Ley Orgánica de Protección de Datos de Carácter Personal
The Organic Law 15/1999 of December 13 on Protection of Personal Data (, LOPD) was Spanish organic law that guaranteed and protected the processing of personal data, public liberties, and fundamental human rights, and especially of personal and family honor and privacy. It was approved by the General Court on December 13, 1999. This law was developed based on Article 18 of the Spanish Constitution of 1978, the familiar and personal right to privacy, and the secrecy of communications. Its main objective was to regulate the treatment of data and files, of  a personal nature, regardless of the support in which they are treated, the rights of citizens over them and the obligations of those who create or treat them. This law affected all data that referred to registered humans on any support, computer or otherwise. Excluded from this regulation are those data collected for domestic use, classified materials of the state and those files that collected data on Terrorism and other forms of organized crime (not simple delinquency). Based on this law, the Spanish Agency for Data Protection was created, at the state level, which ensures compliance with this Law. This  act was repealed by the passage of a new data protection act, the Organic Law 3/2018 of December 5, about protection of personal data and guarantees of digital rights, to conform the Spanish legislation with the General Data Protection Regulation Control bodies and possible sanctions. The body responsible for monitoring compliance with data protection regulations at Spanish territory, in general, is the Spanish Agency for Data Protection (AEPD), The sanctions are divided into three groups depending on the seriousness of the act committed, Spain being the country of the European Union that has the highest sanctions in terms of protection  of data. These sanctions depend on the violation committed. The last company sanctioned has been the company Grupon, sanctioned by the state data protection agency, with 20 000 euros for storing the CVV codes of the Credit cards from their customers without informing them. They are divided into: Despite the amount of sanctions, there are many companies in Spain that have not yet adapted to it, or have done so in a partial manner or do not periodically review its adequacy; so that, maintenance and review of the adequacy carried out is essential. In the public sector, the mentioned Law  also regulates the use and management of information and files with personal data used by all public administrations. The Spanish Agency for Data Protection (AEPD) was created in 1994 in accordance with the provisions of the repealed LORTAD. Its headquarters are located in Madrid, although the Autonomous Communities of Madrid, the Basque Country and Catalonia have created their own autonomous Agencies. Inspection and guardianship of Rights Procedures. Spanish Agency for Data Protection (AEPD). Year 2012. In 2012 complaints filed with the AEPD, increased by 12%. The activity of the Agency has grown significantly in 2012, with an increase of 15 % in the files registered and almost 40% in the resolutions issued. The allegations of identity theft, especially in the supply and commercialization of energy and water (222%) and in telecommunications (92%), have experienced a substantial increase. Of the 863 infringement decisions declared to private managers, more than 34% concluded in a warning, without imposing a penalty. On the other hand, most of the sanctions affect the telecommunications sector, which represents 73% of the total. Three of the main operators accumulate 70.94% of the total amount of fines. Year 2011. In 2011, reported complaints were 51.6% higher than those filed in  2010. This increase is also reflected in the increase in declaratory resolutions of infringement of 37.7%. However, the application of the figure of the warning has determined a decrease of 14.5% in the declared economic sanctions. The sector where sanctions have increased most (64%) and have been declared to a greater extent (25.5%) and amount, (63%) is that of telecommunications. The amount of sanctions has grown by 12% compared to 2010. Year 2009. In 2009 they increased by more than 75% of the complaints received, which reached the figure of 4,136, and the number of requests for protection of rights , by 58%. 709 sanctioning procedures were resolved, of which 621 ended with sanction with a total amount of 24.8 million euros. Source: Memory of the Spanish Agency for Data Protection (AEPD) for the years 2007, 2008, 2009. Year 2008. In 2008 the number of facts reported to the AEPD (together with officio investigations initiated) increased by more than 45%, reaching the value of 2362. AEPD resolved in 2008 a total of 630 sanctioning procedures, almost 58% more than in 2007, of which 535 culminated with the imposition of sanctions. The fines imposed amounted to 22.6 million euros, representing an increase  of 15% over the previous year. The number of procedures solved of declarations of infraction committed by the public administrations rose in 2008 almost 20% with respect to the previous year, going from 66 to 79, of which 59 ended with a declaration of infraction. Year 2007. In 2007 the Spanish Agency for Data Protection resolved 399 sanctioning procedures, increasing by 32.5% with respect to the previous year. The economic sanctions imposed by the AEPD amounted to 19 600 000 euros. Autonomous data protection agencies. Year 2007. The Data Protection Agency of the Community of Madrid carried out 196 inspection  procedures and 32 procedures for the protection of rights in 2007. The Basque Data Protection Agency-Datuak Babesteko Euskal Bulegoa (AVDP-DBEB), resolved 43 complaints and 18 infringement procedures in 2007. Ibero-American Data Protection Network. The Ibero-American Data Protection Network (RIPD), since its creation in 2003, has developed an intense and fruitful work, such as the organization of ten meetings. In addition to contributing to that more than 150 million Latin American citizens currently have, along with the traditional protection of habeas data, rules that allow to effectively guarantee the use of their personal information and specialized authorities  with powers to protect said guarantee. In Latin America policies are being developed for the protection of personal data. In 2012 two new laws were approved. In Nicaragua, Law No. 787 of Protection of Personal Data, of March 29, 2012 and Statutory Law No. 1581 of October 17, 2012, by which general provisions for the Protection of Personal Data are issued. In Chile, also Law 19.628, of August 28, 1999, on Protection of Private Life, is currently in the process of reviewing part of its articles. The National Assembly of Venezuela is processing the bill for the Protection of Personal  Data of Habeas Data. And in Costa Rica there is already a Data Protection Agency of the Republic of Costa Rica, in compliance with the law approved in 2011. Information Duty. Personal data are classified according to their greater or lesser degree of sensitivity, being the legal requirements and computer security measures more stringent in terms of this greater degree of sensitivity, being mandatory on the other hand, in any case the declaration of the data protection files to the "Spanish Agency for Data Protection". Interested parties to which personal data are requested must be previously informed in an express , precise and unambiguous way: 1. The existence of a file or treatment of personal data, the purpose of the collection of these and the recipients of the information. 2. Of the obligatory or optional character of his answer to the questions that are posed to them. 3. The consequences of obtaining the data or the refusal to supply them. 4. Of the possibility of exercising rights of access, rectification, cancellation and opposition. 5. The identity and address of the person responsible for the treatment or, if applicable, his representative. However, the processing of personal data without having been collected directly  from the affected party or interested party is permitted, although it is not exempted from the obligation to report expressly, accurately and unequivocally, by the person responsible for the file or its representative, within of the three months following the start of data processing. Exception: Communication in three months of such information will not be necessary if the data has been collected from "sources accessible to the public", and are intended for advertising or commercial prospecting, in this case "in each communication addressed to the interested party, he will be informed of the origin of the data and the identity  of the person responsible for the treatment, as well as the rights that assist him". This could be a model clause of information / consent of rights protected by the LOPD: Consent. Types of consent. A) Unmistakable consent The treatment of personal data will require the unambiguous consent of the affected party, unless the law provides otherwise. B) Tacit Consent This will be the normal form of consent in cases where an express or express consent is not required in writing. C) Express consent Personal data referring to racial origin, health and sexual life may only be collected, processed and assigned  when, for reasons of general interest, it is provided by a law or the person expressly consents. D) Express and written consent Express consent is required in writing from the affected party regarding data related to ideology, union affiliation, religion and beliefs and may only be transferred with express consent. Data communication. They have responsibility in the communication and treatment of data not only the legal persons (companies) but also freelancers, freelancers, associations, collectives and people who own a blog (bloggers) through from which data from third parties are collected to make queries and for any other transaction. The personal  data object of the treatment can only be communicated to a third party for the fulfillment of purposes directly related to the legitimate functions of the transferor and the transferee with the prior consent of the interested party. The consent required in the previous section will not be precise: The consent for the communication of personal data to a third party will be void when the information provided to the interested party does not allow him to know the purpose to which the data will be destined whose communication is authorized or the type of activity of the person to  whom it is sent. They intend to communicate. The consent for the communication of personal data also has a revocable nature. The one to whom the personal data are communicated is obliged, by the mere fact of the communication, to observe the provisions of this Law. If the communication is made prior to the dissociation procedure, the provisions of the previous sections will not apply. Criticisms and main problems. Certain aspects of the law were declared unconstitutional in November 2000 and deleted from the current text. It is considered that the increase in the creation of files and processing of  personal data affects the right to protection of citizens' data; This concern was picked up by the European bodies that even ordered that January 28 be held annually on "European Data Protection Day". The celebration dates back to 2006, when the Committee of Ministers of the Council of Europe established the annual celebration of the Data Protection Day in Europe on January 28, commemorating the anniversary of the signing of Convention 108 of the Council of Europe for the protection of persons with regard to the automated processing of personal data. A very strict compliance with the regulation on data  protection could slow down the normal work of a File Manager for the documentary accreditation of the information and consent principles of the LOPD; also in the opposite direction, a mere fulfillment of formal obligations, would leave the law senseless and the citizens unprotected and go against the "spirit" of the LOPD. The possibility that companies can collect data without the consent of the affected has been criticized. Certain resolutions of the AEPD have been reason for controversy: Bibliography. Translation of :