Data Protection in Spain: Difference between revisions
No edit summary |
(Translated and updated history) |
||
| Line 11: | Line 11: | ||
|English Translation of National Implementation Law:||[n/a English Translation] | |English Translation of National Implementation Law:||[n/a English Translation] | ||
|- | |- | ||
|Official Language(s):||Spanish | |Official Language(s):||Spanish; Regional: Basque, Catalan, Galician | ||
|- | |- | ||
|National Legislation Database(s):||https://www.boe.es/ | |National Legislation Database(s):||https://www.boe.es/ | ||
| Line 20: | Line 20: | ||
|} | |} | ||
The current Spanish Data Protection Act is the [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales' (LOPDGDD)]. | The current Spanish Data Protection Act is the [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales' (LOPDGDD)] (Organic Law 3/2018 regarding the Protection of Personal Data and guarantees of digital rights). | ||
The [[AEPD (Spain)|AEPD]] (''Agencia Española de Protección de Datos'') is the national Data Protection Authority for Spain. | The [[AEPD (Spain)|AEPD]] (''Agencia Española de Protección de Datos'') is the national Data Protection Authority for Spain. | ||
There are three other independent regional data protection authorities in Spain that for the public sector: the [[APDCAT (Catalonia)|Catalan Data Protection Authority]] (''Autoritat Catalana de Protecció de Dades'' or ''Autoridad Catalana de Protección de Datos''), the [[DBEB/AVPD (Basque Country)|Basque Data Protection Authority]] (''Datuak Babesteko Euskal Bulegoa'' or ''Agencia Vasca de Protección de Datos'') and the [[CTPDA (Andalusia)|Andalusian Data Protection Authority]] (''Consejo de Transparencia y Protección de Datos de Andalucía''). | There are three other independent regional data protection authorities in Spain that for the public sector: the [[APDCAT (Catalonia)|Catalan Data Protection Authority]] (''Autoritat Catalana de Protecció de Dades'' or unofficially ''Autoridad Catalana de Protección de Datos''), the [[DBEB/AVPD (Basque Country)|Basque Data Protection Authority]] (''Datuak Babesteko Euskal Bulegoa'' or ''Agencia Vasca de Protección de Datos'') and the [[CTPDA (Andalusia)|Andalusian Data Protection Authority]] (''Consejo de Transparencia y Protección de Datos de Andalucía''). | ||
==Legislation== | ==Legislation== | ||
===History=== | ===History=== | ||
The right to data protection is constitutionally enshrined in art. 18.4 of the [https://www.boe.es/buscar/act.php?id=BOE-A-1978-31229 Spanish Constitution]: "''The law shall limit the use of information technology to guarantee the honour and personal and family intimacy of citizens and the full exercise of their rights''". | |||
Subsequently, the Spanish Constitutional Court, in Judgments [https://hj.tribunalconstitucional.es/en/Resolucion/Show/4276 292/2000] and [https://hj.tribunalconstitucional.es/en/Resolucion/Show/2383 254/1993], confirmed it as an autonomous right, independent of the rights to intimacy [privacy], honour and image, conferring it a broader sphere, not only in terms of the legal object protected, but also because it attributes subjects a range of powers, since the right to data protection guarantees the power to control their data. | |||
Spain is a party to the European Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention No. 108), drawn up in Strasbourg. It was signed on 28 January 1981 and ratified by Spain on the 31 January 1984, entering into force on 1 October 1985. | |||
The first data protection law was [https://www.boe.es/buscar/doc.php?id=BOE-A-1992-24189 Ley Orgánica 5/1992, de 29 de octubre, de regulación del tratamiento automatizado de los datos de carácter personal] (Organic Law 5/1992 of 29 October 1992 on the Regulation of the Automated Processing of Personal Data) (LORTAD), which defined the basic principles and recognised the legal protection of the constitutional right. Its late drafting was positive as it was able to pick up aspects from other countries, although it contemplated several exceptions. | |||
Following [https://eur-lex.europa.eu/eli/dir/1995/46/oj Directive 95/46/EC], the [https://boe.es/buscar/doc.php?id=BOE-A-1999-23750 Ley Orgánica de Protección de Datos de Carácter Personal] (Organic Law on Data Protection) (LOPD) was enacted in 1999, which has been fully applicable until the entry into force of the GDPR. In 2018 the new ''Ley Orgánica de Protección de Datos Personales y garantía de los derechos digitales'' came into force and three years later the [https://boe.es/buscar/act.php?id=BOE-A-2021-8806 Ley Orgánica 7/2021, de 26 de mayo, de protección de datos personales tratados para fines de prevención, detección, investigación y enjuiciamiento de infracciones penales y de ejecución de sanciones penales] (Organic Law 7/2021 of 26 May on the protection of personal data processed for the purposes of the prevention, detection, investigation and prosecution of criminal offences and the execution of criminal penalties), that transposes [https://eur-lex.europa.eu/eli/dir/2016/680/oj Directive 2016/680]. | |||
===National constitutional protections=== | ===National constitutional protections=== | ||
Revision as of 16:56, 6 July 2022
| Data Protection in Spain | |
|---|---|
 | |
| Data Protection Authority: | AEPD (Spain) |
| National Implementation Law (Original): | Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales |
| English Translation of National Implementation Law: | [n/a English Translation] |
| Official Language(s): | Spanish; Regional: Basque, Catalan, Galician |
| National Legislation Database(s): | https://www.boe.es/ |
| English Legislation Database(s): | n/a |
| National Decision Database(s): | http://www.poderjudicial.es/search/index.jsp |
The current Spanish Data Protection Act is the Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales' (LOPDGDD) (Organic Law 3/2018 regarding the Protection of Personal Data and guarantees of digital rights).
The AEPD (Agencia Española de Protección de Datos) is the national Data Protection Authority for Spain.
There are three other independent regional data protection authorities in Spain that for the public sector: the Catalan Data Protection Authority (Autoritat Catalana de Protecció de Dades or unofficially Autoridad Catalana de Protección de Datos), the Basque Data Protection Authority (Datuak Babesteko Euskal Bulegoa or Agencia Vasca de Protección de Datos) and the Andalusian Data Protection Authority (Consejo de Transparencia y Protección de Datos de Andalucía).
Legislation
History
The right to data protection is constitutionally enshrined in art. 18.4 of the Spanish Constitution: "The law shall limit the use of information technology to guarantee the honour and personal and family intimacy of citizens and the full exercise of their rights".
Subsequently, the Spanish Constitutional Court, in Judgments 292/2000 and 254/1993, confirmed it as an autonomous right, independent of the rights to intimacy [privacy], honour and image, conferring it a broader sphere, not only in terms of the legal object protected, but also because it attributes subjects a range of powers, since the right to data protection guarantees the power to control their data.
Spain is a party to the European Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention No. 108), drawn up in Strasbourg. It was signed on 28 January 1981 and ratified by Spain on the 31 January 1984, entering into force on 1 October 1985.
The first data protection law was Ley Orgánica 5/1992, de 29 de octubre, de regulación del tratamiento automatizado de los datos de carácter personal (Organic Law 5/1992 of 29 October 1992 on the Regulation of the Automated Processing of Personal Data) (LORTAD), which defined the basic principles and recognised the legal protection of the constitutional right. Its late drafting was positive as it was able to pick up aspects from other countries, although it contemplated several exceptions.
Following Directive 95/46/EC, the Ley Orgánica de Protección de Datos de Carácter Personal (Organic Law on Data Protection) (LOPD) was enacted in 1999, which has been fully applicable until the entry into force of the GDPR. In 2018 the new Ley Orgánica de Protección de Datos Personales y garantía de los derechos digitales came into force and three years later the Ley Orgánica 7/2021, de 26 de mayo, de protección de datos personales tratados para fines de prevención, detección, investigación y enjuiciamiento de infracciones penales y de ejecución de sanciones penales (Organic Law 7/2021 of 26 May on the protection of personal data processed for the purposes of the prevention, detection, investigation and prosecution of criminal offences and the execution of criminal penalties), that transposes Directive 2016/680.
National constitutional protections
Art. 18.4 CE "La ley limitará el uso de la informática para garantizar el honor y la intimidad personal y familiar de los ciudadanos y el pleno ejercicio de sus derechos". Este artículo se encuentra dentro del Capítulo II de la Sección I del Título I de la Constitución, por lo que se le confieren prerrogativas constitucionales reforzadas, como la necesidad de ser desarrollado su contenido esencial por Ley Orgánica (artículo 81 CE), pudiendo recabar los ciudadanos la tutela jurisdiccional sumaria y preferente sin necesidad de que se haya desarrollado legislativamente, además de vincular a todos los poderes públicos (Art. 53 CE).
National GDPR implementation law
In Spain the GDPR is developed by the Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).
Age of consent
Article 7(2) LOPDGDD states that the minimum age for consent in Spain is 14 years old.
Freedom of Speech
You can help us fill this section!
Employment context
You can help us fill this section!
Research
You can help us fill this section!
Other relevant national provisions and laws
You can help us fill this section!
National ePrivacy Law
You can help us fill this section!
Data Protection Authority
The Spanish Data Protection Authority (Agencia Española de Protección de Datos) is the national data protection authority for Spain.
→ Details see AEPD (Spain)
Para la protección de datos del sector público en País Vasco, Cataluña y Andalucía existe una autoridad concreta, así como para el tratamiento de los datos jurisdiccionales, que es llevada por el Consejo General del Poder Judicial.
Cataluña [1]
País Vasco [2]
Andalucía [3]
CGPJ [4]
Judicial protection
Contra las resoluciones que ponen fin a la vía administrativa (48.6 LOPDGDD), se podrá interponer (Art. 123 de la 39/2015), potestativamente, recurso de reposición ante la Directora de la Agencia Española de Protección de Datos en el plazo de un mes a contar desde el día siguiente a la notificación de esta resolución o directamente recurso contencioso administrativo ante la Sala de lo Contencioso-administrativo de la Audiencia Nacional (Art. 25 y DA4º. 5 Ley 29/1998) en el plazo de dos meses a contar desde el día siguiente a la notificación de este acto, según lo previsto en el artículo 46.1 de la referida Ley.
Constitutional Court
El Tribunal Constitucional puede actuar en amparo para la tutela del derecho de protección de datos contenido en el art. 18.4 CE
