Data Advocacy for Spain
As a member of the European Union, Spain formally implemented the EU Data Protection Directive 95/46/EC in November 1999 with the Special Data Protection Act 1999 (the ‘Act’, also known as the ‘LOPD’ in Spain). Nevertheless, from 1992, Spain already had a Data Protection Act (‘LORTAD’) that was fully consistent with most of the contents of the EU Data Protection Directive 95/46/EC. The Act, simply represents an up-to-date version of LORTAD, rather than being a major change in the legal framework. Enforcement is through the Spanish Data Protection Commissioner’s Office (‘AEPD’). Its last amendment took place in March 2011.
Law Applicable
The Spanish Data Protection Act No. 15/1999 (“SDPA”), which transposes the Data Protection Directive 95/46/EC into national law.
The Royal Decree No. 1720/2007 (“DPAR”), which approves the regulation implementing the SDPA.
Instruction No. 1/2006 of the Spanish DPA on the processing of Personal Data for surveillance purposes through camera systems.
The Spanish Data Protection Commissioner’s Office (‘AEPD’, standing in Spanish for Agencia Española de Protección de Datos). It is based in Madrid. Regional commissioners may exist as well in certain territories, dealing only with data protection issues of the regional public authorities themselves.
Although there is no blanket requirement in Spain for organisations to appoint a data protection officer as such, organisations handling personal information to which ‘medium’ or ‘high’ security requirements apply shall appoint a Head of Data Security. The Head of Data Security is not in charge of data protection matters in general, but only the security measures to be applied to databases.
As of yet, there is no mandatory requirement in the LOPD to report data security breaches or losses to the AEPD or to data subjects. Nevertheless, the organisation is required to record such incidents in the Security Incidents Ledger. The AEPD is entitled to request to see the Security Incidents Ledger at any time. As a matter of fact, Police Forces and Public Offices do normally immediately report to the AEPD any data breach or loss of personal data they may be informed about (eg when a claim for the theft of a hard disk is filed by the owner). In March 2012, the Spanish General Telecommunications Act was amended to oblige telecommunications operators to rapidly report data breaches to AEPD and to the relevant data subjects. Rumours on the possibility of extending that obligation to other companies have been heard, but this has not happened to date.
Presently, Data Controllers are not generally required either to notify the Spanish DPA or the Data Subjects upon the occurrence of a data security breach.
However, an amendment to the Spanish Telecommunications Act sets forth the obligation to notify the Spanish DPA and the Data Subjects, as applicable, of the occurrence of a data security breach where the Data Controller is an operator providing publicly available electronic communications services.
Notwithstanding any of the above, from an internal perspective, a data security breach or any anomaly which does or might affect data security (“Incident”) must be reported to the Data Security Officer or to the person appointed in the so-called security document drafted by the Data Controller or, where applicable, by the Data Processor. The Data Security Officer (or the appointed person) will then take the proper action to address the Incident and record the following details: (i) kind of Incident; (ii) the time at which it occurred; (iii) the person reporting it; (iv) to whom it was reported; and (v) the effects thereof.
An organization that is involved in a data breach situation may be subject to closure or cancelation of the file, register or database, an administrative fine, penalty or sanction, civil actions, class actions, and/or a criminal prosecution.
Opt-in regime: no direct marketing electronic mail can be legally sent without the express consent of the receiver, unless a pre-existing business or commercial relationship exists. (Consent is however not mandated for marketing to legal persons.)
Also, a specific opt out must be offered with each message. Disguised sender identities are prohibited, and a valid return address must be provided.
The term “Opt-Out Rule” means that the sending of e-marketing to the recipient is permitted on an opt-out basis if:
- the recipient’s details were originally collected “in the context of a sale”.
- the entity sending the marketing is the same legal entity that collected the recipient’s details initially.
- the marketing relates to “similar” products and/or services for which the recipient’s details were originally obtained.
- the recipient is given the opportunity free of charge to object to the e-marketing, both at the time their details were collected and in each subsequent communication.
Applicable Legislation:
Law 34/2002 on information society services and electronic commerce (‘ECA’)
First party e-marketing
(entity that collects the data will send the e-marketing itself)
B2C: Opt-in. Opt-out permitted where Opt-Out Rule applies.
B2B: Opt-in. Opt-out permitted where Opt-Out Rule applies
Third party e-marketing
(entity that collects the data will share with third party partner for e-marketing)
B2C: Opt-in
B2B: Opt-in.
hotmail.es 2331142
yahoo.es 1757957
terra.es 149011
wanadoo.es 46426
outlook.es 24865
gmx.es 24471
ozu.es 14762
teleline.es 8458
orange.es 8420
gmail.es 7770
orangemail.es 6965
telecable.es 6046
arrakis.es 5698
vodafone.es 5444
juntadeandalucia.es 4642
movistar.es 4541
lycos.es 4212
live.es 4184
telefonica.es 4156
aol.es 3545
yahoo.com.es 3236
gva.es 2911
andaluciajunta.es 2865
hotmai.es 2744
msn.es 2624
hotmail.com.es 2594
uv.es 2382
inicia.es 2377
iespana.es 2376
badoo.es 2259
edu.xunta.es 2252
homail.es 2133
us.es 2096
indra.es 2069
usal.es 1918
ugr.es 1891
tiscali.es 1808
unizar.es 1726
comb.es 1702
alumni.uv.es 1675
um.es 1589
myspace.es 1461
supercable.es 1396
ctv.es 1240
hotmal.es 1224
alumni.unav.es 1222
yaho.es 1214
endesa.es 1194
icab.es 1188
uma.es 1184
uco.es 1183
ehu.es 1136
mi.madritel.es 1128
hotmil.es 1109
cajamadrid.es 1108
yahho.es 1084
ya.es 1081
icam.es 1079
arquired.es 1034
ua.es 990
hotmeil.es 990
ahoo.es 969
ciccp.es 958
lacaixa.es 955
alu.ua.es 947
uclm.es 946
uam.es 943
ono.es 941
usc.es 932
uniovi.es 926
uvigo.es 924
aragon.es 911
bankinter.es 900
iberdrola.es 897
uab.es 889
fcc.es 885
unex.es 882
sergas.es 872
acciona.es 861
munimadrid.es 859
uca.es 845
unav.es 839
hotamil.es 822
upm.es 821
jccm.es 821
udc.es 807
correo.ugr.es 803
ull.es 789
deloitte.es 772
jerez.es 755
carm.es 741
htmail.es 721
adif.es 716
jcyl.es 697
ferrovial.es 695
cajamar.es 690
uah.es 684
iies.es 676
educastur.princast.es 671
clinic.ub.es 669
alumnos.uc3m.es 652
yaoo.es 645
notes.banesto.es 644
example.es 644
jet.es 632
iberia.es 615
rtve.es 610
gruposantander.es 605
aena.es 599
urjc.es 597
icav.es 591
tele2.es 590
tragsa.es 583
email.es 571
t-systems.es 568
seacon.es 563
renfe.es 555
elcorteingles.es 537
sescam.jccm.es 535
fomento.es 534
cop.es 522
hotmial.es 520
ujaen.es 509
retemail.es 509
umh.es 499
kpmg.es 497
hormail.es 497
coitt.es 494
seat.es 489
tid.es 487
ual.es 482
upo.es 474
unileon.es 472
coag.es 458
unican.es 454
cruzroja.es 453
yhoo.es 451
cv.gva.es 450
xunta.es 442
alumail.uji.es 435
live.uem.es 432
able.es 425
ubu.es 416
adslmail.es 416
otmail.es 408
cgac.es 402
cfnavarra.es 402
acai-berry.es 400
yahooo.es 395
unavarra.es 394
ieci.es 394
mail.es 390
uib.es 381
dkvseguros.es 379
alumnos.upm.es 372
hayoo.es 363
tecnocom.es 362
hoymail.es 361
correo.cop.es 361
barclays.es 361
libero.es 349
mundivia.es 348
unionradio.es 346
banesto.es 345
hotmaill.es 341
coam.es 338
axa.es 338
sarenet.es 331
hotail.es 328
postal.uv.es 327
htomail.es 327
hotamail.es 327
ej-gv.es 322
ohl.es 319
alum.uca.es 316
mobileemail.vodafone.es 313
ineco.es 313
upvnet.upv.es 309
coit.es 309
coac.es 309
hitmail.es 308
recol.es 307
uem.es 306
tecnicasreunidas.es 306
gemail.es 305
map.es 304
sanitas.es 303
sener.es 302
mcx.es 298
usuarios.retecal.es 297
tinet.fut.es 297
gotmail.es 297
worldonline.es 295
live.com.es 295
yhaoo.es 292
et.mde.es 292
bancaja.es 289
navantia.es 288
ciemat.es 286
micorreo.cai.es 285
caixagalicia.es 285
fremap.es 278
cam.es 275
marca.es 274
yohoo.es 272
isciii.es 272
ine.es 272
antena3tv.es 271
yahool.es 269
once.es 267
estumail.ucm.es 261
salud.aragon.es 260
fn.mde.es 260
hotmsil.es 257
trsa.es 254
agbar.es 253
uji.es 252
ceu.es 250
estudiante.uam.es 249
torres.es 247
comv.es 247
upct.es 246
elmundo.es 244
securitasdirect.es 242
uhu.es 240
altran.es 238
cajasol.es 236
hotnail.es 234
puig.es 232
heineken.es 232
universia.es 230
bde.es 230
alum.us.es 229
rtva.es 228
eic.ictnet.es 228
ree.es 225
red.renault.es 225
mcu.es 225
isban.es 225
orangecorreo.es 224
eoi.es 224
leroymerlin.es 222
ssib.es 220
holmail.es 220
colvet.es 219
halcon-viajes.es 218
nexo.es 215
guardiacivil.es 215
extremadura.es 215
castillalamancha.es 215
rai.usc.es 214
caatvalencia.es 214
esteve.es 213
facebook.es 212
elpais.es 212
ymail.es 211
pas.ucm.es 211
caja-granada.es 211
mtin.es 209
bancopastor.es 209
bajarpeso24.es 209
randstad.es 208
mercuryin.es 206
epi.es 206
campus.uab.es 205
alu.umh.es 205
yell.es 204
hot.es 204
alcampo.es 204
copc.es 202
blackberry.orange.es 201
alu.uclm.es 200
unionfenosa.es 198
colacao.es 198
typsa.es 197
remax.es 197
ea.mde.es 196
asepeyo.es 196
unidadeditorial.es 195
infomed.es 195
excite.es 193
yandex.es 192
rapchile.es 191
madrid.es 191
correu.udg.es 191
industrial.initec.es 190
mityc.es 188
oc.mde.es 187
cespa.es 187
alumno.uned.es 187
manpower.es 186
abc.es 185
cervantes.es 184
dgp.mir.es 183
banif.es 183
mccann.es 181
telecinco.es 180
hotmali.es 180
hotma.es 180
icai.es 179
cbm.uam.es 179
meditex.es 178
imas.imim.es 178
grn.es 178
caser.es 178
uc3m.es 176
navarra.es 176
husa.es 176
etsii.upv.es 176
alumnos.unex.es 176
ing.uc3m.es 175
correos.es 175
pnte.cfnavarra.es 174
icali.es 174
santillana.es 173
sage.es 173
rba.es 173
mail.ono.es 173
kutxa.es 173
elecnor.es 173
racc.es 172
princast.es 172
libertyseguros.es 172
capgemini.es 172
ibermutuamur.es 171
ocaso.es 170
icagr.es 170
cnio.es 170
jotmail.es 169
jahoo.es 169
hachette.es 169
cshg.es 169
ceca.es 168
murcia.es 167
deusto.es 167
ccee.ucm.es 167
sespa.princast.es 166
cir.uic.es 166
recoletos.es 165
steria.es 164
allianz.es 164
humv.es 163
yajoo.es 162
learning.eoi.es 160
isdefe.es 160
reale.es 159
itp.es 159
diba.es 159
comercio.mityc.es 159
coiim.es 158
santpau.es 157
mma.es 157
comerciales.es 157
cajalaboral.es 157
cajaespana.es 156
zaragoza.es 155
inta.es 155
homtail.es 155
wol.es 153
fer.es 153
upv.es 152
michaelpage.es 151
larural.es 151
windowslive.es 150
hotmaol.es 150
sego.es 149
groupama.es 149
eroski.es 149
clientes.euskaltel.es 149
icex.es 148
dipgra.es 148
alumnos.unican.es 148
allianzmed.es 147
erra.es 146
enagas.es 146
edu.jccm.es 146
airnostrum.es 146
epsg.upv.es 145
alu.um.es 144
murciaeduca.es 143
hootmail.es 143
estudiantes.ulpgc.es 142
dival.es 142
andaluciaemprende.es 142
unirioja.es 141
ono.gec.es 141
egmasa.es 141
ati.es 141
servicioficial.es 140
uch.ceu.es 139
fastwebnet.es 139
spibermutuamur.es 138
fjd.es 138
bancopopular.es 138
inia.es 137
auna.es 137
arq.upv.es 137
mpr.es 135
aaa.upv.es 135
tourspain.es 134
pas.uned.es 134
hsll.es 134
vass.es 133
uax.es 133
hotmmail.es 133
gobcantabria.es 133
ucv.es 132
outloo.es 132
imim.es 132
educa.aragon.es 132
tahoo.es 131
rtvv.es 131
opendeusto.es 131
futurnet.es 131
coamalaga.es 131
cajaduero.es 131
alumno.sek.es 131
unique.es 130
mail.fujitsu.es 130
caixacatalunya.es 130
pas.ulpgc.es 129
mediapro.es 129
lineadirecta.es 129
google.es 129
etsid.upv.es 129
campofrio.es 129
ufv.es 128
phonehouse.es 128
hptmail.es 128
ctav.es 128
cofm.es 128
amper.es 128
dipusevilla.es 127
aenor.es 127
ncs.es 126
mercedes-benz.es 126
grupozeta.es 126
fade.es 126
eresmas.es 126
coma.es 126
cam.upv.es 126
sadiel.es 125
ikasle.ehu.es 125
efe.es 125
canon.es 125
alsa.es 125
sigma-tau.es 124
nmisa.es 124
senado.es 123
lavoz.es 123
dipucadiz.es 123
agencia.axa-seguros.es 123
vet.ucm.es 122
ure.es 122
unicaja.es 122
fundaciononce.es 122
viajeseci.es 121
tera.es 121
hottmail.es 121
ceit.es 121
alumnos.urjc.es 121
thaivisa.es 120
citop.es 120
ayesa.es 120
wanado.es 119
outlok.es 119
mpib.es 119
meh.es 119
cecot.es 119
anaya.es 119
saludcastillayleon.es 118
hotmailo.es 118
alcatel-lucent.es 118
prevencionfremap.es 117
parador.es 117
logiccontrol.es 117
etsii.upm.es 117
cemad.es 117
cedex.es 117
estudiantes.unileon.es 116
web.es 115
telemadrid.es 115
generali.es 115
valencia.es 114
tvalmansa.es 114
tsm.es 114
tempe.es 114
qiuy.es 114
jubii.es 114
condenast.es 114
med.ucm.es 113
lasalle.es 113
instanet.es 113
hays.es 113
dsic.upv.es 113
dip-badajoz.es 113
alum.uax.es 113
satec.es 112
badajoz.es 112
almirall.es 112