic communications.
Unsolicited marketing communications can only be sent in written paper format by regular post to individuals whose contact details are displayed in telephone directories or are obtained from other public sources.
The Spanish Consumer Rights Act Real Decreto Legislativo 1/2007, de 16 de noviembre, por el que se aprueba el texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios y otras leyes complementarias bans “robot” telemarketing phone calls. Unsolicited telemarketing calls must be performed by human agents, and shall always show the phone number of the calling party. People in the Robinson List should never be contacted.
Art. 29 of the Spanish Unfair Competition Act Ley 3/1991, de 10 de enero, de Competencia Desleal considers it an aggressive practice to carry out persistent unsolicited phone calls, emails or any other electronic means, unless this is deemed necessary and justifiable in order to seek fulfilment of legal obligations.
Due regard shall be paid to the legal basis of the processing and the duty of information (Art. 13 of the GDPR and Art. 14 of the GDPR). Further, the purchaser must be able to demonstrate that it complies with the GDPR and, specifically, that the use of a purchased marketing list complies with any of the legitimate basis of processing as established by Art. 6 of the GDPR. The general rules on sending marketing communications apply.
Sending marketing communications in breach of the LSSI shall be fined up to EUR 150,000. However, if doing so involved an infringement of the LOPD at the same time, then an additional fine of up to EUR 300,000 shall be imposed.
The LSSI implements Art. 5 of the EU ePrivacy Directive. Pursuant to Art. 5 of the EU ePrivacy Directive, the storage of cookies (or other data) on an end user’s device requires prior consent (the applicable standard of consent is derived from Directive 95/46/EC and, from 25 May 2018, the GDPR). For consent to be valid, it must be informed, specific, freely given and must constitute a real indication of the individual’s wishes. This does not apply if: (i) the cookie is for the sole purpose of carrying out the transmission of a communication over an electronic communications network; or (ii) the cookie is strictly necessary to provide an “information society service” (e.g., a service over the internet) requested by the subscriber or user, which means that it must be essential to fulfil their request. The Spanish DPA has published a Guide on Cookies available in Spanish.
Yes. It is noteworthy to mention that a fine was imposed in 2017 for using the Mailchimp Service in breach of Art. 22.2 of the LSSI.
For other sanction resolutions, please visit the Spanish DPA’s website: http://www.agpd.es/portalwebAGPD/canaldocumentacion/cookies/index-ides-idphp.php.
Failure to provide proper cookie information might attract fines of up to EUR 30,000. If this action is repeated within three (3) years after the first final decision of the Spanish DPA, this might attract fines from EUR 30,000 to EUR 150,000.
Traditionally, Spain prohibited anonymous reporting (see the Spanish DPA’s legal report 2007-0128). However, the Draft LOPD Bill opens the door to anonymous reporting.
According to the LOPD, prior notification is needed as for any other type of personal data processing. Further, controllers must place a sign which is sufficiently visible, and documents which comply with the duty to inform must be made available to data subjects.
Under the GDPR, a DPIA must be undertaken with assistance from the Data Protection Officer when there is a systematic monitoring of a publicly accessible area on a large scale. If the DPIA suggests that the processing would result in a high risk to the rights and freedoms of individuals prior to any action being taken by the controller, the controller must consult the data protection authority.
During the course of a consultation, the controller must provide information on the responsibilities of the controller and/or processors involved, the purpose of the intended processing, a copy of the DPIA, the safeguards provided by the GDPR to protect the rights and freedoms of data subjects and where applicable, the contact details of the Data Protection Officer.
The Draft LOPD Bill follows essentially what has been outlined under the current LOPD.
A guide on video surveillance is set to be published by the Spanish DPA once the GDPR and the new LOPD become applicable.
Monitoring must be lawful, transparent, proportionate and legitimate and there should not be other less intrusive means to reach equivalent goals. Prominent video surveillance signs are always a must.
In 2017, the WP29 updated its opinion on data processing at work (Opinion 2/2017).
Consent of employees is not needed, since notice is required since control measures on employees are permitted by law (Art. 20.3 of Estatuto de los trabajadores), provided that such control measures comply with the above-mentioned principles. The Draft LOPD Bill adds that failure to provide the required information will not deprive the images of their probative value where the images have captured the flagrant commission of a criminal act. However, this is without prejudice to the liabilities that may arise from such failure.
The issue of notice in the context of covert video surveillance of employees has been the subject of a recent case of the ECHR (López Ribalda v. Spain).
The Company’s Workers’ Committee (comités de empresa) must be informed of the existence of CCTV, according to Art. 64.2 of Estatuto de los trabajadores.
Both controllers and processors must ensure they have appropriate technical and organisational measures to meet the requirements of the GDPR. Depending on the security risk, this may include the encryption of personal data, the ability to ensure the ongoing confidentiality, integrity and resilience of processing systems, an ability to restore access to data following a technical or physical incident and a process for regularly testing and evaluating the technical and organisation measures for ensuring the security of processing.
Further, failure to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk as is required by Art. 32.1 of the GDPR is considered a serious infringement under the Draft LOPD Bill.
The GDPR entitles the relevant data protection authority to impose a temporary or definitive limitation including a ban on processing.
The Spanish DPA makes all its decisions available to the public. Therefore, there are countless enforcement examples available on the Spanish DPA’s website.
Facebook Spain, S.L. was an establishment of Facebook Inc.: Spanish Law is applicable when the data are processed in the context of activities conducted at the controller’s establishment, provided such establishment is located on Spanish soil (see Art. 2.1.a) of the current LOPD).
Facebook, Inc. processed data with hardware located on Spanish soil which was not employed for transit only: Spanish Law is applicable when the controller is not established in the European Union and processes the data with hardware located on Spanish soil, unless such hardware is employed for transit only (see Art. 2.1.c) of the current LOPD).
Businesses will typically analyse the request on a case-by-case basis and take into account data protection, labour, criminal and other relevant laws. They will check, among others, if the request is correctly made, if it complies with the legal formalities between the countries, the scope of the request, the legal basis for the disclosure and any international data transfer issues.
No clear guidance is in place besides international conventions ratified by Spanish regulatory bodies, such as the USA FTC Memorandum of Understanding and equivalent documents. However, the WP29’s Working Document 1/2009 on pre-trial discovery for cross-border civil litigation might provide some guidance. Further, the Spanish DPA analysed the issue in 2011 and published a legal report which is available on its website.
Art. 4.3 of the LOPD – Quality of data.
Art. 6.1 of the LOPD – Data subject consent.
Art. 21 of the LOPD – Prohibition of commercial communications sent by electronic means without previous data subject consent.
Also noteworthy is that the Spanish DPA has imposed fines on Facebook, Whatsapp and Google in the last twelve (12) months.
The GDPR and the Draft LOPD Bill are the two main “hot topics”.

References: Art. 197
 Art. 96
 Art. 29
 Art. 41
 Art. 48
 Art. 17
 Art. 6
 Art. 20
 Art. 44

Art. 29
 Art. 14
 Art. 6
 Art. 5
 Art. 5
 Art. 22
 v. 
 Art. 64
 Art. 32
 Art. 2
 Art. 2

Art. 4

Art. 6

Art. 21