Data protection bill adapts Spain to the GDPR

On 10 November 2017 the Council of Ministers approved sending to Parliament the organic bill on the protection of personal data, which will adapt Spanish legislation to a 2016 EU regulation. That regulation will apply from 25 May 2018 and seeks to end the fragmentation of national rules and adapt data protection to rapid technological change and to the phenomena arising from the information society.

According to the official note, the bill’s aims are to increase legal certainty and adapt the rules to technological change. In Spain, where data protection is a fundamental right recognised in article 18.4 of the Constitution, the text introduces novelties in the consent regime, in processing and in the creation of new figures and procedures, which affect any company or professional that handles data on customers, employees or suppliers.

Consent, minors and the deceased

The bill sets at thirteen the age from which a minor can consent to the processing of their data, in line with other countries around us. It rules out tacit consent, which is replaced by an affirmative and express act by the person concerned, and expressly states the duty of confidentiality. If data obtained directly is inaccurate, the controller is not held liable when it has taken all reasonable steps to rectify or erase it.

It also regulates the processing of the data of deceased persons, at the request of their heirs, and maintains the ban on storing special categories of data, such as ideology, trade union membership, religion, sexual orientation, racial or ethnic origin and beliefs. For those categories, the data subject’s consent alone is not enough to make processing viable, a safeguard designed to prevent discriminatory situations.

Rights, officers and specific cases

The text incorporates the principle of transparency in individuals’ right to be informed about the processing of their data and expressly covers the rights of access, rectification, erasure, restriction of processing, portability and objection. It strengthens the role of the data protection officer, an individual or legal entity whose appointment must be notified to the competent authority, and sets up the Spanish Data Protection Agency as an independent administrative authority.

The bill also introduces specific cases: it presumes the prevalence of the controller’s legitimate interest in certain cases, such as credit information systems, and regulates situations of public interest, such as video surveillance, advertising exclusion systems known as Robinson lists, public statistical work and internal whistleblowing in the private sector. These are areas where business practice is very common and where the rules will be clearer.

What to review

The date of application of the regulation, 25 May 2018, is the real deadline: although the bill still has to go through Parliament, the European obligations are already set. It is worth starting now with a data inventory: what personal data your company processes, why, on what legal basis, for how long and who has access, and checking whether existing consents remain valid under the new requirements.

It is also worth reviewing contracts with suppliers that process data on the company’s behalf, procedures for handling individuals’ rights, retention periods and information security, including how to act in the event of a breach. And consider whether you need to appoint a data protection officer. The penalties provided for in the regulation can be high, so it is best to approach the adaptation in good time and with specialist advice.

Data protection stops being a formality and becomes a way of governing the company’s information.

This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.