Personal data protection and digital rights

FELIPE VI

KING OF SPAIN

To all who see and understand the present.

Know: That the General Courts have passed and I come to sanction the following organic law.

PREAMBLE

I

The protection of natural persons in relation to the processing of personal data is a fundamental right protected by the Article 18.4 of the Spanish Constitution. This way, our Constitution was a pioneer in the recognition of the fundamental right to the protection of personal data when it provided that "the law shall limit the use of computer science to guarantee the honour and personal and family privacy of citizens and the full exercise of their rights". This reflected the work carried out since the late 1960s in the Council of Europe and the few legal provisions adopted in countries around us.

The Constitutional Court stated in its Judgment 94/1998 of 4 May that we are faced with a fundamental right to data protection which guarantees the person control over his or her data, any personal data, and his or her use and destination, in order to prevent illicit trafficking in such data or harmful to the dignity and rights of the persons concerned; thus, the right to data protection is set up as a power of the citizen to oppose the use of certain personal data for purposes other than that which justified their acquisition. For its part, in the Judgment 292/2000, 30 Novemberconsiders it as an autonomous and independent right consisting of a power of disposition and control over personal data that empowers the person to decide which of these data to provide to a third party, whether the State or a private individual, or which third party may collect, and that also allows the individual to know who owns such personal data and for what, being able to oppose such possession or use.

At the legislative level, the realization and development of the fundamental right of protection of natural persons in relation to the processing of personal data took place in its origins through the approval of the Organic Law 5/1992 of 29 October 1992, regulating automated processing of personal data, known as LORTAD. The Organic Law 5/1992 was replaced by the Organic Law 15/1999 of 13 December 1999protection of personal data, in order to transpose our right to Directive 95/46/EC of the European Parliament and the Council of 24 October 1995on the protection of individuals with regard to the processing of personal data and the free movement of such data. This organic law was a second milestone in the evolution of the regulation of the fundamental right to data protection in Spain and was complemented by an increasing amount of case law from the organs of the administrative and contentious jurisdiction.

It is also reflected in Article 8 of the Treaty on European Union. Charter of Fundamental Rights of the European Union and in Article 16(1) of the Treaty on the Functioning of the European Union. Previously, at European level, the Directive 95/46/EC the purpose of the proposal was to ensure that the guarantee of the right to protection of personal data did not constitute an obstacle to the free movement of data within the Union, thereby establishing a common area of guarantee of the right which, at the same time, ensured that in the event of international data transfer, the processing of data in the country of destination was protected by safeguards appropriate to those provided for in the Directive itself.

II

In the last few years of the last decade, efforts have been stepped up to achieve a more uniform regulation of the fundamental right to data protection within the framework of an increasingly globalized society. Proposals for the reform of the existing framework have thus been adopted in various international bodies. In this context, the Commission launched on 4 November 2010 its Communication entitled ‘A comprehensive approach to the protection of personal data in the European Union’, which is the seed of the subsequent reform of the European Union framework. At the same time, the Court of Justice of the Union has been adopting over the last few years jurisprudence which is fundamental in its interpretation.

The last milestone in this development took place with the adoption of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016on the protection of individuals with regard to the processing of their personal data and the free movement of such data and repealing the Directive 95/46/EC (General Data Protection Regulation) as well as the Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016on the protection of natural persons with regard to the processing of personal data by the competent authorities for the purposes of preventing, investigating, detecting or prosecuting criminal offences or enforcing criminal sanctions, and on the free movement of such data and repealing Council Framework Decision 2008/977/JHA.

III

The general data protection regulation aims directly to overcome the obstacles to the harmonisation of the Directive 95/46/EC of the European Parliament and the Council of 24 October 1995on the protection of individuals with regard to the processing of personal data and the free movement of such data. The transposition of the directive by the Member States has resulted in a regulatory patchwork with irregular profiles throughout the European Union, which has ultimately led to significant differences in the protection of citizens' rights.

It also addresses new circumstances, notably the increase in cross-border flows of personal data as a result of the functioning of the internal market, the challenges posed by rapid technological developments and globalisation, which have made personal data the fundamental resource of the information society. The centrality of personal information has positive aspects, because it allows for new and better services, products or scientific findings. But it also has risks, as information about individuals is multiplied exponentially, is more accessible, by more actors, and is becoming easier to process while control of their destination and use is more difficult.

The General Data Protection Regulation requires a review of the legal bases of the European data protection model beyond merely updating the existing legislation. It should strengthen legal certainty and transparency while allowing its rules to be specified or restricted by Member States' law to the extent necessary for reasons of consistency and to make national provisions understandable to its addressees. Thus, the General Data Protection Regulation contains a good number of ratings, if not impositions, to Member States in order to regulate certain matters, even allowing, in recital 8, and unlike what constitutes a general principle of European Union law, where its rules must be specified, interpreted or, exceptionally, restricted by the law of the Member States, they have the possibility to incorporate into national law provisions specifically contained in the Regulation, to the extent necessary for reasons of consistency and understanding.

It should be stressed here that all intervention in the fields covered by European regulations is not excluded from national law. On the contrary, such intervention may be necessary, even if necessary, both for the purposes of cleansing national legislation and for the development or supplementation of the regulation in question. Thus, the principle of legal certainty, in its positive aspect, obliges Member States to integrate European law into national law in a sufficiently clear and public way to enable it to be fully known both by legal operators and by the citizens themselves, whereas, in its negative aspect, it implies an obligation for those States to eliminate situations of uncertainty arising from the existence of rules in national law incompatible with European law. The second aspect of this is the consequent obligation to clean up the legal system. In conclusion, the principle of legal certainty requires that domestic legislation which is incompatible with European Union law be definitively eliminated ‘by means of binding internal provisions having the same legal value as the internal provisions which need to be amended’ (Case Commission v Commission of 23 February 2006 (Case C-364/00 Commission v Commission). Spain; of 13 July 2000, Commission v. France; and of 15 October 1986, Commission v. Italy). Finally, regulations, despite their characteristic direct applicability, may in practice require additional internal rules to fully implement them. In this respect, rather than incorporating it, we could talk about 'development' or complementing European Union law.

The adaptation to the General Data Protection Regulation, which will apply from 25 May 2018, as set out in Article 99, requires, in sum, the elaboration of a new organic law to replace the current one. This work has preserved the principles of good regulation, since it is a necessary rule for the adaptation of Spanish law to the aforementioned European provision and proportional to this objective, and its ultimate reason is to seek legal certainty.

IV

The Internet, on the other hand, has become an omnipresent reality in both our personal and collective lives. A large part of our professional, economic and private activity is carried out on the Network and acquires a fundamental importance for both human communication and the development of our life in society. Already in the 1990s, and aware of the impact that the Internet would have on our lives, the pioneers of the Network proposed to elaborate a Declaration of the Rights of Man and the Citizen on the Internet.

Today, we identify quite clearly the risks and opportunities that the world of networks offers to citizens. It is up to the public authorities to promote policies that give effect to the rights of citizens on the Internet by promoting the equality of citizens and the groups in which they are integrated in order to enable the full exercise of fundamental rights in the digital reality. The digital transformation of our society is already a reality in our present and future development at both the social and economic levels. In this context, countries around us have already adopted regulations that strengthen the digital rights of citizens.

The constituents of 1978 already sensed the enormous impact that technological advances would have on our society and, in particular, on the enjoyment of fundamental rights. A desirable future reform of the the Constitution should include in its priorities the updating of the Constitution to the digital age and, specifically, to raise to constitutional rank a new generation of digital rights. But, as long as this challenge is not met, the legislator must address the recognition of a system of guaranteeing digital rights which, unequivocally, finds its anchor in the mandate imposed by the fourth paragraph of the Article 18 of the Spanish Constitution and that, in some cases, they have already been shaped by ordinary, constitutional and European jurisprudence.

V

This organic law consists of ninety-seven articles structured into ten titles, twenty-two additional provisions, six transitional provisions, one derogation provision and sixteen final provisions.

Title I, on general provisions, begins by regulating the object of the organic law, which is, as indicated above, twofold. The first aim is to bring the Spanish legal system into line with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016General Data Protection Regulation, and supplement its provisions. It also establishes that the fundamental right of natural persons to the protection of personal data, protected by the Article 18.4 of the Constitutionshall be exercised in accordance with the Regulation (EU) 2016/679 and in this organic law. The Autonomous Communities have competence to develop regulations and implement the fundamental right to the protection of personal data in their field of activity, and the autonomous data protection authorities that are believed to be responsible for helping to guarantee this fundamental right of citizenship. Secondly, it is also the object of the law to guarantee the digital rights of citizens, under the provisions of the Convention. Article 18.4 of the Constitution.

It highlights the novel regulation of data concerning deceased persons, since, after excluding from the scope of the law their treatment, it is allowed that persons linked to the deceased for family or de facto reasons or their heirs may request access to them, as well as their rectification or deletion, if necessary subject to the instructions of the deceased. It also excludes from the scope treatments governed by specific provisions, inter alia, rules transposing that provision. Directive (EU) 2016/680the fourth transitional provision provides for the application to these treatments of Organic Law 15/1999 of 13 December 1999until the above-mentioned legislation is adopted.

Title II ‘Data protection principles’ provides that for the purposes of Regulation (EU) 2016/679 The controller shall not be liable to the controller, provided that the controller has taken all reasonable measures to ensure that the data obtained directly from the controller is deleted or rectified without delay, where the controller has received the data from another controller by virtue of the exercise by the controller of the right to portability, or where the controller obtains it from the mediator or intermediary where the rules applicable to the sector of activity to which the controller belongs provide for the possibility of intervention by an intermediary or mediator or where the data has been obtained from a public register. The obligation of confidentiality, the processing of data protected by law, the special categories of data and the processing of data of a criminal nature are also expressly mentioned, and consent is specifically referred to, which is to proceed from a declaration or from a clear affirmative action of the affected person, excluding what was known as "unclusive consent", it is indicated that the consent of the affected person for a plurality of purposes will need to be specifically and unambiguously stated for all purposes, and the age at which the consent of the minor may be given is kept at fourteen years.

It also regulates the possible legal authorizations for treatment based on the fulfilment of a legal obligation imposed on the person responsible, as provided for in the Regulation (EU) 2016/679where this is provided for by a rule of European Union law or by law, which may determine the general conditions of processing and the types of data subject to it, as well as the assignments resulting from the fulfilment of the legal obligation, This is the case, for example, of databases regulated by law and managed by public authorities which meet specific objectives of risk control and solvency, supervision and inspection of the type of the Banco de España Risk Information Centre regulated by the Law 44/2002 of 22 November 2002, of Measures to Reform the Financial System, or of the data, documents and information of a reserved nature held by the Directorate-General for Insurance and Pension Funds in accordance with the provisions of Law 20/2015 of 14 July, of management, supervision and solvency of insurance and reinsurers.

Special conditions may also be imposed on treatment, such as the adoption of additional security measures or other measures, where this results from the exercise of public powers or from the fulfilment of a legal obligation and may be considered to be based only on the performance of a mission carried out in the public interest or the exercise of public powers conferred on the person responsible, as provided for in the European regulation, where it results from a competence conferred by law. The prohibition on consenting to processing is maintained for the main purpose of storing identifying information of certain categories of data which are specially protected, which does not prevent them from being processed in the other cases provided for in the Regulation (EU) 2016/679. Thus, for example, the provision of consent will not cover the creation of 'blacklists' of trade unionists, although union membership data may be processed by the employer to enable the exercise of workers' rights under Article 9.2(b) of the Convention. Regulation (EU) 2016/679 or by the trade unions themselves in the terms of Article 9.2(d) of the same European standard.

Also in relation to the processing of special categories of data, article 9.2 establishes the principle of the reservation of law for their empowerment in the cases provided for in article 9.2. Regulation (EU) 2016/679. This provision not only extends to future provisions but also allows for the protection of the various existing legal qualifications, as specifically indicated in the 17th Additional Provision, with regard to health and insurance legislation. The General Data Protection Regulation does not affect such ratings, which remain fully in force, even allowing extensive interpretation of them, as is the case, in particular, with regard to the extent of the consent of the data subject or the use of his data without consent in the field of biomedical research. To this end, paragraph 2 of the 17th Additional Provision introduces a series of forecasts aimed at ensuring the proper development of health research, in particular biomedical research, taking into account the undoubted benefits it brings to society with due guarantees of the fundamental right to data protection.

Title III, devoted to the rights of individuals, adapts to Spanish law the principle of transparency in the treatment of the European regulation, which regulates the right of those concerned to be informed about the processing and contains the so-called "layered information" already generally accepted in areas such as video surveillance or the installation of mass data storage devices (such as cookies), providing the person concerned with basic information, although indicating an electronic address or other means to allow easy and immediate access to the remaining information.

This Title makes use of the enablement allowed by recital 8 of the Regulation (EU) 2016/679 to supplement its regime, ensuring the proper systematic structure of the text. The organic law then provides for rights of access, rectification, suppression, opposition, right to limitation of treatment and right to portability.

Title IV sets out ‘Provisions applicable to specific treatments’, incorporating a series of assumptions that should not in any case be considered exhaustive of all licit treatments. They include, first of all, those for which the legislator establishes a presumption ‘iuris tantum’ of the prevalence of the legitimate interest of the controller when carried out with a number of requirements, which does not exclude the lawfulness of such treatments when the conditions laid down in the text are not strictly complied with, although in this case the controller must carry out the legally enforceable weighting, since the prevalence of his legitimate interest is not presumed to be the case. In addition to these cases, other cases, such as video surveillance, advertising exclusion files or internal complaints systems in which the lawfulness of the treatment comes from the existence of a public interest, as set out in Article 6.1.e of the Convention, are included. Regulation (EU) 2016/679. Finally, reference is made in this Title to the lawfulness of other treatments regulated in Chapter IX of the regulations, such as those related to the statistical function or for purposes of archiving of general interest. In any event, the fact that the legislator refers to the lawfulness of treatment does not undermine the obligation of those responsible to take all measures of active responsibility set out in Chapter IV of the European Regulation and Title V of this organic law.

Title V refers to the controller and processor. It should be borne in mind that the most recent development of the Regulation (EU) 2016/679 is the evolution of a model based primarily on the control of compliance to another based on the principle of active responsibility, which requires a prior assessment by the controller or the controller of the risk that could generate the processing of personal data in order to, on the basis of that assessment, take the appropriate measures. In order to clarify these developments, the organic law retains the same name as Chapter IV of the Regulation, dividing the article into four chapters devoted, respectively, to the general measures of active responsibility, to the regime of the controller, to the figure of the data protection delegate and to the mechanisms of self-regulation and certification. The figure of the data protection delegate is of particular importance in the Regulation (EU) 2016/679 This is reflected in the organic law, which starts from the principle that it may be compulsory or voluntary, be integrated or not integrated into the organization of the person responsible or responsible and be both a natural person and a legal person. The designation of the data protection delegate shall be communicated to the competent data protection authority. The Spanish Data Protection Agency will maintain a public and updated relationship of data protection delegates, accessible by any person. Knowledge in this field may be demonstrated through certification schemes. It may also not be removed except in cases of serious misconduct or negligence. It should be noted that the data protection delegate is able to set up a means for the amicable resolution of complaints, since the data subject may reproduce before him a complaint that is not addressed by the controller or processor.

Title VI, on international data transfers, adapts to the provisions of the Convention. Regulation (EU) 2016/679 and refers to specialities related to procedures through which data protection authorities may approve contractual models or binding corporate rules, situations of authorisation of a particular transfer, or prior information.

Title VII is devoted to data protection authorities, which, following the mandate of Regulation (EU) 2016/679 to be established by national law. In keeping with the scheme that was being collected in its normative history, the organic law regulates the regime of the Spanish Data Protection Agency and reflects the existence of the autonomous data protection authorities and the necessary cooperation between the supervisory authorities. The Spanish Data Protection Agency is set up as an independent administrative authority under the Law 40/2015 of 1 October, of the Public Sector Legal Regime, which relates to the Government through the Ministry of Justice.

Title VIII regulates ‘Procedures in the event of a possible breach of data protection rules’. The Regulation (EU) 2016/679 establishes a new and complex system, evolving towards a ‘one-stop shop’ model in which there is a principal supervisory authority and other interested authorities. A cooperation procedure is also established between Member State authorities and, in the event of a discrepancy, the binding decision of the European Data Protection Committee is provided for. Consequently, prior to the processing of any procedure, it will be necessary to determine whether or not the processing is cross-border in nature and, if so, which data protection authority is to be considered principal.

The regulation is limited to delimiting the legal regime; the initiation of procedures, being possible for the Spanish Data Protection Agency to refer the complaint to the data protection delegate or to the bodies or entities responsible for the extrajudicial resolution of conflicts as set out in a code of conduct; the non-admissibility of complaints; prior investigative proceedings; provisional measures, including the order to block the data; and the time-limit for processing the proceedings and, where appropriate, their suspension. The specialities of the procedure refer to the regulatory development.

Title IX, which provides for the sanctioning regime, states that the Regulation (EU) 2016/679 establishes a system of sanctions or corrective actions which allows for a wide margin of discretion. In this context, the organic law describes typical behaviours, making the distinction between very serious, serious and minor offences, taking into account the differentiation that the General Data Protection Regulation establishes when setting the level of penalties. The categorization of infringements is introduced for the sole purpose of determining the limitation periods, with the description of the typical conduct as the sole object of the enumeration of some of the punishable acts to be understood as falling within the general types laid down in the European standard. The organic law regulates the cases of interruption of the statute of limitations based on the constitutional requirement of knowledge of the facts that are imputed to the person, but taking into account the problems arising from the procedures established in the European regulation, depending on whether the procedure is handled exclusively by the Spanish Data Protection Agency or if it is followed the coordinated procedure of Article 60 of the General Data Protection Regulation.

The Regulation (EU) 2016/679 establishes broad margins for the determination of the amount of sanctions. The organic law takes advantage of the residual clause in Article 83(2) of the European standard, referring to aggravating or mitigating factors, to clarify that the elements to be taken into account may include those already contained in Article 45(4) and (5) of the Treaty. Organic Law 15/1999, and which are known to legal operators.

Finally, Title X of this law undertakes the task of recognizing and guaranteeing a list of digital rights of citizens in accordance with the mandate set out in the Constitution. In particular, the rights and freedoms that can be preached to the Internet environment such as the neutrality of the Network and universal access or the rights to security and digital education as well as the rights to forgetfulness, portability and the digital will are regulated. The recognition of the right to digital disconnection within the framework of the right to privacy in the use of digital devices in the workplace and the protection of minors on the Internet is of importance. Finally, the guarantee of freedom of expression and the right to clarification of information in digital media are noteworthy.

The additional provisions cover issues such as security measures in the public sector, data protection and transparency and access to public information, time-limits, judicial authorization for international data transfers, protection against abusive practices that may be developed by certain operators, and health data processing, among others.

In accordance with the 14th additional provision, the rules on derogations and limitations on the exercise of rights which would have entered into force before the date of application of the European Regulation, and in particular the Articles 23 and 24 of Organic Law 15/1999 of 13 December 1999, of Personal Data Protection, will remain in force as long as it is not expressly modified, replaced or repealed. The continuation of this legislation implies the continuity of the exceptions and limitations contained therein until its reform or abrogation takes place, even if they relate to the rights as they are regulated in the Regulation (EU) 2016/679 and in this organic law. Thus, for example, under that additional provision, the tax administrations responsible for the data files with tax significance referred to in Article 3 of the Directive are responsible for the tax Article 95 of Law 58/2003 of 17 December, General Taxation, may, in relation to such data, refuse the exercise of the rights referred to in Articles 15 to 22 of Regulation (EU) 2016/679where it impedes administrative action to ensure compliance with tax obligations and, in any event, where the person concerned is being subject to inspection proceedings.

The transitional provisions concern, among other things, the status of the Spanish Data Protection Agency, the transitional regime of procedures or treatments submitted to the Directive (EU) 2016/680. A derogation is included and the final provisions on the precepts as ordinary law, the title of jurisdiction and the entry into force are set out below.

The necessary amendments to the Law 1/2000 of 7 Januaryof Civil Prosecution and the Act 29/1998 of 13 July 1998the regulation of the administrative and administrative jurisdiction, the Organic Law, 6/1985, of 1 July, of the judiciary, the Law 19/2013 of 9 December 2013transparency, access to public information and good governance, Organic Law 5/1985 of 19 June 1985of the General Electoral Regime, the Law 14/1986 of 25 AprilGeneral de Sanidad, la Law 41/2002 of 14 November 2002, basic regulation of patient autonomy and rights and obligations in the field of clinical information and documentation and Law 39/2015 of 1 October 2015the Common Administrative Procedure of the Public Administrations.

Finally, with regard to the guarantee of digital rights, changes are also made to the Organic Law 2/2006 of 3 May, of Education, the Organic Law 6/2001 of 21 December 2001, of universities, as well as in the Consolidated text of the Workers' Statute Act and in the Consolidated Text of the Basic Staff Regulations Act.

TITLE I

General provisions

Article 1. Subject matter of the law.

The purpose of this organic law is to:

(a) To adapt the Spanish legal system to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016on the protection of individuals with regard to the processing of their personal data and the free movement of such data, and to supplement its provisions.

The fundamental right of natural persons to the protection of personal data, protected by Article 18.4 of the Constitutionshall be exercised in accordance with the Regulation (EU) 2016/679 and in this organic law.

(b) Ensuring the digital rights of citizenship in accordance with the mandate set out in the Article 18.4 of the Constitution.

Article 2. Scope of Titles I to IX and Articles 89 to 94.

1. The provisions of Titles I to IX and Articles 89 to 94 of this Organic Law apply to any processing of personal data wholly or partially automated, as well as to the non-automated processing of personal data contained or intended to be included in a file.

2. This organic law shall not apply to:

(a) the processing excluded from the scope of the General Data Protection Regulation by Article 2.2 thereof, without prejudice to paragraphs 3 and 4 of this Article;

(b) The processing of data from deceased persons, without prejudice to Article 3.

(c) Treatments subject to the rules on the protection of classified materials.

3. Treatments not directly applicable to Regulation (EU) 2016/679 by affecting activities not falling within the scope of the law of the European Union, they shall be governed by the provisions of their specific legislation, if any, and, in addition, by the provisions of that Regulation and of this Organic Law. This situation includes, inter alia, the treatment carried out under the organic legislation of the general electoral system, the treatment of prisons and the treatment of civil registration, property and commercial registers.

4. The processing of data carried out during the processing by the judicial bodies of the proceedings of which they are competent, as well as that carried out within the management of the Judicial Office, shall be governed by the provisions of the Regulation (EU) 2016/679 and the present organic law, without prejudice to the provisions of Organic Law 6/1985 of 1 Julyof the Judiciary, which shall apply to it.

5. The processing of data carried out in connection with the processing by the Public Prosecutor ' s Office of the processes for which it is responsible, as well as that carried out for those purposes within the management of the Public Prosecutor ' s Office, shall be governed by the provisions of the Regulation (EU) 2016/679 and the present Organic Law, without prejudice to the provisions of the Law 50/198 of 30 December 1981regulation of the Organic Statute of the Public Prosecutor's Office Organic Law 6/1985 of 1 Julythe judiciary and the rules of procedure applicable to it.

Paragraph 5 is added by final provision 4.1 of Organic Law 7/2021 of 26 May. Ref. BOE-A-2021-8806

Article 3. Data on deceased persons.

1. Persons linked to the deceased for family or de facto reasons, as well as his heirs, may contact the controller or processor for the purpose of requesting access to the personal data of the deceased and, where appropriate, rectification or deletion thereof.

By way of exception, the persons referred to in the preceding paragraph shall not have access to the data of the deceased, nor shall they request its rectification or deletion, if the deceased has expressly prohibited it or is established by law. Such prohibition shall not affect the right of the heirs to access data of a material nature of the deceased.

2. Persons or institutions to which the deceased has expressly designated for this purpose may also request, on the basis of the instructions received, access to the personal data of the deceased and, where appropriate, rectification or deletion thereof.

The royal decree shall establish the requirements and conditions for proving the validity and validity of these mandates and instructions and, where appropriate, the registration thereof.

3. In the event of the death of minors, these powers may also be exercised by their legal representatives or, within their competence, by the Public Prosecutor's Office, which may act on its own initiative or at the request of any natural or legal person concerned.

In the event of the death of persons with disabilities, these powers may also be exercised, in addition to those referred to in the preceding paragraph, by those who have been appointed to support functions, if such powers are understood to fall within the support measures provided by the designated person.

TITLE II

Data protection principles

Article 4. Accuracy of data.

1. In accordance with Article 5.1(d) of the Regulation (EU) 2016/679 the data shall be accurate and, if necessary, updated.

2. For the purposes of Article 5.1(d) of the Regulation (EU) 2016/679the controller shall not be liable, provided that the controller has taken all reasonable measures to ensure that the personal data is deleted or rectified without delay, for the purposes for which they are processed, where the inaccurate data:

(a) They would have been obtained by the person directly responsible for the person concerned.

(b) They would have been obtained by the person responsible for a mediator or intermediary if the rules applicable to the sector of activity to which the controller belongs provided for the possibility of intervention by an intermediary or mediator who collects the data of the persons concerned on his own behalf for transmission to the controller. The mediator or intermediary shall assume the responsibilities that may arise in the case of communication to the data controller that do not correspond to those provided by the data subject.

(c) They were treated by the person responsible for having received them from another person responsible by virtue of the exercise by the person concerned of the right to portability under article 20 of the Convention. Regulation (EU) 2016/679 and the provisions of this organic law.

(d) They were obtained from a public register by the person responsible.

Article 5. Duty of confidentiality.

1. Data controllers and controllers as well as all persons involved at any stage of data processing shall be subject to the duty of confidentiality referred to in Article 5.1.f of the Convention. Regulation (EU) 2016/679.

2. The general obligation referred to in the preceding paragraph shall be complementary to the duties of professional secrecy in accordance with its applicable rules.

3. The obligations set out in the preceding paragraphs shall be maintained even if the relationship of the obligor with the controller or processor has been terminated.

Article 6. Treatment based on the consent of the affected person.

1. In accordance with Article 4.11 of the Regulation (EU) 2016/679the consent of the person concerned means any expression of free, specific, informed and unequivocal will by which the person accepts, either through a declaration or a clear affirmative action, the processing of personal data concerning him or her.

2. Where the processing of the data is intended to be based on the consent of the affected person for a plurality of purposes, it shall be specified and unambiguously stated that such consent is granted to all of them.

3. The performance of the contract shall not be subject to consent by the party concerned to the processing of personal data for purposes unrelated to the maintenance, development or control of the contractual relationship.

Article 7. Consent of children.

1. The processing of the personal data of a minor may be based on his consent only when he is over fourteen years of age.

Except for cases where the law requires the assistance of the holders of parental authority or guardianship for the conclusion of the legal act or business in which the consent for the treatment is sought.

2. The processing of data on children under fourteen years of age, based on consent, shall be lawful only if it consists of that of the holder of parental authority or guardianship, with the scope determined by the holders of parental authority or guardianship.

Article 8. Processing of data by legal obligation, public interest or the exercise of public authorities.

1. The processing of personal data may be considered to be based only on the fulfilment of a legal obligation incumbent on the controller, as provided for in Article 6.1(c) of the Convention. Regulation (EU) 2016/679where this is provided for by a rule of European Union law or by a rule of law, which may determine the general conditions of processing and the types of data covered by it, as well as the assignments that proceed as a result of the fulfilment of the legal obligation. This rule may also impose special conditions on treatment, such as the adoption of additional safety measures or other measures laid down in Chapter IV of the Convention. Regulation (EU) 2016/679.

2. The processing of personal data may be considered to be based only on the performance of a mission carried out in the public interest or on the exercise of public powers conferred on the controller, as provided for in Article 6.1(e) of the Regulation (EU) 2016/679, where it derives from jurisdiction conferred by a rule of law.

Article 9. Special categories of data.

1. For the purposes of Article 9.2(a) of the Regulation (EU) 2016/679in order to avoid discriminatory situations, the consent of the person concerned alone will not be sufficient to lift the prohibition on the processing of data whose main purpose is to identify his or her ideology, trade union affiliation, religion, sexual orientation, belief or racial or ethnic origin.

The provisions of the preceding paragraph shall not preclude the processing of such data under the other circumstances referred to in Article 9.2 of the Convention. Regulation (EU) 2016/679where appropriate.

2. The processing of data referred to in Article 9.2(g), (h) and (i) Regulation (EU) 2016/679 They must be covered by a rule of law, which may lay down additional requirements relating to their security and confidentiality.

In particular, this rule may cover the processing of data in the field of health where the management of public and private health and social care systems and services or the execution of an insurance contract to which the person concerned is a party so requires.

Article 10. Processing of data of a criminal nature.

1. The processing of personal data relating to convictions and criminal offences, as well as related precautionary and security procedures and measures, for purposes other than those relating to the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal sanctions, may only be carried out where it is covered by a rule of Union law, this organic law or other rules of legal rank.

2. The complete record of data relating to convictions and criminal offences, as well as related precautionary and security procedures and measures referred to in article 10 of the Convention Regulation (EU) 2016/679may be carried out in accordance with the provisions of the regulation of the System of Administrative Registers in Support of the Administration of Justice.

3. Apart from the cases referred to in the preceding paragraphs, the processing of data relating to convictions and criminal offences, as well as related precautionary and security procedures and measures, shall be possible only when they are carried out by lawyers and prosecutors and are intended to collect the information provided by their clients for the performance of their duties.

TITLE III

Rights of the individual

CHAPTER I

Transparency and information

Article 11. Transparency and information to the affected person.

1. Where the personal data are obtained from the data subject, the controller may comply with the duty of information laid down in Article 13 of this Regulation. Regulation (EU) 2016/679 providing the person concerned with the basic information referred to in the following paragraph and indicating to him an electronic address or other means to allow easy and immediate access to the remaining information.

2. The basic information referred to in the preceding paragraph shall contain at least:

(a) The identity of the controller and his or her representative, if any.

(b) The purpose of the treatment.

(c) The possibility of exercising the rights set forth in articles 15 to 22 of the Convention Regulation (EU) 2016/679.

If the data obtained from the affected person are to be processed for profiling, the basic information shall also include this circumstance. In this case, the person concerned shall be informed of his right to oppose the adoption of automated individual decisions which have legal effect on him or significantly affect him in a similar manner, where this right is in accordance with article 22 of the Convention. Regulation (EU) 2016/679.

3. Where the personal data have not been obtained from the person concerned, the person responsible may fulfil the duty of information laid down in Article 14 of the Convention. Regulation (EU) 2016/679 by providing it with the basic information referred to in the preceding paragraph, indicating an electronic address or other means to allow easy and immediate access to the remaining information.

In these cases, the basic information shall also include:

(a) The categories of data subject to processing.

(b) The sources from which the data originated.

CHAPTER II

Exercise of rights

Article 12. General provisions on the exercise of rights.

1. The rights recognized in articles 15 to 22 of the Covenant Regulation (EU) 2016/679may be exercised directly or by means of a legal or voluntary representative.

2. The controller shall be obliged to inform the person concerned of the means at his disposal to exercise his rights. The means must be easily accessible to the person concerned. The exercise of the right may not be denied on the sole ground of choosing the person concerned by other means.

3. The person responsible may process, on behalf of the person responsible, applications for the exercise of their rights made by the persons concerned if this is established in the contract or legal act relating to them.

4. The person responsible shall be responsible for proof of compliance with the duty to respond to the request for the exercise of his rights made by the person concerned.

5. Where the laws applicable to certain treatments establish a special regime affecting the exercise of the rights provided for in Chapter III of the Regulation (EU) 2016/679You'll be at the disposal of those.

6. In any case, the holders of parental authority may exercise in the name and representation of children under the age of fourteen the rights of access, rectification, cancellation, opposition or any other rights that may be corresponding to them in the context of this organic law.

7. The processing officer shall be free of charge to act on requests for the exercise of these rights, without prejudice to Articles 12.5 and 15.3 of the Convention. Regulation (EU) 2016/679 and in article 13, paragraphs 3 and 4, of this organic law.

Article 13. Right of access.

1. The right of access of the person concerned shall be exercised in accordance with Article 15 of the Regulation (EU) 2016/679.

Where the controller processes a large amount of data relating to the data subject and the data subject exercises his right of access without specifying whether it concerns all or part of the data, the data controller may, before providing the information, request the data or processing activities to which the request relates.

2. The right of access shall be deemed to be granted if the controller provides the data subject with a system of remote, direct and secure access to personal data that ensures, on a permanent basis, access to the data subject in full. To that end, the person responsible shall inform the person concerned of the manner in which the person concerned may access the system in question in order to comply with the request for the exercise of the right.

However, the data subject may request from the controller information relating to the matters referred to in Article 15(1) of the Convention. Regulation (EU) 2016/679 not included in the remote access system.

3. For the purposes set out in Article 12.5 of Regulation (EU) 2016/679 the exercise of the right of access may be considered repetitive on more than one occasion for a period of six months, unless there is legitimate cause for doing so.

4. Where the person concerned chooses a means other than that offered to him or her which involves a disproportionate cost, the application shall be deemed excessive and the person concerned shall bear the excess costs of his or her choice. In this case, only the satisfaction of the right of access without undue delay shall be enforceable to the controller.

Article 14. Right of rectification.

In exercising the right of rectification recognized in article 16 of the Regulation (EU) 2016/679the person concerned shall indicate in his request what information he refers to and the correction to be made. It shall accompany, where necessary, the supporting documentation of the inaccuracy or incompleteness of the data subject to processing.

Article 15. Right of deletion.

1. The right of withdrawal shall be exercised in accordance with Article 17 of the Regulation (EU) 2016/679.

2. Where the abolition results from the exercise of the right of opposition under Article 21(2) of the Treaty, Regulation (EU) 2016/679the person responsible may keep the identifying data of the person concerned necessary to prevent future processing for direct marketing purposes.

Article 16. Right to limitation of treatment.

1. The right to limit treatment shall be exercised in accordance with Article 18 of the Convention. Regulation (EU) 2016/679.

2. The fact that the processing of personal data is limited should be clearly stated in the information systems of the controller.

Article 17. Right to portability.

The right to portability shall be exercised in accordance with Article 20 of the Regulation (EU) 2016/679.

Article 18. Right of opposition.

The right to object, as well as rights related to automated individual decisions, including profiling, shall be exercised in accordance with Articles 21 and 22 of the Convention, respectively. Regulation (EU) 2016/679.

TITLE IV

Provisions applicable to specific treatments

Article 19. Processing of contact data, individual entrepreneurs and liberal professionals.

1. Unless otherwise proved, the provisions of Article 6.1(f) of the Convention shall be presumed to apply. Regulation (EU) 2016/679 the processing of contact details and, where appropriate, those relating to the role or position of natural persons providing services in a legal person provided that the following requirements are met:

(a) The processing relates only to the data necessary for its professional location.

(b) The purpose of the treatment is to maintain relations of any kind with the legal person in which the person concerned provides his services.

2. The same presumption shall apply to the processing of data relating to individual entrepreneurs and liberal professionals, where they relate to them only in that condition and are not treated to establish a relationship with them as natural persons.

3. The controllers or processors referred to in article 77.1 of this organic law may also process the data referred to in the two preceding paragraphs when this results from a legal obligation or is necessary for the exercise of their powers.

Article 20. Credit information systems.

1. Unless otherwise proved, the processing of personal data relating to non-compliance with monetary, financial or credit obligations by common credit reporting systems shall be presumed lawful where the following requirements are met:

(a) The data has been provided by the creditor or by the person acting on his or her own behalf or interest.

(b) That the data relate to certain, mature and enforceable debts, the existence or amount of which had not been the subject of an administrative or judicial claim by the debtor or through alternative dispute resolution proceedings binding between the parties.

(c) The creditor informed the party concerned in the contract or at the time of the request for payment of the possibility of inclusion in such systems, indicating those in which it participates.

The institution maintaining the credit reporting system with data relating to non-compliance with monetary, financial or credit obligations shall notify the affected party of the inclusion of such data and shall inform the latter of the possibility of exercising the rights set out in Articles 15 to 22 of the Regulation (EU) 2016/679 within 30 days of notification of the debt to the system, the data being blocked during that period.

(d) That the data should be kept in the system only for as long as the non-compliance persists, with a maximum limit of five years from the date of expiry of the money, financial or credit obligation.

(e) That the data relating to a particular debtor may only be consulted when the person consulting the system maintains a contractual relationship with the person concerned which involves payment of a pecuniary amount or has been asked by the person concerned to conclude a contract involving financing, deferred payment or periodic check-in, as is the case, inter alia, under the legislation on consumer credit agreements and real estate credit agreements.

Where the system has been exercised the right to limit the processing of data by challenging its accuracy as provided for in Article 18(1)(a) of the Convention, Regulation (EU) 2016/679the system shall inform those who may consult it in accordance with the preceding paragraph of the mere existence of that circumstance, without providing the particulars for which the right has been exercised, pending the decision on the application of the person concerned.

(f) If the request for the conclusion of the contract is refused or not concluded as a result of the consultation, the person who consulted the system shall inform the person concerned of the outcome of the consultation.

2. Institutions that maintain the system and creditors, with regard to the processing of data relating to their debtors, shall have the status of co-responsible for the processing of data, the provisions of Article 26 of which apply. Regulation (EU) 2016/679.

It shall be for the creditor to ensure that the requirements for the inclusion of debt in the system are met, in response to its non-existence or inaccuracy.

3. The presumption referred to in paragraph 1 of this Article does not cover cases where the credit information was associated by the institution maintaining the system with information additional to that referred to in that paragraph, relating to the debtor and obtained from other sources, in order to profile it, in particular by applying credit rating techniques.

Article 21. Treatments related to the conduct of certain commercial transactions.

1. Unless otherwise proved, data processing, including prior communication, which may result from the development of any structural change operation of companies or from the provision or transfer of business or business, shall be presumed lawful, provided that the processing is necessary for the good purpose of the operation and ensures, where appropriate, continuity in the provision of services.

2. In the event that the transaction is not completed, the transferee entity shall immediately proceed to the deletion of the data, without the obligation of blocking provided for in this organic law being applicable.

Article 22. Treatments for video surveillance purposes.

1. Natural or legal persons, public or private, may process images through camera or video camera systems in order to preserve the security of persons and property and their facilities.

2. Images of the road may only be taken in so far as this is essential for the purpose referred to in the preceding paragraph.

However, it will be possible to catch the public road in a larger area where it is necessary to ensure the safety of strategic goods or installations or infrastructure linked to transport, without in any case involving the capture of images from inside a private domicile.

3. The data shall be deleted within a maximum period of one month of their collection, except where they are to be kept to prove the commission of acts that infringe upon the integrity of persons, property or facilities. In such a case, the images shall be made available to the competent authority within 72 hours of the existence of the recording.

The obligation of blocking provided for in article 32 of this organic law shall not apply to such treatment.

4. The duty of information provided for in article 12 of the Regulation (EU) 2016/679 shall be deemed to have been complied with by placing an information device in a sufficiently visible place, identifying at least the existence of the treatment, the identity of the person responsible and the possibility of exercising the rights provided for in Articles 15 to 22 of the Regulation (EU) 2016/679. A connection code or internet address to this information may also be included in the information device.

In any event, the controller shall keep the information referred to in that Regulation available to those concerned.

5. Under Article 2.2(c) of the Regulation (EU) 2016/679, the processing by a natural person of images that only capture the interior of his own home is considered excluded from its scope.

This exclusion does not cover treatment by a private security entity that has been contracted for the surveillance of a home and has access to the images.

6. The processing of personal data derived from images and sounds obtained through the use of cameras and camcorders by the Security Forces and Corps and by the competent bodies for the surveillance and control in prisons and for the control, regulation, surveillance and discipline of traffic shall be governed by the legislation transposing the provisions of the Convention. Directive (EU) 2016/680where the treatment is intended for the prevention, investigation, detection or prosecution of criminal offences or for the enforcement of criminal sanctions, including protection and prevention from threats to public security. In addition to these circumstances, such treatment shall be governed by its specific legislation and by the Regulation (EU) 2016/679 and the present organic law.

7. The provisions of this Article are without prejudice to the provisions of the Law 5/2014 of 4 April, Private Security and its development provisions.

8. The processing by the employer of data obtained through camera or video camera systems is subject to the provisions of article 89 of this organic law.

Article 23. Advertising exclusion systems.

1. The processing of personal data which is intended to prevent the sending of commercial communications to those who have expressed their refusal or opposition to receive them shall be lawful.

To this end, general or sectoral information systems may be set up by the associations and bodies referred to in Article 40(2) of the Treaty. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 Aprilon the protection of individuals with regard to the processing of personal data and the free movement of such data and repealing the Directive 95/46/EC (General Data Protection Regulation) having a high representativeness, including only the data required to identify those affected. Such systems may also include services of preference, whereby those concerned limit the receipt of commercial communications to those coming from certain undertakings. The establishment and maintenance of such systems will be monitored through regulatory development.

2. The entities responsible for the advertising exclusion schemes shall inform the competent supervisory authority of their establishment, their general or sectoral nature, as well as of the way in which the persons concerned can join them and, where appropriate, assert their preferences.

The competent supervisory authority shall make public at its electronic headquarters a list of such systems communicated to it, incorporating the information referred to in the preceding paragraph. To that end, the competent supervisory authority notified of the establishment of the system shall inform the other supervisory authorities for publication by them.

3. Where an affected person expresses to a responsible person his wish that his or her data will not be processed for the transmission of commercial communications, the latter shall inform him or her of the existing advertising exclusion systems, and may refer to the information published by the competent supervisory authority.

4. Those seeking to carry out direct marketing communications must first consult the advertising exclusion systems that might affect their performance, excluding from processing the data of those affected who have expressed their opposition or refusal to it. For this purpose, consultation of the exclusion systems included in the relationship published by the competent supervisory authority shall be sufficient to consider the above obligation to be fulfilled.

The consultation referred to in the preceding paragraph will not be necessary if the person concerned has given, in accordance with the provisions of this organic law, his consent to receive the communication to whom he intends to make it.

Paragraph 1 is amended by final provision 4 of Law 10/2025 of 26 December. Ref. BOE-A-2025-26698

Article 24. Processing of data for the protection of persons reporting regulatory infringements.

The processing of personal data necessary to ensure the protection of persons reporting regulatory infringements shall be lawful.

Such treatment shall be governed by the provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016in this organic law and in the Law on the Protection of Persons Reporting on Normative Offences and the Fight against Corruption.

It is amended by final provision 7 of Law 2/2023 of 20 February. Ref. BOE-A-2023-4513

Article 25. Data processing in the field of public statistics.

1. The processing of personal data carried out by bodies which have conferred the powers relating to the exercise of the public statistical function shall be subject to the provisions of their specific legislation, as well as to the provisions of the Regulation (EU) 2016/679 and in the present organic law.

2. The transmission of data to the bodies responsible for statistical matters shall be understood only as covered by Article 6.1(e) of the Convention. Regulation (EU) 2016/679 where the statistics for which the information is required are required by a rule of European Union law or are included in the legally provided statistical programming instruments.

In accordance with the provisions Article 11.2 of Act No. 12/1989 of 9 May 1989of the Public Statistical Service, shall be of a strictly voluntary contribution and, consequently, only the data referred to in Articles 9 and 10 of the Convention may be collected with the express consent of the persons concerned. Regulation (EU) 2016/679.

3. The bodies responsible for the exercise of the public statistical function may refuse applications for the exercise by those concerned of the rights set out in Articles 15 to 22 of the Treaty. Regulation (EU) 2016/679 where the data are covered by the guarantees of statistical secrecy provided for in state or regional legislation.

Article 26. Processing of data for purposes of public interest archiving by public administrations.

The processing by the public authorities of data for the purpose of archiving in the public interest shall be lawful and shall be subject to the provisions of the Regulation (EU) 2016/679 and in the present organic law with the specialities derived from the provisions of the Law 16/1985 of 25 June 1985, of the Spanish Historical Heritage, in the Royal Decree 1708/2011 of 18 November 2011establishing the Spanish System of Archives and regulating the System of Archives of the General Administration of the State and its public bodies and their access regime, as well as the autonomous legislation that results from application.

Article 27. Processing of data relating to offences and administrative penalties.

1. For the purposes of Article 86 of the Regulation (EU) 2016/679the processing of data relating to infringements and administrative penalties, including the maintenance of records relating thereto, shall require:

(a) The persons responsible for such treatment are the competent bodies for the investigation of the sanctioning procedure, for the declaration of offences or for the imposition of sanctions.

(b) The processing is limited to the data strictly necessary for the purpose pursued by that data.

2. Where any of the conditions laid down in the preceding paragraph is not met, the processing of data relating to offences and administrative penalties shall be subject to the consent of the data subject or be authorized by a rule of law, which shall regulate, where appropriate, additional guarantees for the rights and freedoms of those concerned.

3. Apart from the cases referred to in the preceding paragraphs, processing of data relating to offences and administrative penalties is only possible when they are carried out by lawyers and prosecutors and are intended to collect the information provided by their clients for the performance of their duties.

TITLE V

Responsible and responsible for the treatment

CHAPTER I

General provisions. Active responsibility measures

Article 28. General obligations of the controller and processor.

1. The persons responsible and responsible, taking into account the elements listed in Articles 24 and 25 of the Treaty, Regulation (EU) 2016/679shall determine the appropriate technical and organisational measures to be applied in order to ensure and demonstrate that the treatment is in accordance with the aforementioned Regulations, this Organic Law, its implementing rules and applicable sectoral legislation. In particular, they shall assess whether the data protection impact assessment and the prior consultation referred to in Chapter IV, Section 3, of that Regulation are appropriate.

2. For the adoption of the measures referred to in the preceding paragraph, the controllers and processors shall take into account, in particular, the increased risks that may arise in the following situations:

(a) Where the processing could lead to discrimination, identity theft or fraud, financial loss, damage to reputation, loss of confidentiality of data subject to professional secrecy, unauthorized reversal of pseudonymization or any other significant economic, moral or social damage to those affected.

(b) Where the processing could deprive the persons concerned of their rights and freedoms or prevent them from exercising control over their personal data.

(c) Where the processing of the special categories of data referred to in Articles 9 and 10 of the Convention is not merely incidental or incidental, Regulation (EU) 2016/679 and 9 and 10 of this organic law or data related to the commission of administrative offences.

(d) Where the treatment involves an assessment of the personal aspects of the persons concerned in order to create or use personal profiles of the persons concerned, in particular by analysing or predicting aspects relating to their performance at work, their economic situation, their health, their preferences or personal interests, their reliability or behaviour, their financial solvency, their location or their movements.

(e) When data are processed from groups of affected persons in situations of particular vulnerability, and in particular from minors and persons with disabilities.

(f) Where mass processing involves a large number of persons concerned or involves the collection of a large amount of personal data.

(g) Where personal data are routinely transferred to third States or international organizations for which an adequate level of protection has not been declared.

(h) Any others that the person responsible or the person responsible may consider relevant, and in particular those provided for in codes of conduct and standards defined by certification schemes.

Article 29. Co-responsibility assumptions in treatment.

The determination of the responsibilities referred to in Article 26(1) of the Regulation (EU) 2016/679 be carried out according to the activities that each of the co-responsibles of the treatment actually develops.

Article 30. Representatives of controllers or processors not established in the European Union.

1. In cases where Regulation (EU) 2016/679 is applicable to a controller or processor not established in the European Union pursuant to Article 3.2 thereof and the processing relates to affected persons who are in Spain, the Spanish Data Protection Agency or, where appropriate, the autonomous data protection authorities may impose on the representative, jointly with the controller or controller, the measures laid down in Article 3(2) of Regulation (EU) No 1303/2013. Regulation (EU) 2016/679.

Such requirement shall be without prejudice to any liability that may be incurred by the controller or processor and the representative of the repeat action against the person concerned.

2. Similarly, in the event of a requirement of liability as provided for in article 82 of the Regulation (EU) 2016/679the persons responsible, responsible and responsible shall be jointly and severally liable for the damage caused.

Article 31. Recording of treatment activities.

1. The controllers and processors or, where appropriate, their representatives shall keep the records of treatment activities referred to in Article 30 of this Regulation. Regulation (EU) 2016/679unless the derogation provided for in paragraph 5 thereof applies.

The register, which may be organised around structured data sets, shall specify, in accordance with its purposes, the processing activities carried out and the other circumstances laid down in that regulation.

Where a data protection delegate has been appointed by the controller or processor, he shall be informed of any addition, modification or exclusion of the contents of the registry.

2. The subjects listed in article 77.1 of this organic law shall make public an inventory of their electronic processing activities containing the information set out in article 30 of the Convention. Regulation (EU) 2016/679 and its legal basis.

Article 32. Blocking of data.

1. The controller shall be obliged to block the data when it is rectified or deleted.

2. The blocking of data consists in the identification and reservation of data, taking technical and organizational measures, to prevent their processing, including their visualization, except for the provision of data to judges and courts, the Public Prosecutor's Office or the competent public administrations, in particular data protection authorities, for the requirement of possible responsibilities arising from the processing and only for the limitation period.

After that period, the data must be destroyed.

3. The blocked data may not be processed for any purpose other than that specified in the preceding paragraph.

4. Where, in order to fulfil this obligation, the configuration of the information system does not permit the blocking or requires an adaptation that involves a disproportionate effort, a secure copy of the information shall be made in such a way as to provide digital or other evidence, which will enable the authenticity of the information to be established, the date of the blocking and the non-handling of the data during the blocking.

5. The Spanish Data Protection Agency and the regional data protection authorities, within the scope of their respective competences, may set exceptions to the obligation of blocking established in this article, in cases where, taking into account the nature of the data or the fact that they relate to a particularly high number of affected persons, their mere preservation, even blocked, could create a high risk to the rights of those affected, as well as in cases where the retention of the blocked data could entail a disproportionate cost to the controller.

CHAPTER II

Treatment Officer

Article 33. In charge of the treatment.

1. Access by a controller to personal data necessary for the provision of a service to the controller shall not be considered as data communication provided that the provisions of the Convention are complied with. Regulation (EU) 2016/679the present organic law and its implementing rules.

2. It shall be regarded as responsible for the processing and not as the person in charge who, on his own behalf and without the record acting on behalf of another person, establishes relations with those concerned even if there is a contract or legal act with the content laid down in Article 28(3) of the Convention. Regulation (EU) 2016/679. This provision shall not apply to processing orders made under public sector procurement legislation.

It shall also be considered as controller who is listed as the controller and uses the data for his or her own purposes.

3. The controller shall determine whether, at the end of the performance of the manager's services, the personal data must be destroyed, returned to the controller or, where appropriate, delivered to a new controller.

The destruction of the data shall not take place where there is a legal provision requiring its preservation, in which case they shall be returned to the person responsible, who shall ensure its retention as long as such obligation persists.

4. The controller may keep the data, duly blocked, as long as responsibilities may arise from its relationship with the controller.

5. In the public sector, the powers of a controller may be attributed to a particular body of the General Administration of the State, the Administration of the Autonomous Communities, the Entities that make up the Local Government or to the bodies linked or dependent on them by adopting a regulation regulating those powers, which shall incorporate the content required by Article 28(3) of the Constitution. Regulation (EU) 2016/679.

CHAPTER III

Data Protection Delegate

Article 34. Designation of a data protection delegate.

1. Data controllers and processors shall appoint a data protection delegate in the cases provided for in Article 37(1) of the Convention. Regulation (EU) 2016/679 and, in any case, in the case of the following entities:

(a) Professional colleges and their general councils.

(b) Educational establishments offering teaching at any level established by the legislation regulating the right to education, as well as public and private universities.

(c) Entities operating networks and providing electronic communications services in accordance with their specific legislation, where they routinely and systematically process large-scale personal data.

(d) Information society service providers when developing large-scale profiles of service users.

(e) Entities included in the Article 1 of Law 10/2014 of 26 June, the organisation, supervision and solvency of credit institutions.

(f) Financial credit institutions.

(g) Insurance and reinsurers.

(h) Investment firms, regulated by the securities market law.

(i) Electrical energy distributors and marketers and natural gas distributors and marketers.

(j) The entities responsible for common files for the assessment of the solvency of assets and credit or for common files for the management and prevention of fraud, including those responsible for files regulated by legislation to prevent money-laundering and the financing of terrorism.

(k) Entities engaged in commercial advertising and prospecting activities, including commercial and market research, when performing treatment based on the preferences of those concerned or carrying out activities involving the profiling of those persons.

(l) Health facilities legally obliged to maintain patient records.

Except for health professionals who, while legally obliged to maintain patients' medical records, carry out their activities individually.

(m) Entities having as one of their objects the issuance of commercial reports that may refer to natural persons.

(n) Operators who carry out gambling activity through electronic, computer, telematic and interactive channels, in accordance with the rules governing gambling.

(ñ) Private security companies.

(o) Sports federations when processing data on minors.

2. Data controllers or processors not covered by the preceding paragraph may voluntarily appoint a data protection delegate, who shall be subject to the regime laid down in the Regulation (EU) 2016/679 and in the present organic law.

3. Data controllers and controllers shall communicate within ten days to the Spanish Data Protection Agency or, where appropriate, to the regional data protection authorities, the designations, appointments and terminations of data protection delegates both in cases where they are required to designate them and in cases where they are voluntary.

4. The Spanish Data Protection Agency and the regional data protection authorities shall maintain, within the scope of their respective competences, an updated list of data protection delegates which shall be accessible by electronic means.

5. In fulfilling the obligations of this Article, controllers and processors may establish the full or part-time work of the delegate, inter alia, depending on the volume of the processing, the special category of data processed or the risks to the rights or freedoms of the data subjects.

Article 35. Qualification of the data protection delegate.

Compliance with the requirements laid down in Article 37(5) of the Regulation (EU) 2016/679 for the designation of the data protection delegate, whether natural or legal, it may be demonstrated, inter alia, through voluntary certification mechanisms which shall take particular account of obtaining a university degree that demonstrates expertise in data protection law and practice.

Article 36. Position of the data protection delegate.

1. The data protection delegate shall act as an interlocutor for the controller or controller before the Spanish Data Protection Agency and the regional data protection authorities. The delegate may inspect procedures relating to the subject matter of this organic law and issue recommendations within the scope of his or her competence.

2. In the case of a natural person integrated into the organisation of the controller or processor, the data protection delegate may not be removed or punished by the controller or controller for performing his or her duties unless he or she is guilty of wilful misconduct or gross negligence in the performance of his or her duties. The independence of the data protection delegate within the organisation shall be ensured, and any conflict of interest shall be avoided.

3. In the exercise of its functions, the data protection delegate shall have access to personal data and processing processes, and the controller or controller may not object to this access to the existence of any obligation of confidentiality or secrecy, including that provided for in article 5 of this organic law.

4. Where the data protection delegate appreciates the existence of a relevant breach in the area of data protection, he shall document it and shall immediately inform the administrative and management bodies of the controller or processor.

Article 37. Intervention by the data protection delegate in the event of a complaint to the data protection authorities.

1. Where the controller or processor has appointed a data protection delegate, the data protection officer concerned may, prior to the submission of a complaint against them to the Spanish Data Protection Agency or, where appropriate, to the regional data protection authorities, address the data protection delegate of the entity against which he claims.

In this case, the data protection delegate shall inform the data protection officer of the decision taken within two months of receipt of the complaint.

2. Where the person concerned lodges a complaint with the Spanish Data Protection Agency or, where appropriate, with the regional data protection authorities, those authorities may refer the complaint to the data protection delegate in order for the data protection delegate to respond within one month.

If, after that period, the data protection delegate has not informed the competent data protection authority of the response to the complaint, that authority shall continue the procedure in accordance with Title VIII of this organic law and its implementing rules.

3. The procedure before the Spanish Data Protection Agency shall be that established in Title VIII of this organic law and its implementing rules. In addition, the Autonomous Communities shall regulate the corresponding procedure before their regional data protection authorities.

CHAPTER IV

Codes of conduct and certification

Article 38. Codes of conduct.

1. Codes of conduct governed by Chapter IV, Section 5a, of the Regulation (EU) 2016/679 shall be binding on those who adhere to them.

Such codes may be provided with mechanisms for the extrajudicial resolution of conflicts.

2. These codes may be promoted, in addition to the associations and bodies referred to in Article 40(2) of the Treaty, by the Regulation (EU) 2016/679by undertakings or groups of undertakings as well as by those responsible or responsible for whom Article 77.1 of this organic law refers.

They may also be promoted by bodies or entities that assume the functions of supervision and extrajudicial resolution of conflicts referred to in article 41 of the Convention. Regulation (EU) 2016/679.

The controllers or processors who adhere to the code of conduct are obliged to submit to the supervisory body or entity complaints made to them by those affected in relation to the processing of data within its scope if they consider that it is not appropriate to comply with the request in the complaint, without prejudice to article 37 of this organic law. In addition, without prejudice to the powers conferred by the Regulation (EU) 2016/679 the data protection authorities may, on a voluntary basis and before processing, subject the data protection authority or supervisory body to the verification of its conformity with the matters covered by the code of conduct.

In the event that the supervisory body or entity rejects or dismisses the complaint, or if the controller or processor does not submit the complaint to its decision, the controller may make it to the Spanish Data Protection Agency or, where appropriate, the regional data protection authorities.

The competent data protection authority shall verify that the bodies or entities promoting codes of conduct have provided these codes with supervisory bodies which meet the requirements laid down in Article 41.2 of Regulation (EU) No 1303/2013. Regulation (EU) 2016/679.

3. The codes of conduct shall be approved by the Spanish Data Protection Agency or, where appropriate, by the competent regional data protection authority.

4. The Spanish Data Protection Agency or, where appropriate, the autonomous data protection authorities shall submit the draft codes to the consistency mechanism referred to in Article 63 of the Convention. Regulation (EU) 2016/679 where appropriate in accordance with Article 40.7. The procedure shall be suspended until the opinion referred to in Articles 64(1)(b) and 65(1)(c) of the said Regulation is delivered by the European Data Protection Committee.

Where a regional data protection authority submits the draft code to the consistency mechanism, it shall be subject to the provisions of article 60 of this organic law.

5. The Spanish Data Protection Agency and the regional data protection authorities shall keep records of the codes of conduct approved by them, which shall be interconnected and coordinated with the register managed by the European Data Protection Committee in accordance with Article 40.11 of that Regulation.

The register shall be accessible through electronic means.

6. By royal decree, the contents of the register and the specialities of the procedure for approving codes of conduct shall be established.

Article 39. Accreditation of certification institutions.

Without prejudice to the functions and accreditation powers of the competent supervisory authority pursuant to Articles 57 and 58 of the Treaty, Regulation (EU) 2016/679the accreditation of the certification institutions referred to in Article 43.1 of the said regulation may be carried out by the National Accreditation Entity (ENAC), which shall communicate to the Spanish Data Protection Agency and to the data protection authorities of the autonomous communities the concessions, refusals or revocations of the accreditations, as well as their motivation.

TITLE VI

International data transfers

Article 40. International data transfer regime.

International data transfers shall be governed by the provisions of Regulation (EU) 2016/679in this organic law and its implementing rules approved by the Government, and in the circulars of the Spanish Data Protection Agency and the regional data protection authorities, within the scope of their respective competences.

In any event, the provisions contained in those rules, in particular those governing the principles of data protection, shall apply to the processing of the transfer itself.

Article 41. Assumptions of adoption by the Spanish Agency for Data Protection.

1. The Spanish Data Protection Agency and the regional data protection authorities may adopt, in accordance with Article 46(2)(c) of the Convention, the following provisions: Regulation (EU) 2016/679standard contractual clauses for international data transfers, which shall be submitted in advance to the opinion of the European Data Protection Committee provided for in Article 64 of that Regulation.

2. The Spanish Data Protection Agency and the regional data protection authorities may adopt binding corporate rules in accordance with Article 47 of the Convention. Regulation (EU) 2016/679.

The procedure will be initiated at the request of an entity located in Spain and will last for a maximum of nine months. It shall be suspended as a result of the referral of the dossier to the European Data Protection Committee for the opinion referred to in Article 64(1)(f) of the Treaty. Regulation (EU) 2016/679, and will continue after its notification to the Spanish Data Protection Agency or to the competent regional data protection authority.

Article 42. Assumptions subject to prior authorisation by the data protection authorities.

1. International data transfers to countries or international organisations that do not have an adequacy decision approved by the Commission or that do not fall under any of the guarantees provided for in the preceding article and Article 46.2 of the Convention Regulation (EU) 2016/679require prior authorization from the Spanish Data Protection Agency or, where appropriate, regional data protection authorities, which may be granted in the following cases:

(a) Where the transfer is intended to be based on the provision of adequate guarantees on the basis of contractual clauses which do not correspond to the standard clauses provided for in Article 46(2)(c) and (d) of the Treaty; Regulation (EU) 2016/679.

(b) When the transfer is carried out by any of the persons responsible or responsible referred to in article 77.1 of this organic law and is based on provisions incorporated into non-regulatory international agreements with other public authorities or agencies of third States, which incorporate effective and enforceable rights for those affected, including memorandums of understanding.

The procedure shall last for a maximum of six months.

2. The authorisation shall be subject to the European Data Protection Committee's opinion as referred to in Articles 64(1)(e), 64(1)(f) and 65(1)(c) of the Treaty. Regulation (EU) 2016/679. The referral of the file to the said committee shall entail the suspension of the procedure until the opinion is notified to the Spanish Data Protection Agency or, through it, to the competent supervisory authority, if necessary.

Article 43. Assumptions submitted to the competent data protection authority for prior information.

Data controllers shall inform the Spanish Data Protection Agency or, where appropriate, the regional data protection authorities of any international data transfer they intend to carry out on the basis of their need for purposes related to the compelling legitimate interests pursued by them and the attendance of the rest of the requirements provided for in the last paragraph of Article 49.1 of Regulation (EU) 2016/679. They shall also inform the persons concerned of the transfer and of the legitimate interests pursued.

This information shall be provided prior to the transfer.

The provisions of this Article shall not apply to activities carried out by public authorities in the exercise of their public powers, in accordance with Article 49(3) of the Treaty. Regulation (EU) 2016/679.

TITLE VII

Data protection authorities

CHAPTER I

The Spanish Agency for Data Protection

Section 1.a General provisions

Article 44. General provisions.

1. The Spanish Data Protection Agency is an independent administrative authority at the state level, from those provided for in the Law 40/2015 of 1 October, of the Public Sector Legal Regime, with legal personality and full public and private capacity, which acts with full independence of the public authorities in the exercise of its functions.

Its official name, in accordance with the provisions of Article 109(3) of Law 40/2015 of 1 October 2015, of the Legal Regime of the Public Sector, will be «Spanish Agency of Data Protection, Independent Administrative Authority».

It relates to the Government through the Ministry of Justice.

2. The Spanish Data Protection Agency shall have the status of a common representative of the data protection authorities of the Kingdom of Spain in the European Data Protection Committee.

3. The Spanish Data Protection Agency, the General Council of the Judiciary and, where appropriate, the Attorney General's Office, shall cooperate in order to ensure the proper exercise of the respective powers conferred on them by the Organic Law 6/1985 of 1 Julythe judiciary assigns them to the protection of personal data in the field of the administration of justice.

Paragraph 3 is amended by final provision 4.2 of Organic Law 7/2021 of 26 May. Ref. BOE-A-2021-8806

Article 45. Legal regime.

1. The Spanish Agency for Data Protection is governed by the provisions of the Regulation (EU) 2016/679the present organic law and its provisions for development.

As soon as it is compatible with its full independence and without prejudice to the provisions of article 63.2 of this organic law, the rules referred to in the Article 110.1 of Law 40/2015 of 1 October, of Public Sector Legal Regime.

2. The Government, on the proposal of the Spanish Data Protection Agency, will approve its Statute by royal decree.

Article 46. Budgetary and personnel economic regime.

1. The Spanish Data Protection Agency shall draw up and approve its budget and forward it to the Government for integration, independently, in the General Budgets of the State.

2. The regime of modifications and linkage of the appropriations of its budget will be that established in the Statute of the Spanish Agency for the Protection of Data.

It is up to the Presidency of the Spanish Data Protection Agency to authorize the budgetary changes that involve up to three percent of the initial figure of its total expenditure budget, provided that the appropriations for staff costs are not increased. Any remaining changes not exceeding five per cent of the budget shall be authorized by the Ministry of Finance and, in other cases, by the Government.

3. The Spanish Agency for Data Protection shall count for the fulfilment of its purposes on the allocations established from the General Budgets of the State, the assets and values that constitute its assets and the ordinary and extraordinary revenues derived from the exercise of its activities, including those derived from the exercise of the powers set out in Article 58 of the Constitution. Regulation (EU) 2016/679.

4. The positive result of its revenue will be allocated by the Spanish Data Protection Agency to the endowment of its reserves in order to guarantee its full independence.

5. The staff at the service of the Spanish Data Protection Agency shall be official or professional and shall be governed by the provisions of the Consolidated text of the Law on the Basic Statute of Public Employees, approved by Royal Legislative Decree 5/2015, of 30 Octoberand other regulations governing civil servants and, where appropriate, labour regulations.

6. The Spanish Data Protection Agency shall draw up and approve its list of jobs, within the framework of the criteria established by the Ministry of Finance, respecting the limit of staff expenditure established in the budget. In any case, the list of jobs shall include those posts which must be held exclusively by public officials, consisting of the exercise of the functions involving direct or indirect participation in the exercise of public powers and the safeguarding of the general interests of the State and of the public administrations.

7. Without prejudice to the powers conferred on the Court of Auditors, the economic and financial management of the Spanish Data Protection Agency shall be subject to the control of the General Intervention of the State Administration in the terms established by the Law 47/2003 of 26 November 2003, General Budget.

Article 47. Functions and powers of the Spanish Data Protection Agency.

The Spanish Data Protection Agency is responsible for monitoring the application of this organic law and the Regulation (EU) 2016/679 and, in particular, to exercise the functions set out in article 57 and the powers provided for in article 58 of the same Regulations, in this Organization Act and in its implementing provisions.

The Spanish Data Protection Agency is also responsible for the performance of the functions and powers conferred on it by other laws or rules of European Union law.

Article 48. The Presidency of the Spanish Agency for Data Protection.

1. The Presidency of the Spanish Data Protection Agency directs it, has its representation and issues its resolutions, circulars and guidelines.

2. The Presidency of the Spanish Data Protection Agency shall be assisted by an Assistant to whom it may delegate its functions, except those related to the procedures regulated by Title VIII of this organic law, and which shall replace it in the exercise of those functions in the terms provided for in the Organic Statute of the Spanish Data Protection Agency.

They shall exercise their functions in full independence and objectivity and shall not be subject to any instruction in their performance. They shall be subject to the legislation governing the exercise of the high office of the General Administration of the State.

In cases of absence, vacancy or illness of the person holding the Presidency or where any of the reasons for abstention or disqualification provided for in the Article 23 of Law 40/2015 of 1 Octoberthe exercise of the powers related to the procedures regulated by Title VIII of this Organic Law shall be assumed by the person holding the management body carrying out the inspection functions. Where any of the above circumstances also applies to that person, the exercise of the powers concerned shall be taken over by the persons holding the management bodies at the level of general sub-directory, in accordance with the order laid down in the Staff Regulations.

The exercise of the remaining powers shall be assumed by the Deputy in accordance with the terms provided for in the Organic Statute of the Spanish Data Protection Agency and, failing that, by the persons holding the management bodies with the level of general sub-direction, in accordance with the order established in the Statute.

3. The Presidency of the Spanish Data Protection Agency and its Deputy shall be appointed by the Government, on the proposal of the Ministry of Justice, from persons of recognized professional competence, in particular in the field of data protection.

Two months before the expiry of the term of office or, in the other cases of termination, when the term of office has occurred, the Ministry of Justice shall order the publication in the Official Gazette of the State of the public summons of candidates.

After assessing the merit, capacity, competence and suitability of the candidates, the Government shall forward to the Congress of Deputies a proposal for a Presidency and Deputy accompanied by a supporting report which, following the mandatory hearing of the candidates, shall be ratified by the Justice Committee by a public vote by a majority of three fifths of its members in the first ballot or, if not reached, by an absolute majority in the second ballot, which shall take place immediately after the first ballot. In the latter case, the votes in favour must be taken from Members of at least two different parliamentary groups.

4. The Presidency and the Deputy of the Spanish Data Protection Agency will be appointed by the Council of Ministers by royal decree.

5. The term of office of the Presidency and the Deputy of the Spanish Data Protection Agency is five years and can be renewed for another term of equal duration.

The Presidency and the Deputy shall cease only before the expiry of their term of office, at their own request or by separation agreed by the Council of Ministers, by:

(a) Serious breach of its obligations;

(b) incapacity to perform their duties;

(c) Incompatibility; or

(d) A final conviction for a wrongful offence.

In the cases provided for in points (a), (b) and (c), ratification of the separation by the parliamentary majorities provided for in paragraph 3 of this Article shall be necessary.

6. The acts and provisions issued by the Presidency of the Spanish Agency for the Protection of Data put an end to the administrative process, and can be appealed directly to the Chamber of Administrative Disputes of the National High Court.

Paragraph 2 is amended by final provision 9.1 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Article 49. Advisory Council of the Spanish Agency for Data Protection.

1. The Presidency of the Spanish Data Protection Agency shall be assisted by an Advisory Council composed of the following members:

(a) A deputy, proposed by the Congress of Deputies.

(b) One Senator, proposed by the Senate.

(c) A representative appointed by the General Council of the Judiciary.

(d) A representative of the General Administration of the State with experience in the matter, proposed by the Minister of Justice.

(e) A representative of each Autonomous Community who has established a Data Protection Authority in its territorial area, proposed in accordance with the provisions of the respective Autonomous Community.

(f) An expert nominated by the Spanish Federation of Municipalities and Provinces.

(g) An expert proposed by the Consumers and Users Council.

(h) Two experts nominated by business organizations.

(i) A representative of data protection and privacy professionals, proposed by the state-wide association with more partners.

(j) A representative of the bodies or entities for the supervision and extrajudicial resolution of conflicts provided for in Chapter IV of Title V, proposed by the Minister of Justice.

(k) An expert, proposed by the Conference of Rectors of the Spanish Universities.

(l) A representative of the organizations that bring together the General Councils, Superiors and Professional Associations of the different professions of the State, proposed by the Minister of Justice.

(m) A representative of the information security professionals, proposed by the state-level association with the largest number of partners.

(n) An expert on transparency and access to public information proposed by the Transparency and Good Governance Council.

(ñ) Two experts nominated by the most representative trade union organizations.

2. For the purposes of the preceding paragraph, the status of an expert shall require the accreditation of expertise in law and practice in the field of data protection through professional or academic practice.

3. The members of the Advisory Council shall be appointed by order of the Minister of Justice, published in the Official Gazette of the State.

4. The Advisory Council shall meet when the Presidency of the Spanish Data Protection Agency so decides and, in any case, once a semester.

5. Decisions taken by the Advisory Council shall in no case be binding.

6. In everything not provided for by this organic law, the regime, powers and functioning of the Advisory Council shall be those established in the Organic Statute of the Spanish Agency for the Protection of Data.

Article 50. Advertising.

The Spanish Data Protection Agency shall publish the resolutions of its Presidency declaring whether or not to be taken into account the rights recognized in Articles 15 to 22 of the Convention. Regulation (EU) 2016/679those that terminate the sanctioning procedures and warning procedures, those that terminate the pre-investigation proceedings, those ordered in respect of the entities referred to in article 77.1 of this organic law, those that impose precautionary measures and the others provided for in its Statute.

It is amended by final provision 9.2 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Section 2.a. Investigative powers and preventive audit plans

Article 51. Scope and competent personnel.

1. The Spanish Data Protection Agency will carry out its research activity through the actions provided for in Title VIII and through the preventive audit plans.

2. The research activity will be carried out by the officials of the Spanish Data Protection Agency or by officials outside it expressly authorized by its Presidency.

3. In cases of joint investigative proceedings pursuant to article 62 of the Regulation (EU) 2016/679, the staff of the supervisory authorities of other Member States of the European Union who collaborate with the Spanish Data Protection Agency shall exercise their powers in accordance with the provisions of this organic law and under the guidance and in the presence of the staff of the latter.

4. Officials carrying out investigative activities shall be regarded as agents of the authority in the performance of their duties and shall be obliged to keep secret the information they know during that exercise, even after they have ceased to do so.

Article 52. Duty of collaboration.

1. Public administrations, including tax and social security administrations, and individuals, shall be obliged to provide the Spanish Data Protection Agency with the data, reports, background and supporting documents necessary to carry out its research activity.

Where the information contains personal data, the communication of such data shall be covered by the provisions of Article 6.1(c) of the Regulation (EU) 2016/679.

2. Within the framework of the previous investigation proceedings, when it has not been able to carry out the identification by other means, the Spanish Data Protection Agency may obtain from the public administrations, including tax and social security authorities, the information and data that are essential for the sole purpose of obtaining the identification of those responsible for the conduct that could constitute a breach of the law. Regulation (EU) 2016/679 and of this organic law.

In the case of the tax and social security administrations, the information will be limited to what is necessary in order to be able to identify unequivocally against whom the action of the Spanish Data Protection Agency should be directed in the cases of creation of corporate networks that would hinder the direct knowledge of the alleged perpetrator of the conduct contrary to the law. Regulation (EU) 2016/679 and to this organic law.

3. Where it has not been able to make identification by other means, the Spanish Data Protection Agency may obtain from operators who provide electronic communications services available to the public and from information society service providers the data in their possession and which are essential for the identification of the person alleged to be responsible for the conduct contrary to the Regulation (EU) 2016/679 and to this organic law when it has been carried out by means of a service of the information society or by means of an electronic communication. For this purpose, the data that the Spanish Data Protection Agency may collect under this section are as follows:

(a) Where the conduct was carried out through the use of a fixed or mobile telephone service:

1.o The telephone number of origin of the call in case it had been hidden.

2. The name, identification number and address of the subscriber or registered user to whom that telephone number applies.

3.o The mere confirmation that a specific call has been made between two numbers on a given date and time.

(b) Where the conduct was carried out through the use of an information society service:

1. The identification of the Internet protocol address from which the conduct was carried out and the date and time of its realization.

2.o If the conduct was carried out by e-mail, the identification of the Internet protocol address from which the e-mail account was created and the date and time at which it was created.

3. The name, identification number and address of the subscriber or registered user to whom the Internet Protocol address referred to in the two preceding paragraphs would have been assigned.

This data must be transferred, subject to a reasoned request from the Spanish Data Protection Agency, exclusively in the context of investigative actions initiated as a result of a complaint filed by an affected person concerning a conduct of a legal person or with regard to the use of systems that allow the unrestricted disclosure of personal data. In the rest of the cases, the transfer of these data will require the prior obtaining of a judicial authorization granted in accordance with the procedural rules when it becomes necessary.

Traffic data which operators were dealing with solely with in order to comply with the obligations laid down in the Convention are excluded from the provisions of this paragraph. Law 25/2007 of 18 Octoberthe preservation of data relating to electronic communications and public communications networks, the transfer of which may take place only in accordance with the provisions of that law, subject to judicial authorization requested by one of the authorized agents referred to in article 6 of that law.

Article 53. Scope of the research activity.

1. Those carrying out the research may collect the information necessary for the performance of their duties, carry out inspections, require the display or dispatch of the necessary documents and data, examine them at the place where they are stored or where the treatments are carried out, obtain copies of them, inspect the physical and logical equipment and require the execution of treatments and programmes or procedures for the management and support of the treatment subject to investigation.

2. Where access to the constitutionally protected home of the inspected person by the staff carrying out the investigation is necessary, their consent or judicial authorization shall be required.

3. In the case of judicial bodies or judicial offices, the exercise of inspection powers shall be carried out through and through the General Council of the Judiciary.

Article 53 bis. Research actions through digital systems.

The research activities can be carried out through digital systems that, through videoconferencing or other similar system, allow the bidirectional and simultaneous communication of image and sound, the visual, auditory and verbal interaction between the Spanish Agency for Data Protection and the inspected. In addition, they must ensure the safe transmission and receipt of documents and information exchanged, and, where appropriate, collect the necessary evidence and the outcome of the proceedings carried out ensuring their authorship, authenticity and integrity.

The use of these systems shall take place when determined by the Agency and shall require the conformity of the inspected person with respect to their use and with the date and time of their development.

It is added by final provision 9.3 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Text added, published on 09/05/2023, in force from 10/05/2023.

Article 54. Audit plans.

1. The Presidency of the Spanish Data Protection Agency may agree to carry out preventive audit plans, referring to the treatment of a particular sector of activity. The purpose of the study is to analyse compliance with the provisions of Regulation (EU) 2016/679 and this organic law, based on the conduct of research activities on entities belonging to the inspected sector or on those responsible for the audit.

2. As a result of the audit plans, the Presidency of the Spanish Data Protection Agency may issue general or specific guidelines for a specific person responsible or responsible for the precise treatments to ensure the full adaptation of the sector or responsible for the Regulation (EU) 2016/679 and to this organic law.

In the preparation of these guidelines, the Presidency of the Spanish Data Protection Agency may request the cooperation of the supervisory bodies for codes of conduct and for the extrajudicial resolution of conflicts, if any.

3. The guidelines shall be binding on the sector or responsible to which the audit plan relates.

Section 3.a Other powers of the Spanish Data Protection Agency

Article 55. Regulatory powers. Circulars of the Spanish Agency for Data Protection.

1. The Presidency of the Spanish Data Protection Agency may issue provisions setting out the criteria to be met by this authority in the application of the provisions of the Convention. Regulation (EU) 2016/679 and in the present organic law, which will be called ‘Circulars of the Spanish Agency for Data Protection’.

2. Its preparation will be subject to the procedure established in the Statute of the Spanish Data Protection Agency, which must provide for the necessary technical and legal reports and the hearing of the interested parties.

3. Circulars shall be binding once published in the Official Gazette of the State.

Article 56. External action.

1. The Spanish Data Protection Agency is responsible for the ownership and exercise of the functions related to the external action of the State in the area of data protection.

The Autonomous Communities, through the autonomous data protection authorities, are also responsible for exercising their functions as subjects of external action within the framework of their powers in accordance with the provisions of the Convention. Law 2/2014 of 25 Marchof the Action and the Foreign Service of the State, as well as concluding international administrative agreements in implementation and implementation of an international treaty and non-normative agreements with similar bodies of other subjects of international law, which are not legally binding on those who sign them, on matters within their competence within the framework of the Law 25/2014 of 27 November 2014of Treaties and other International Agreements.

2. The Spanish Data Protection Agency is the competent body for the protection of natural persons with regard to the processing of personal data arising from the application of any international agreement to which the Kingdom of Spain is a party which confers on a national supervisory authority that competence and the common representative of the data protection authorities in the European Data Protection Committee, in accordance with Article 68(4) of the Convention. Regulation (EU) 2016/679.

The Spanish Data Protection Agency shall inform the regional data protection authorities of the decisions taken by the European Data Protection Committee and shall seek their views in the case of matters within its competence.

3. Without prejudice to paragraph 1, the Spanish Data Protection Agency shall:

(a) Participate in international meetings and forums at different levels from that of the European Union established by mutual agreement of the independent supervisory authorities in the field of data protection.

(b) Participate, as Spanish authority, in international organizations competent in the field of data protection, in committees or working groups, study and collaboration of international organizations dealing with matters affecting the fundamental right to the protection of personal data and in other international forums or working groups, within the framework of the State ' s external action.

(c) Collaborate with authorities, institutions, agencies and administrations of other States in order to promote, promote and develop the fundamental right to data protection, in particular in the Ibero-American context, and may conclude international administrative and non-regulatory agreements in this area.

CHAPTER II

Regional data protection authorities

Section 1.a General provisions

Article 57. Regional data protection authorities.

1. The autonomous authorities for the protection of personal data may exercise the functions and powers laid down in Articles 57 and 58 of the Treaty. Regulation (EU) 2016/679in accordance with regional rules, where they relate to:

(a) Treatments for which the public sector entities of the relevant Autonomous Community or local entities are responsible or who provide services through any form of direct or indirect management.

(b) Treatment by natural or legal persons for the exercise of public functions in matters falling within the competence of the relevant Autonomous or Local Administration.

(c) Treatments expressly provided for in the respective Statutes of Autonomy, if any.

2. The autonomous data protection authorities may issue circulars with the scope and effects established for the Spanish Data Protection Agency in article 55 of this organic law, in relation to the processing subject to their competence.

Article 58. Institutional cooperation.

The Presidency of the Spanish Data Protection Agency shall convene, on its own initiative or at the request of another authority, the regional data protection authorities to contribute to the coherent application of the Regulation (EU) 2016/679 and of this organic law. In any event, six-monthly cooperation meetings will be held.

The Presidency of the Spanish Data Protection Agency and the regional data protection authorities may request and shall exchange with each other the information necessary for the performance of their duties, and in particular that relating to the activity of the European Data Protection Committee. They may also set up working groups to deal with specific issues of common interest.

Article 59. Treatments contrary to Regulation (EU) 2016/679.

When the Presidency of the Spanish Data Protection Agency considers that a processing carried out in matters falling within the competence of the regional data protection authorities violates the Regulation (EU) 2016/679 may require them to take, within one month, the measures necessary for their cessation.

If the autonomous authority does not comply with the request or the measures adopted in time do not result in the cessation of the unlawful processing, the Spanish Agency for Data Protection may exercise the actions that proceed before the contentious-administrative jurisdiction.

Section 2.a Coordination within the framework of the procedures established in the Regulation (EU) 2016/679

Article 60. Coordination in the event of an opinion issued by the European Data Protection Committee.

All communications between the European Data Protection Committee and the autonomous data protection authorities shall be carried out through the Spanish Data Protection Agency when the latter, as competent authorities, are required to submit their draft decision to the said committee or to request it to examine a matter pursuant to Article 64(1) and (2) of the Convention. Regulation (EU) 2016/679.

In these cases, the Spanish Data Protection Agency will be assisted by a representative of the Autonomous Authority in his address to the Committee.

Article 61. Intervention in case of cross-border treatment.

1. The autonomous data protection authorities shall be the principal supervisory authority or interested in the procedure laid down in Article 60 of the Treaty. Regulation (EU) 2016/679 where it relates to a treatment provided for in article 57 of this organic law carried out by a person responsible or responsible for the treatment of those provided for in article 56 of the Regulation (EU) 2016/679Unless it developed significantly treatments of the same nature in the rest of Spain.

2. In such cases, the autonomous authorities shall be responsible for intervening in the procedures laid down in Article 60 of the Treaty. Regulation (EU) 2016/679informing the Spanish Agency for Data Protection of its development in the cases in which the mechanism of coherence should be applied.

Article 62. Coordination in case of conflict resolution by the European Data Protection Committee.

1. All communications between the European Data Protection Committee and the autonomous data protection authorities shall be carried out through the Spanish Data Protection Agency when the authorities, as the principal authorities, are required to request from the said Committee the issuance of a binding decision as provided for in Article 65 of the Convention. Regulation (EU) 2016/679.

2. The autonomous data protection authorities which have the status of non-main authority concerned in a procedure referred to in Article 65 of the Treaty Regulation (EU) 2016/679 inform the Spanish Data Protection Agency when the matter is referred to the European Data Protection Committee, providing it with the documentation and information necessary for its processing.

The Spanish Data Protection Agency shall be assisted by a representative of the autonomous authority concerned in his intervention before the said committee.

TITLE VIII

Procedures in case of possible infringement of data protection rules

Article 63. Legal regime.

1. The provisions of this Title shall apply to the procedures processed by the Spanish Data Protection Agency in cases where an affected person claims that his application for the exercise of the rights recognized in Articles 15 to 22 of the Convention has not been complied with. Regulation (EU) 2016/679and in which the latter investigates the existence of a possible violation of the provisions of the aforementioned regulations and of this organic law.

2. The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of the Regulation (EU) 2016/679in this Organic Law, by the regulations issued in its course and, as soon as they do not contradict them, in a subsidiary capacity, by the general rules on administrative procedures.

3. The Government will regulate by royal decree the procedures that the Spanish Agency for Data Protection processes under this Title, ensuring in any case the rights of defense and hearing of the interested parties.

Article 64. Form of initiation and duration of the procedure.

1. Where the procedure relates exclusively to the failure to comply with a request for the exercise of the rights set out in articles 15 to 22 of the Convention, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016shall be initiated by agreement on admission to the procedure, which shall be adopted in accordance with article 65 of this organic law.

In this case, the time limit for resolving the proceedings shall be six months from the date on which the claimant has been notified of the admission-for-procedure agreement. After that time limit, the person concerned may consider his claim to be considered admissible.

2. Where the procedure concerns the determination of the possible existence of an infringement of the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016and in this organic law, it shall be initiated by agreement of initiation, adopted on its own initiative or as a consequence of a complaint, which shall be notified to the person concerned.

If the procedure is based on a complaint made to the Spanish Data Protection Agency, it shall, on a preliminary basis, decide on its admission to the procedure, in accordance with article 65 of this organic law.

Admitted to processing the complaint, as well as in cases where the Spanish Agency for Data Protection acts on its own initiative, prior to the agreement of initiation there may be a phase of previous investigative proceedings, which will be governed by the provisions of article 67 of this organic law.

The procedure shall last for a maximum period of 12 months from the date of the initiation agreement. After that time limit, it will expire and, consequently, the record of proceedings will be filed.

3. Where this is so done in view of the nature of the facts and having due regard to the criteria laid down in Article 83(2) of the Treaty, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016the Spanish Data Protection Agency, after hearing the controller or controller, may direct a warning, as well as order the controller or processor to take corrective measures aimed at ending the possible breach of data protection legislation in a given manner and within the specified time frame.

The procedure shall last for a maximum period of six months from the date of the initiation agreement. After that time limit, it will expire and, consequently, the record of proceedings will be filed.

The second and third subparagraphs of paragraph 2 of this Article shall apply in this case.

4. The procedure may also be processed as a result of the communication to the Spanish Data Protection Agency by the supervisory authority of another Member State of the European Union of the complaint lodged before it, where the Spanish Data Protection Agency has the status of the principal supervisory authority for the processing of a procedure in accordance with the provisions of Articles 56 and 60 of the Treaty. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. Paragraphs 1, 2 and 3 of this Article shall apply in this case.

5. The time limits laid down in this Article, as well as those for admission to proceedings governed by Article 65(5) and for the duration of the preliminary investigation proceedings provided for in Article 672, shall be automatically suspended when information, consultation, request for assistance or a mandatory decision is to be sought from a body or body of the European Union or from one or more control authorities of the Member States as provided for in the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, for the time between the application and the notification of the statement to the Spanish Agency for Data Protection.

6. The period of time referred to in the preceding paragraph may be suspended by reasoned decision where it is essential to obtain information from a court.

It is amended by final provision 9.4 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Article 65. Admissibility of claims.

1. When a complaint is submitted to the Spanish Data Protection Agency, the Spanish Data Protection Agency must evaluate its admissibility, in accordance with the provisions of this article.

2. The Spanish Data Protection Agency will not admit the complaints filed when they do not appear on issues of personal data protection, are manifestly unfounded, are abusive or do not provide any prima facie evidence of the existence of an infringement.

3. Likewise, the Spanish Data Protection Agency may inadmit the complaint when the controller or processor, upon warning from the Spanish Data Protection Agency, has taken corrective measures aimed at ending the possible breach of data protection legislation and any of the following circumstances occur:

(a) No harm has been caused to the person concerned in the case of the offences provided for in article 74 of this organic law.

(b) The right of the person concerned is fully guaranteed by the application of the measures.

4. Before deciding on the admissibility of the complaint, the Spanish Data Protection Agency may refer the complaint to the data protection delegate who has, where appropriate, designated the controller or controller, to the supervisory body established for the application of codes of conduct or to the body that assumes the functions of extrajudicial resolution of disputes for the purposes provided for in articles 37 and 38.2 of this organic law.

The Spanish Data Protection Agency may also refer the complaint to the controller or processor when no data protection delegate has been appointed or is affiliated to mechanisms for the extrajudicial resolution of disputes, in which case the controller or controller must respond to the complaint within one month.

If, as a result of such referral proceedings, the controller or processor demonstrates that he has taken measures to comply with the applicable rules, the Spanish Data Protection Agency may inadmissibly initiate the complaint.

5. The decision on the admission or inadmissibility to the proceedings, as well as the decision determining, where appropriate, the referral of the claim to the principal supervisory authority deemed competent, shall be notified to the claimant within three months. If such notification does not take place after this period, it shall be understood that the complaint continues to be processed in accordance with this Title from the date on which three months have elapsed since the complaint was entered into the Spanish Data Protection Agency, without prejudice to the Agency's ability to file the complaint at a later date and expressly.

In the event that the Spanish Data Protection Agency acts as a result of the communication sent to it by the supervisory authority of another Member State of the European Union, in accordance with Article 64.4 of this organic law, the calculation of the time limit referred to in the preceding paragraph shall begin once all the necessary documentation for its processing is received at the Agency.

Where the facts of a complaint relating to the possible existence within the Agency's competence bear a substantial identity with which they are the subject of previous investigative proceedings or of a sanctioning procedure already initiated, notification of the decision to admit the proceedings may indicate the file number corresponding to the previous proceedings or the corresponding procedure, as well as the web address in which the decision to terminate the investigation will be published, so that the complainant can be informed of the course and outcome of the investigation.

6. After admission to the procedure, if the controller or processor demonstrates that they have adopted measures to comply with the applicable regulations, the Spanish Data Protection Agency may resolve the file of the complaint, when in the specific case circumstances exist that advise the adoption of other solutions more moderate or alternative to the corrective action, provided that no prior investigation proceedings or any of the procedures regulated in this organic law have been initiated.

Paragraphs 4 and 5 are amended and paragraph 6 is added by final provision 9.5 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Article 66. Determination of territorial scope.

1. Except in the cases referred to in article 64.4 of this organic law, the Spanish Agency for the Protection of Data shall, prior to the performance of any other action, including the admission to the processing of a complaint or the initiation of prior investigative proceedings, examine its competence and determine the national or cross-border nature, in any of its modalities, of the procedure to be followed.

2. If the Spanish Data Protection Agency considers that it does not have the status of the principal supervisory authority for the processing of the procedure, it shall, without further processing, forward the complaint made to the principal supervisory authority it considers competent, in order that it may be given appropriate action. The Spanish Data Protection Agency shall notify such circumstances to any person who, if any, has made the complaint.

The agreement resolving the referral referred to in the preceding paragraph shall entail the provisional filing of the proceedings, without prejudice to the fact that the Spanish Data Protection Agency shall, if appropriate, issue the decision referred to in Article 60(8) of the Treaty. Regulation (EU) 2016/679.

Paragraph 1 is amended by final provision 9.6 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Article 67. Pre-investigation proceedings.

1. Prior to the adoption of the agreement to initiate proceedings, and once the complaint has been admitted to the proceedings if any, the Spanish Data Protection Agency may carry out prior investigation proceedings in order to obtain a better determination of the facts and circumstances justifying the procedure.

The Spanish Data Protection Agency will act in any case when it is necessary to investigate the processing involving a mass traffic of personal data.

2. The preliminary investigation proceedings shall be submitted to the provisions of Chapter I, Section 2a, of Title VII of this Organic Law and may not last more than eighteen months from the date of the agreement of admission for processing or the date of the agreement by which it is decided to initiate such proceedings when the Spanish Agency for the Protection of Data acts on its own initiative.

Paragraph 2 is amended by final provision 9.7 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Article 68. Agreement to initiate the procedure for the exercise of the sanctioning power.

1. If necessary, the proceedings referred to in the preceding article shall be concluded by the Presidency of the Spanish Data Protection Agency, where appropriate, to issue an agreement to initiate proceedings for the exercise of the sanctioning power, which shall specify the facts, the identification of the person or entity against whom the proceedings are directed, the offence that may have been committed and the possible sanction.

2. Where the Spanish Data Protection Agency has the status of the principal supervisory authority and the procedure provided for in Article 60 of the Treaty must be followed. Regulation (EU) 2016/679the draft agreement on the initiation of a sanctioning procedure shall be subject to the provisions of the agreement.

Article 69. Interim and duty-guarantee measures.

1. During the performance of the previous investigative proceedings or initiated a procedure for the exercise of the sanctioning power, the Spanish Data Protection Agency may agree on the grounds of reason for the provisional measures necessary and proportionate to safeguard the fundamental right to data protection, and in particular those provided for in Article 66.1 of the Convention. Regulation (EU) 2016/679, the precautionary blocking of data and the immediate obligation to comply with the requested right.

2. In cases where the Spanish Data Protection Agency considers that the continuation of the processing of personal data, its communication or international transfer would seriously impair the right to the protection of personal data, it may order those responsible or responsible for the processing to block the data and cease its processing and, in the event of failure to comply with these mandates, to freeze it.

3. Where a complaint concerning, inter alia, the lack of timely attention to the rights set out in Articles 15 to 22 of the Convention has been submitted to the Spanish Data Protection Agency, Regulation (EU) 2016/679the Spanish Agency for the Protection of Data may at any time, even before the initiation of the procedure for the exercise of the sanctioning power, by means of a reasoned decision and after hearing the controller, agree on the obligation to comply with the requested right, and the procedure continues with regard to the rest of the issues that are the subject of the complaint.

TITLE IX

Penalty regime

Article 70. Responsible subjects.

1. They are subject to the sanctioning regime established in the Regulation (EU) 2016/679 and in the present organic law:

(a) Those responsible for treatment.

(b) Those responsible for treatment.

(c) Representatives of those responsible for or responsible for treatment not established in the territory of the European Union.

(d) Certification bodies.

(e) Accredited entities monitoring codes of conduct.

2. The sanctioning regime set out in this Title shall not apply to the data protection delegate.

Article 71. Infractions.

The acts and conduct referred to in Article 83(4), (5) and (6) of the EEC Treaty are offences. Regulation (EU) 2016/679as well as those that are contrary to this organic law.

Article 72. Infringements considered very serious.

1. In accordance with the provisions of Article 83.5 of Regulation (EU) 2016/679 are considered to be very serious and shall prescribe at three years for infringements which constitute a substantial breach of the articles referred to in that article, and in particular the following:

(a) The processing of personal data in violation of the principles and guarantees set out in article 5 of the Convention Regulation (EU) 2016/679.

(b) The processing of personal data without any of the conditions for the lawfulness of processing laid down in Article 6 of the Convention; Regulation (EU) 2016/679.

(c) Failure to comply with the requirements of article 7 of the Convention Regulation (EU) 2016/679 for the validity of consent.

(d) The use of the data for a purpose that is not compatible with the purpose for which they were collected, without the consent of the person concerned or with a legal basis for this purpose.

(e) The processing of personal data of the categories referred to in Article 9 of the Convention Regulation (EU) 2016/679without any of the circumstances provided for in that provision and in article 9 of this organic law.

(f) The processing of personal data relating to convictions and criminal offences or related security measures outside the circumstances permitted by article 10 of the Convention; Regulation (EU) 2016/679 and in article 10 of this organic law.

(g) The processing of personal data relating to offences and administrative penalties outside the circumstances permitted by article 27 of this organic law.

(h) Failure to inform the person concerned of the processing of his or her personal data in accordance with articles 13 and 14 of the Convention; Regulation (EU) 2016/679 and 12 of this organic law.

(i) The violation of the duty of confidentiality established in article 5 of this organic law.

(j) The requirement for payment of a fee to provide the person concerned with the information referred to in Articles 13 and 14 of the Regulation (EU) 2016/679 or to comply with requests for the exercise of the rights of those concerned provided for in Articles 15 to 22 of Regulation (EU) 2016/679, other than the cases set out in Article 12.5.

(k) Impairment or obstruction or repeated failure to give effect to the rights set forth in articles 15 to 22 of the Convention Regulation (EU) 2016/679.

(l) The international transfer of personal data to a consignee in a third country or to an international organization, where the guarantees, requirements or exceptions set out in articles 44 to 49 of the Convention do not apply; Regulation (EU) 2016/679.

(m) Failure to comply with decisions issued by the data protection authority competent to exercise the powers conferred on it by Article 58(2) of the Treaty Regulation (EU) 2016/679.

(n) Failure to comply with the obligation to block the data provided for in article 32 of this organic law when it is enforceable.

(ñ) Not to facilitate access by the personnel of the competent data protection authority to personal data, information, premises, equipment and means of processing which are required by the data protection authority for the exercise of its investigative powers.

(o) Resistance or obstruction of the exercise of the inspection function by the competent data protection authority.

(p) Deliberate reversal of an anonymisation procedure in order to allow re-identification of the persons concerned.

2. They shall have the same consideration and shall also prescribe at three years the offences referred to in Article 83(6) of the Treaty. Regulation (EU) 2016/679.

Article 73. Infringements considered serious

In accordance with Article 83(4) of the Regulation (EU) 2016/679 serious offences involving a substantial breach of the articles referred to in that article, and in particular the following, shall be considered and shall be prescribed at two years:

(a) The processing of personal data of a minor without obtaining his or her consent, when he or she has the capacity to do so, or of the person who has parental authority or guardianship, in accordance with article 8 of the Convention; Regulation (EU) 2016/679.

(b) Failure to demonstrate reasonable efforts to verify the validity of consent given by a minor or by the holder of his parental authority or guardianship over him, as required by article 8.2 of the Convention; Regulation (EU) 2016/679.

(c) The impediment or obstruction or non-repeated attention to the rights of access, rectification, suppression, limitation of the processing or portability of data in processing where the identification of the data subject is not required, where the data subject, for the exercise of those rights, has provided additional information allowing their identification.

(d) Failure to adopt such technical and organisational measures as may be appropriate for the effective application of the principles of data protection from design, as well as the non-integration of the necessary guarantees in processing, as required by Article 25 of the Convention; Regulation (EU) 2016/679.

(e) Failure to adopt appropriate technical and organisational measures to ensure that, by default, only the personal data necessary for each of the specific purposes of processing shall be processed, as required by Article 25(2) of the Convention. Regulation (EU) 2016/679.

(f) Failure to adopt such technical and organisational measures as may be appropriate to ensure a level of safety appropriate to the risk of treatment, as required by Article 32(1) of the Convention. Regulation (EU) 2016/679.

(g) The breach, as a result of a lack of due diligence, of technical and organizational measures which have been implemented in accordance with the requirements of article 32.1 of the Convention. Regulation (EU) 2016/679.

(h) Failure to designate a representative of the controller or processor not established in the territory of the European Union, as provided for in Article 27 of the Convention; Regulation (EU) 2016/679.

(i) The lack of attention by the representative in the Union of the person responsible for processing applications made by the data protection authority or by those concerned.

(j) The procurement by the controller of a processor who does not provide sufficient guarantees to implement appropriate technical and organizational measures as provided for in Chapter IV of the Convention; Regulation (EU) 2016/679.

(k) To order the processing of data to a third party without the prior conclusion of a contract or other written legal act with the content required by Article 28(3) of the Regulation (EU) 2016/679.

(l) Contracting by a processor without prior authorization from the controller, or without having informed him of changes in subcontracting where they were legally enforceable.

(m) Infringement by a controller of the provisions of the Regulation (EU) 2016/679 and in this organic law, in determining the purposes and means of treatment, as provided for in article 28.10 of the said regulations.

(n) Failure to have the records of treatment activities set out in Article 30 of the Regulation (EU) 2016/679.

(ñ) Not to make available to the requested data protection authority, the registration of processing activities, in accordance with Article 30(4) of Regulation (EU) 2016/679.

(o) Failure to cooperate with the supervisory authorities in the performance of their duties in cases not provided for in article 72 of this organic law.

(p) The processing of personal data without carrying out a prior assessment of the elements mentioned in article 28 of this organic law.

(q) Failure to comply with the duty of the controller to notify the controller of any security violations of which he or she is aware.

(r) Failure to notify the data protection authority of a breach of security of personal data in accordance with Article 33 of the Convention; Regulation (EU) 2016/679.

(s) Failure to communicate to the person concerned a breach of data security in accordance with article 34 of the Convention. Regulation (EU) 2016/679 if the controller has been required by the data protection authority to carry out such notification.

(t) The processing of personal data without having carried out an assessment of the impact of processing operations on the protection of personal data in cases where such data is required.

(u) The processing of personal data without prior consultation of the data protection authority in cases where such consultation is required in accordance with Article 36 of the Convention; Regulation (EU) 2016/679 or when the law establishes an obligation to carry out such consultation.

(v) Failure to appoint a data protection delegate when his appointment is required in accordance with article 37 of the Convention. Regulation (EU) 2016/679 and article 34 of this organic law.

(w) Not to enable the effective participation of the data protection delegate in all matters relating to the protection of personal data, not to support or interfere in the performance of his/her duties.

(x) The use of a data protection stamp or certification that has not been granted by a duly accredited certification body or in the event that the validity of the certification has expired.

(y) Obtain accreditation as a certification body by submitting inaccurate information on compliance with the requirements of Article 43 of the Treaty; Regulation (EU) 2016/679.

(z) The performance of functions that the Regulation (EU) 2016/679 It reserves the right of the certification bodies, without having been duly accredited in accordance with article 39 of this organic law.

(aa) Failure by a certification body to comply with the principles and duties to which it is subject under articles 42 and 43 of the Convention; Regulation (EU) 2016/679.

(b) The performance of functions as provided for in article 41 of the Regulation (EU) 2016/679 reserve codes of conduct to supervisory bodies without prior accreditation by the competent data protection authority.

(c) The failure of accredited supervisory bodies to adopt a code of conduct of measures as appropriate in the event of a violation of the code, as required by Article 41.4 of the Convention; Regulation (EU) 2016/679.

Article 74. Infringements considered mild.

They are considered to be minor and shall prescribe annually the remaining offences of a purely formal nature of the articles referred to in Article 83(4) and (5) of the Treaty. Regulation (EU) 2016/679 and in particular:

(a) Failure to comply with the principle of transparency of information or the right of information of the person concerned by failing to provide all the information required by articles 13 and 14 of the Convention; Regulation (EU) 2016/679.

(b) The requirement to pay a fee to provide the person concerned with the information required by Articles 13 and 14 of the Treaty; Regulation (EU) 2016/679 or to comply with requests for the exercise of the rights of those concerned provided for in Articles 15 to 22 of Regulation (EU) 2016/679where Article 12.5 so permits, if the amount of the costs incurred exceeds the amount to provide the information or perform the requested action.

(c) Failure to comply with requests for the exercise of the rights set out in articles 15 to 22 of Regulation (EU) 2016/679unless the provisions of article 72.1 (k) of this organic law apply.

(d) Failure to comply with the rights of access, rectification, suppression, limitation of the processing or portability of data in which the identification of the person concerned is not required, where the person concerned has provided additional information for the exercise of those rights, enabling their identification, unless the provisions of article 73 (c) of this organic law are applied.

(e) Failure to comply with the notification obligation relating to the rectification or deletion of personal data or the limitation of processing required by Article 19 of the Regulation (EU) 2016/679.

(f) Failure to inform the person concerned, upon request, of the addressees to whom the personal data corrected, deleted or for which processing has been limited has been communicated.

(g) Failure to comply with the obligation to delete data relating to a deceased person where this is required under article 3 of this organic law.

(h) Failure by the controllers to process the agreement determining the respective obligations, functions and responsibilities with regard to the processing of personal data and their relations with those affected by Article 26 of the Convention; Regulation (EU) 2016/679 or inaccuracy in determining them.

(i) Failure to make available to the affected parties the essential aspects of the formalized agreement between the co-responsibles of the treatment, as required by Article 26(2) of the Regulation (EU) 2016/679.

(j) Failure to comply with the obligation of the controller to inform the controller of the possible violation of the provisions of the Convention by an investigation received from the controller; Regulation (EU) 2016/679 or of this organic law, as required by article 28.3 of the said regulations.

(k) Failure by the person responsible to comply with the terms of the contract or legal act governing the treatment or instructions of the controller, unless he is legally bound to do so under the terms of the Regulation (EU) 2016/679 and this organic law or in cases where it is necessary to prevent a breach of data protection legislation and the controller or processor has been notified thereof.

(l) To have a register of processing activities that does not incorporate all the information required by article 30 of the Convention; Regulation (EU) 2016/679.

(m) Incomplete, late or defective notification to the data protection authority of information relating to a breach of security of personal data in accordance with Article 33 of the Convention; Regulation (EU) 2016/679.

(n) Failure to document any security breach required by article 33.5 of the Convention Regulation (EU) 2016/679.

(ñ) Failure to communicate to the person concerned a violation of the security of the data which poses a high risk to the rights and freedoms of those concerned, as required by article 34 of the Convention. Regulation (EU) 2016/679unless the provisions of article 73 (s) of this organic law apply.

(o) To provide inaccurate information to the Data Protection Authority, in cases where the controller is required to consult it in advance, in accordance with Article 36 of the Convention. Regulation (EU) 2016/679.

(p) Failure to publish the contact details of the data protection delegate, or not to communicate them to the data protection authority, where their appointment is required in accordance with Article 37 of the Regulation (EU) 2016/679 and article 34 of this organic law.

(q) Failure by certification bodies to inform the data protection authority of the issue, renewal or withdrawal of a certificate, as required by Article 43(1) and (5) of Regulation (EU) 2016/679.

(r) Failure by accredited supervisory bodies to comply with a code of conduct to inform the data protection authorities of appropriate measures in the event of a breach of the code, as required by Article 41.4 of Regulation (EU) 2016/679.

Article 75. Interruption of the statute of limitations of the offence.

The statute of limitations shall be interrupted if, with the knowledge of the person concerned, the penalty procedure is initiated, and the limitation period is reinitiated if the penalty file is paralysed for more than six months for reasons not attributable to the alleged offender.

Where the Spanish Data Protection Agency has the status of the principal supervisory authority and the procedure provided for in Article 60 of the Treaty must be followed. Regulation (EU) 2016/679 The requirement shall be interrupted by the formal knowledge of the starting agreement by the party concerned.

Paragraph 2 is amended by final provision 9.8 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Article 76. Penalties and corrective measures.

1. The penalties provided for in Article 83(4), (5) and (6) of the Treaty Regulation (EU) 2016/679 shall apply taking into account the graduation criteria laid down in paragraph 2 of that Article.

2. In accordance with Article 83(2)(k) of the Treaty, Regulation (EU) 2016/679 account may also be taken of:

(a) The continuing nature of the offence.

(b) Linking the activity of the offender to the processing of personal data.

(c) The benefits derived from the commission of the infringement.

(d) The possibility that the conduct of the person concerned might have led to the commission of the offence.

(e) The existence of a merger procedure for post-infringement absorption, which cannot be attributed to the absorbing entity.

(f) The impact on the rights of minors.

(g) To have, where it is not mandatory, a data protection delegate.

(h) Subjection by the person responsible or responsible, on a voluntary basis, to alternative dispute resolution mechanisms, in cases where disputes exist between those persons and any interested party.

3. It is possible, in addition to or alternatively, to take, where appropriate, the remaining corrective measures referred to in Article 83(2) of the Treaty. Regulation (EU) 2016/679.

4. Information identifying the offender, the offence committed and the amount of the penalty imposed when the competent authority is the Spanish Data Protection Agency, the penalty is more than one million euros and the offender is a legal person shall be published in the Official Gazette of the State.

Where the authority competent to impose the sanction is an autonomous data protection authority, its implementing rules shall be complied with.

Article 77. Conditions applicable to certain categories of controllers or processors.

1. The arrangements laid down in this Article shall apply to the treatments for which they are responsible or responsible:

(a) Constitutional bodies or bodies of constitutional relevance and institutions of the autonomous communities similar to them.

(b) The courts.

(c) The General Administration of the State, the Administrations of the Autonomous Communities and the entities that make up the Local Government.

(d) Public bodies and bodies governed by public law which are linked to or dependent on public administrations.

(e) Independent administrative authorities.

(f) Banco de España.

(g) Public law corporations where the purposes of the treatment relate to the exercise of public law powers.

(h) Public sector foundations.

(i) Public universities.

(j) Consortiums.

(k) The parliamentary groups of the Cortes Generales and the Autonomous Legislative Assemblies, as well as the political groups of the Local Corporations.

2. Where the persons responsible for or responsible for the offences referred to in paragraph 1 have committed any of the offences referred to in Articles 72 to 74 of this organic law, the competent data protection authority shall issue a decision declaring the offence and, where appropriate, laying down the measures to be taken to ensure that the conduct ceases or the effects of the offence committed are corrected, with the exception of that provided for in Article 58(2) of the Code. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

The decision shall be notified to the controller or processor, to the body to which it reports, if any, and to those concerned who have the status of the controller, if any.

3. Without prejudice to the provisions of the preceding paragraph, the data protection authority shall also propose the initiation of disciplinary proceedings where there is sufficient evidence to do so. In this case, the procedure and penalties to be applied shall be those laid down in the legislation on disciplinary or sanctioning arrangements that are applicable.

In addition, where the offences are attributable to authorities and managers, and where technical reports or recommendations for treatment have been established that have not been duly addressed, the decision imposing the sanction shall include a warning with the title of the office responsible and shall be ordered to be published in the Official Gazette of the State or Autonomous Region concerned.

4. The data protection authority shall be informed of the decisions taken in relation to the measures and actions referred to in the preceding paragraphs.

5. The Ombudsman or, where appropriate, similar institutions of the Autonomous Communities shall be informed of the actions taken and decisions taken under this Article.

6. When the competent authority is the Spanish Data Protection Agency, the Spanish Data Protection Agency shall publish on its website with due separation the decisions concerning the entities referred to in paragraph 1 of this article, with express indication of the identity of the person responsible for or responsible for the treatment that the infringement has committed.

Where the competition falls within the competence of an autonomous data protection authority, it shall, as regards the publicity of these decisions, be subject to the provisions of its specific rules.

Paragraph 2 is amended by final provision 9.9 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Article 78. Statute of limitations on sanctions.

1. The sanctions imposed under the Regulation (EU) 2016/679 and this organic law prescribes within the following time limits:

(a) Penalties amounting to EUR 40,000 or less are prescribed within one year.

(b) Penalties ranging from Euro40,001 to Euro300,000 are prescribed within two years.

(c) Penalties of more than Euro300,000 are prescribed for three years.

2. The limitation period for sanctions shall begin to run from the day following the day on which the decision imposing the penalty is enforceable or the period for appealing has elapsed.

3. The limitation period shall be interrupted by the initiation, with the data subject's knowledge, of the enforcement procedure and the re-expiration of the period if it is paralysed for more than six months for reasons not attributable to the offender.

TITLE X

Guarantee of digital rights

Article 79. Rights in the Digital Age.

The rights and freedoms enshrined in the Constitution and to the international treaties and conventions to which Spain is a party are fully applicable on the Internet. Information society service providers and Internet service providers will help ensure its implementation.

Article 80. Right to Internet neutrality.

Users have the right to Internet neutrality. Internet service providers shall provide a transparent offer of services without discrimination on technical or economic grounds.

Article 81. Right of universal access to the Internet.

1. Everyone has the right to access the Internet regardless of his or her personal, social, economic or geographical status.

2. Universal, affordable, quality and non-discriminatory access will be ensured for the entire population.

3. Access to the Internet for both men and women will seek to bridge the gender gap in both the personal and labour spheres.

4. Access to the Internet will seek to bridge the generation gap through actions aimed at training and access to the elderly.

5. The effective guarantee of the right of access to the Internet will address the specific realities of rural environments.

6. Access to the Internet should ensure equal conditions for persons with special needs.

Article 82. Right to digital security.

Users have the right to the security of communications transmitted and received via the Internet. Internet service providers shall inform users of their rights.

Article 83. The right to digital education.

1. The education system will ensure the full integration of students into the digital society and the learning of responsible consumption and the critical and safe use of digital media and respectful of human dignity, social justice and environmental sustainability, constitutional values, fundamental rights and, in particular, respect for and guarantee of personal and family privacy and the protection of personal data. Actions in this area will be inclusive, particularly with regard to students with special educational needs.

Education administrations should include in the curriculum development the digital competence referred to in the preceding paragraph, as well as elements related to risk situations arising from the inadequate use of ICTs, with particular attention to situations of violence in the network.

2. Teachers shall receive the digital skills and training necessary for the teaching and transmission of the values and rights referred to in the preceding paragraph.

3. The curricula for university degrees, in particular those that enable students to perform their professional training, will ensure training in the use and security of digital media and the guarantee of fundamental rights on the Internet.

4. Public Administrations shall incorporate into the subjects of the tests of access to the superior bodies and those in which functions usually involve access to personal data matters related to the guarantee of digital rights and in particular data protection.

Paragraph 1 is amended by final provision 4 of Organic Law 3/2020 of 29 December. Ref. BOE-A-2020-17264

Article 84. Protection of minors on the Internet.

1. Parents, guardians, curators or legal representatives shall ensure that minors make balanced and responsible use of digital devices and information society services in order to ensure the proper development of their personality and to preserve their dignity and fundamental rights.

2. The use or dissemination of images or personal information of minors on social networks and equivalent information society services which may involve unlawful interference with their fundamental rights shall determine the intervention of the Public Prosecutor's Office, which shall require the precautionary and protective measures provided for in the Organic Law 1/1996 of 15 January 1996Legal Protection of Minors.

Article 85. Right to rectification on the Internet.

1. Everyone has the right to freedom of expression on the Internet.

2. Social media and equivalent services officials shall adopt appropriate protocols to enable users to exercise the right to rectification by disseminating content that infringes the right to honour, personal and family privacy on the Internet and the right to freely communicate or receive truthful information, in accordance with the requirements and procedures laid down in the Organic Law 2/1984 of 26 March 1984, regulating the right of rectification.

When the digital media must comply with the request for rectification made against them, they must publish in their digital archives a clarifying notice showing that the original news does not reflect the current situation of the individual. Such notice shall appear in a visible place together with the original information.

Article 86. Right to update information in digital media.

Every person has the right to request, on a reasoned basis, from the digital media the inclusion of a sufficiently visible update notice together with the news concerning him or her when the information contained in the original news does not reflect his or her current situation as a result of circumstances that would have occurred after publication, causing him or her harm.

In particular, such notice shall be included where the original information relates to police or judicial proceedings which have been affected for the benefit of the person concerned as a result of subsequent judicial decisions. In this case, the notice shall refer to the subsequent decision.

Article 87. Right to privacy and use of digital devices in the workplace.

1. Workers and public employees shall be entitled to the protection of their privacy in the use of digital devices made available to them by their employer.

2. The employer may access the content derived from the use of digital media provided to workers for the sole purpose of monitoring compliance with labour or statutory obligations and ensuring the integrity of such devices.

3. Employers must establish criteria for the use of digital devices in accordance with the minimum standards for the protection of their privacy in accordance with social usages and constitutionally and legally recognized rights. Workers' representatives shall be involved in the preparation of the report.

Access by the employer to the content of digital devices for which it has admitted its use for private purposes will require that the authorized uses be specified in a precise manner and guarantees be established to preserve the privacy of workers, such as, where appropriate, the determination of the periods during which the devices may be used for private purposes.

Workers shall be informed of the criteria for use referred to in this paragraph.

Article 88. The right to digital disconnection in the workplace.

1. Public workers and employees shall have the right to digital disconnection in order to ensure, outside legally or conventionally established working time, respect for their rest time, leave and vacation, as well as their personal and family privacy.

2. The arrangements for exercising this right shall take account of the nature and purpose of the employment relationship, enhance the right to reconciliation of work and personal and family life and shall be subject to collective bargaining or, failing that, to the agreement between the undertaking and the workers' representatives.

3. The employer shall, after hearing the workers' representatives, draw up an internal policy for workers, including those in managerial positions, defining the modalities for exercising the right to disconnect, training and awareness-raising activities for staff on the reasonable use of technological tools to avoid the risk of computer fatigue. In particular, the right to digital disconnection shall be preserved in cases of full or partial performance of distance work as well as in the home of the employee linked to the use of technological tools for work purposes.

Article 89. Right to privacy from the use of video surveillance and sound recording devices in the workplace.

1. Employers may treat images obtained through camera systems or camcorders for the exercise of the control functions of workers or public employees as provided for in Article 20(3) of the Convention. Workers' Statute and in the civil service legislation, provided that these functions are exercised within their legal framework and within the limits inherent therein. Employers shall inform workers or public employees and their representatives, where appropriate, of this measure in a prior and explicit, clear and concise manner.

In the event that the flagrant commission of an unlawful act by workers or public employees has been detected, the duty to inform shall be deemed to have been fulfilled when at least the device referred to in article 22.4 of this organic law exists.

2. In no case shall the installation of sound recording or video surveillance systems be allowed in places intended for the rest or recreation of workers or public employees, such as changing rooms, toilets, dining rooms and the like.

3. The use of systems similar to those referred to in the preceding paragraphs for the recording of sounds at the workplace shall be permitted only where the safety risks of installations, goods and persons arising from the activity taking place at the workplace are relevant and in accordance with the principle of proportionality, minimum intervention and the guarantees provided for in the preceding paragraphs. The deletion of the sounds preserved by these recording systems shall be carried out in accordance with the provisions of Article 22(3) of this Law.

Article 90. Right to privacy in the face of the use of geolocation systems in the workplace.

1. Employers may process data obtained through geolocation systems for the exercise of the control functions of public employees or employees provided for in Article 20(3) of the Convention, respectively. Workers' Statute and in the civil service legislation, provided that these functions are exercised within their legal framework and within the limits inherent therein.

2. Prior to this, employers must expressly, clearly and unequivocally inform public workers or employees and, where appropriate, their representatives of the existence and characteristics of these devices. They should also inform them about the possible exercise of the rights of access, rectification, limitation of treatment and suppression.

Article 91. Digital rights in collective bargaining.

Collective agreements may provide additional guarantees for the rights and freedoms related to the processing of workers' personal data and the safeguarding of digital rights in the field of employment.

Article 92. Data protection of minors on the Internet.

Educational institutions and any natural or legal persons engaged in activities involving minors shall ensure the protection of the best interests of the child and his or her fundamental rights, in particular the right to the protection of personal data, in the publication or dissemination of his or her personal data through information society services.

Where such publication or dissemination is to take place through social media services or equivalent services, they shall have the consent of the minor or his legal representatives, as prescribed in article 7 of this organic law.

Article 93. Right to forget about Internet searches.

1. Everyone has the right to have Internet search engines remove from the lists of results obtained after a search carried out from his or her name published links containing information relating to that person when they were inadequate, inaccurate, irrelevant, unupdated or excessive or had become such over time, taking into account the purposes for which they were collected or treated, the time elapsed and the nature and public interest of the information.

Similarly, it should be done when the personal circumstances invoked by the affected person in his case demonstrate the prevalence of his rights over the maintenance of links by the Internet search service.

This right shall continue even if it is lawful to retain the information published on the website to which the link is addressed and does not proceed by it to its prior or simultaneous deletion.

2. The exercise of the right referred to in this article shall not prevent access to information published on the website through the use of search criteria other than the name of the person exercising the right.

Article 94. Right to be forgotten in social media services and equivalent services.

1. Everyone has the right to have deleted, at his simple request, the personal data he would have provided for publication by equivalent social media services and information society services.

2. Every person has the right to have deleted personal data concerning him or her that were provided by third parties for publication by the social media services and equivalent information society services where they were inadequate, inaccurate, not relevant, not updated or excessive or had become such over time, taking into account the purposes for which they were collected or treated, the time elapsed and the nature and public interest of the information.

Similarly, the deletion of such data should be carried out where the personal circumstances invoked by the data subject in his case demonstrate the prevalence of his rights over the maintenance of the data by the service.

Except as provided for in this paragraph, data provided by natural persons in the course of personal or domestic activities shall be excluded.

3. Where the right is exercised by an affected person in respect of data supplied to the service, by him or by third parties, during his or her minority, the provider shall proceed without delay to its deletion by simple application, without the circumstances referred to in paragraph 2.

Article 95. Right of portability in social media services and equivalent services.

Users of equivalent social network services and information society services shall be entitled to receive and transmit the content they have provided to the providers of such services and to have the providers transmit it directly to another provider designated by the user, where technically possible.

Providers may keep copies of the contents without dissemination via the Internet when such preservation is necessary for the fulfilment of a legal obligation.

Article 96. Right to the digital will.

1. Access to content managed by information society service providers on deceased persons shall be governed by the following rules:

(a) Persons linked to the deceased for family or de facto reasons, as well as their heirs, may address the information society service providers in order to access such content and give them any instructions they deem appropriate on its use, destination or deletion.

As an exception, the above-mentioned persons shall not have access to the contents of the deceased, nor may they request their modification or elimination, if the deceased has expressly prohibited or provided for by law. This prohibition shall not affect the right of the heirs to access the contents which may be part of the relicto.

(b) The testamentary executor and the person or institution to which the deceased has expressly designated for this purpose may also request, in accordance with the instructions received, access to the contents with a view to complying with such instructions.

(c) In the case of deceased minors, these powers may also be exercised by their legal representatives or, within their competence, by the Public Prosecutor ' s Office, which may act on its own initiative or at the request of any natural or legal person concerned.

(d) In the event of the death of persons with disabilities, these powers may also be exercised, in addition to those referred to in the preceding paragraph, by those who have been appointed to the exercise of support functions if such powers are understood to fall within the support measures provided by the designated person.

2. The persons entitled in the preceding paragraph may decide on the maintenance or removal of the personal profiles of persons who have died on social networks or equivalent services, unless the deceased has decided on this circumstance, in which case they shall be placed under their instructions.

The person responsible for the service to which the application for the removal of the profile is communicated, in accordance with the preceding paragraph, shall proceed without delay.

3. The royal decree shall establish the requirements and conditions for proving the validity and validity of the mandates and instructions and, where appropriate, the registration thereof, which may coincide with that provided for in article 3 of this organic law.

4. The provisions of this article in relation to persons who have died in the autonomous communities with civil, foral or special law, shall be governed by the provisions of this article within its scope.

Article 97. Policies to promote digital rights.

1. The Government, in collaboration with the Autonomous Communities, will develop an Internet Access Plan with the following objectives:

(a) Overcoming digital divides and ensuring Internet access for vulnerable or special-needs groups and for economically disadvantaged family and social environments through, inter alia, a social Internet access voucher;

(b) promote the existence of public access connecting spaces; and

(c) Promote educational measures that promote training in basic digital skills and skills for people and groups at risk of digital exclusion and the ability of all people to make autonomous and responsible use of the Internet and digital technologies.

2. An Action Plan will also be adopted to promote the training, dissemination and awareness-raising activities necessary to ensure that minors make balanced and responsible use of digital devices and social networks and equivalent information society services on the Internet in order to ensure their proper development of personality and to preserve their dignity and fundamental rights.

3. The Government shall submit an annual report to the relevant parliamentary committee of the Congress of Deputies, in which it shall report on developments in the rights, guarantees and mandates provided for in this Title and on the measures necessary to promote its promotion and effectiveness.

Additional provision one. Security measures in the public sector.

1. The National Security Scheme shall include measures to be implemented in the event of the processing of personal data in order to prevent their loss, alteration or unauthorized access, adapting the risk assessment criteria for the processing of data to the requirements of Article 32 of the Convention. Regulation (EU) 2016/679.

2. The persons responsible listed in Article 77.1 of this organic law shall apply to the processing of personal data the security measures that correspond to those provided for in the National Security Scheme, as well as promote a degree of implementation of equivalent measures in companies or foundations linked to them subject to private law.

In cases where a third party provides a service under concession, management or contract, the security measures shall correspond to those of the original public administration and shall conform to the National Security Scheme.

Second additional provision. Data protection and transparency and access to public information.

Active advertising and access to public information regulated by the Title I of Law 19/2013 of 9 December 2013, transparency, access to public information and good governance, as well as the active publicity obligations laid down by regional legislation, shall be subject, where the information contains personal data, to the provisions of Articles 5.3 and 15 of Law 19/2013, in the Regulation (EU) 2016/679 and in the present organic law.

Additional provision three. Compute deadlines.

The time limits laid down in the Regulation (EU) 2016/679 or in this organic law, irrespective of whether they relate to relations between individuals or with public sector entities, they shall be governed by the following rules:

(a) When the time limits are indicated by days, they are understood to be working, excluding Saturdays, Sundays and public holidays.

(b) If the deadline is set in weeks, it shall end on the same day of the week in which the event that determines its commencement in the week of expiry occurred.

(c) If the period is set at months or years, it shall end on the same day as the event that determines its initiation in the month or year of expiry. If there is no day in the month of expiry equivalent to that on which the calculation begins, the period shall be deemed to expire on the last day of the month.

(d) When the last day of the period of time is inviolable, it shall be deemed to be extended to the first working day following.

Additional provision four. Procedure in relation to the powers conferred on the Spanish Data Protection Agency by other laws.

The provisions of Title VIII and its implementing rules shall apply to the procedures that the Spanish Data Protection Agency would have to process in exercise of the powers conferred on it by other laws.

Additional provision 5. Judicial authorisation in relation to decisions of the European Commission on international data transfer.

1. Where a data protection authority considers that a decision of the European Commission on the international transfer of data, the validity of which would depend on the resolution of a specific procedure, would infringe the provisions of the Convention on the Protection of Data from All Forms of Discrimination against Women, Regulation (EU) 2016/679, in breach of the fundamental right to data protection, shall immediately agree to suspend the proceedings in order to request the judicial authority to give the decision in the proceedings before it. Such suspension shall be confirmed, amended or terminated in the agreement on admission or inadmissibility of the request of the data protection authority addressed to the competent court.

The decisions of the European Commission to which this channel may apply are:

(a) those declaring the appropriate level of protection of a third country or international organization under article 45 of the Convention; Regulation (EU) 2016/679;

(b) those approving standard data protection clauses for international data transfers; or

(c) those declaring the validity of codes of conduct for that purpose.

2. The authorization referred to in this provision may be granted only if, following a preliminary ruling on the validity of Article 267 of the Treaty, the Treaty on the Functioning of the European Union, the European Commission's contested decision was declared invalid by the Court of Justice of the European Union.

Additional provision 6. Incorporation of debts into credit information systems.

Credit information systems referred to in Article 20.1 of this organic law shall not be incorporated in debt in which the amount of the principal is less than 50 euros.

The Government may, by royal decree, update this amount.

Additional provision 7. Identification of the parties to the notifications by means of announcements and publications of administrative acts.

1. Where the publication of an administrative act containing personal data of the person concerned is necessary, the person concerned shall be identified by his or her first name and surname, adding four random numerical figures of the national identity document, foreign identity number, passport or equivalent document. Where the publication relates to a plurality of affected those random figures shall be alternated.

In the case of notification by means of notices, in particular in the cases referred to in the Article 44 of Law 39/2015 of 1 October 2015, of the Common Administrative Procedure of the Public Administrations, the person concerned shall be identified exclusively by the full number of his national identity document, foreign identity number, passport or equivalent document.

Where the person concerned is missing any of the documents mentioned in the two preceding paragraphs, the person concerned shall be identified only by his or her first and last names. In no case should the name and surname be published in conjunction with the full number of the national identity document, foreign identity number, passport or equivalent document.

2. In order to prevent risks to victims of gender-based violence, the Government will promote the development of a collaborative protocol defining safe procedures for publication and notification of administrative acts, with the participation of the relevant bodies.

Additional provision 8th. Power of verification of public administrations.

Where requests are made by any means in which the data subject declares personal data held by the public authorities, the body receiving the request may, in the exercise of its powers, carry out the checks necessary to verify the accuracy of the data.

Additional provision 9th. Processing of personal data in connection with the notification of security incidents.

Where security incidents are to be reported in accordance with applicable national legislation, competent public authorities, computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), electronic communications network and service providers and security technology and services providers may process personal data contained in such notifications only for the time and scope necessary for their analysis, detection, protection and response to incidents and taking appropriate security measures proportionate to the level of risk.

Additional provision 10th. Data communications by the subjects listed in Article 77.1.

The persons responsible listed in article 77.1 of this organic law may communicate the personal data requested by private law subjects when they have the consent of the persons concerned, or if they appreciate that a legitimate interest in the applicants prevails over the rights and interests of the persons concerned as provided for in article 6.1 (f) of the Convention. Regulation (EU) 2016/679.

11th additional provision. Privacy in electronic communications.

The provisions of this Organic Law shall be without prejudice to the application of the rules of national law and of the European Union governing privacy in the field of electronic communications, without imposing additional obligations on natural or legal persons with regard to processing in the context of the provision of public electronic communications services on public communication networks in areas where they are subject to specific obligations laid down in those rules.

Additional provision twelfth. Specific provisions applicable to the processing of public sector personnel records.

1. The processing of records of public sector personnel shall be deemed to have been carried out in the exercise of public authority conferred on their officials, in accordance with Article 6.1(e) of the Treaty. Regulation (EU) 2016/679.

2. Public sector personnel records may process personal data relating to criminal offences and convictions and administrative offences and penalties, limited to the data strictly necessary for the fulfilment of their purposes.

3. In accordance with Article 18(2) of the Regulation (EU) 2016/679, and as a reason of important public interest, data the processing of which has been limited pursuant to Article 18(1) of that Regulation may be processed where necessary for the conduct of personnel procedures.

Additional provision thirteenth. International transfers of tax data.

Transfers of tax data between the Kingdom of Spain and other international or supranational States or entities shall be governed by the terms and limits set out in the rules on mutual assistance between the States of the European Union, or within the framework of conventions to prevent double taxation or other international conventions, as well as by the rules on mutual assistance laid down in the Chapter VI of Title III of Law 58/2003 of 17 December 2003General Tax.

Fourteenth additional provision. Rules issued pursuant to Article 13 of the Directive 95/46/EC.

The rules adopted pursuant to Article 13 of the Directive 95/46/EC of the European Parliament and the Council of 24 October 1995concerning the protection of individuals with regard to the processing of personal data and the free movement of such data, which had entered into force before 25 May 2018, and in particular Articles 23 and 24 of Organic Law 15/1999 of 13 December 1999, of Personal Data Protection, remain in force until expressly modified, replaced or repealed.

Additional provision 15th. Information requirement by the National Securities Market Commission.

Where the National Securities Market Commission has been unable to obtain by other means the information necessary to carry out its monitoring and inspection tasks related to the detection of serious offences, it may obtain from operators providing publicly available electronic communications services and information society service providers the data in their possession relating to electronic communication or information society service provided by such providers which are distinct from their content and essential for the performance of such tasks.

The transfer of these data will require the prior obtaining of judicial authorization granted in accordance with the procedural rules.

It is amended by final provision 4.3 of Organic Law 7/2021 of 26 May. Ref. BOE-A-2021-8806

Additional provision 16th. Aggressive practices in data protection.

For the purposes envisaged in the Article 8 of Law 3/1991 of 10 January 1991, of Unfair Competition, the following are considered aggressive practices:

(a) Act with the intention of supplanting the identity of the Spanish Data Protection Agency or of an autonomous data protection authority in the execution of any communication to the controllers and processors or to the interested parties.

(b) Generate the appearance that it is acting on behalf, on behalf of or in collaboration with the Spanish Data Protection Agency or an autonomous data protection authority in the execution of any communication to those responsible for and responsible for the processing in which the sender offers its products or services.

(c) Conduct commercial practices that restrict the decision-making power of the addressees by referring to the possible imposition of penalties for non-compliance with personal data protection regulations.

(d) To offer any type of document which seeks to create an appearance of compliance with the data protection provisions in addition to the carrying out of training actions without having carried out the necessary actions to verify that such compliance actually takes place.

e) To assume, without the express designation of the controller or controller, the function of data protection delegate and to communicate in that capacity with the Spanish Data Protection Agency or the regional data protection authorities.

Additional provision 17th. Treatment of health data.

1. They are covered by Article 9.2(g), (h), (i) and (j) of the Treaty. Regulation (EU) 2016/679 the processing of health-related data and genetic data which are regulated by the following laws and their development provisions:

(a) The Law 14/1986 of 25 AprilGeneral of Health.

(b) The Act No. 31/1995 of 8 November 1995, of Occupational Risk Prevention.

(c) The Law 41/2002 of 14 November 2002, basic regulation of patient autonomy and of rights and obligations in the field of clinical information and documentation.

(d) The Law 16/2003 of 28 Maythe cohesion and quality of the National Health System.

(e) The Law 44/2003 of 21 November, for the management of the health professions.

(f) The Law 14/2007 of 3 July, from biomedical research.

(g) The Act No. 33/2011 of 4 October 2011General of Public Health.

(h) The Law 20/2015 of 14 July, of management, supervision and solvency of insurance and reinsurers.

(i) The consolidated text of the Law on Guarantees and Wise Use of 105 Medicines and Medical Devices, adopted by Royal Legislative Decree 1/2015 of 24 July 2015.

(j) The Consolidated text of the General Law on the Rights of Persons with Disabilities and Their Social Inclusion, approved by Royal Legislative Decree 1/2013 of 29 November.

2. Data processing in health research shall be governed by the following criteria:

(a) The data subject or, where appropriate, his or her legal representative may consent to the use of his or her data for health research purposes, and in particular biomedical research. Such purposes may cover categories related to general areas related to a medical or research specialty.

(b) Health authorities and public institutions competent to monitor public health may conduct scientific studies without the consent of those concerned in situations of exceptional relevance and seriousness to public health.

(c) The re-use of personal data for health and biomedical research purposes shall be considered lawful and compatible when, having obtained consent for a specific purpose, data are used for purposes or areas of research related to the area in which the initial study was scientifically integrated.

In such cases, those responsible shall publish the information provided for in Article 13 of the Treaty. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016concerning the protection of individuals with regard to the processing of their personal data and the free movement of such data, in an easily accessible place on the corporate website of the centre where the clinical investigation or study is carried out, and where appropriate in that of the sponsor, and to notify the existence of this information by electronic means to those concerned. Where the latter do not have the means to access such information, they may request its transmission in another format.

For the treatments provided for in this letter, a favourable preliminary report from the research ethics committee shall be required.

(d) The use of pseudonymized personal data for health research purposes and, in particular, biomedical data is considered lawful.

The use of pseudonymized personal data for public health and biomedical research purposes shall require:

1. A technical and functional separation between the research team and those who perform pseudonymization and retain the information that enables reidentification.

2. That pseudonymized data are only accessible to the investigation team when:

(i) There is an express commitment to confidentiality and not to engage in any reidentification activity.

(ii) Specific security measures should be taken to prevent re-identification and access by unauthorized third parties.

Data may be reidentified at their source, where an investigation using pseudo-animized data shows that there is a real and specific danger to the safety or health of a person or group of persons, or a serious threat to their rights or is necessary to ensure adequate health care.

(e) When processing personal data for health research, and in particular biomedical data, for the purposes of Article 89(2) of the Regulation (EU) 2016/679the rights of those concerned provided for in Articles 15, 16, 18 and 21 of Regulation (EU) No 1303/2013 may be waived. 2016/679 when:

1. These rights are exercised directly before researchers or research centres using anonymized or pseudonymized data.

2. The exercise of such rights relates to the results of the investigation.

3. The purpose of the investigation is an essential public interest related to State security, defence, public security or other important objectives of general public interest, provided that in the latter case the exception is expressly covered by a rule of law.

(f) When under article 89 of the Regulation (EU) 2016/679a treatment is carried out for the purpose of public health research and in particular biomedical treatment shall be carried out:

1. To carry out an impact assessment to determine the risks arising from treatment in the cases provided for in Article 35 of the Convention. Regulation (EU) 2016/679 or those established by the supervisory authority. This assessment shall specifically include the risks of reidentification linked to the anonymisation or pseudonymisation of the data.

2. To subject scientific research to quality standards and, where appropriate, to international guidelines on good clinical practice.

3. Take, where appropriate, measures to ensure that investigators do not access data identifying the persons concerned.

4. Designate a legal representative established in the European Union, in accordance with Article 74 of the Regulation (EU) 536/2014, if the sponsor of a clinical trial is not established in the European Union. Such legal representative may coincide with that provided for in Article 27(1) of the Regulation (EU) 2016/679.

(g) The use of pseudonymized personal data for public health research purposes and, in particular, biomedical data should be submitted to the previous report of the ethics committee of the research provided for in the sectoral regulations.

In the absence of such a committee, the entity responsible for the investigation shall require a prior report from the data protection delegate or, failing that, an expert with the prior knowledge in Article 37(5) of the Regulation (EU) 2016/679.

(h) Within one year of the entry into force of this Act, research ethics committees in the field of health, biomedical or medicinal products shall include a data protection delegate or, failing that, an expert with sufficient knowledge of the law. Regulation (EU) 2016/679 where they are engaged in research activities involving the processing of personal data or pseudonymised or anonymised data.

Eighteenth additional provision. Safety criteria.

The Spanish Data Protection Agency will develop, with the collaboration, when necessary, of all the actors involved, the tools, guidelines, guidelines and guidelines that are necessary to provide professionals, micro, small and medium-sized enterprises with adequate guidelines for the fulfilment of the obligations of active responsibility set out in Title IV of the Convention. Regulation (EU) 2016/679 and in Title V of this organic law.

Nineteenth additional provision. Rights of minors to the Internet.

Within one year of the entry into force of this organic law, the Government will submit to the Congress of Deputies a draft law specifically aimed at guaranteeing the rights of minors to the impact of the Internet, in order to guarantee their safety and to combat the discrimination and violence against them that is exercised through new technologies.

Additional provision 20th. Specialities of the legal regime of the Spanish Data Protection Agency.

1. The Spanish Agency for Data Protection shall not apply to the Article 50(2)(c) of Law 40/2015 of 1 October, of Public Sector Legal Regime.

2. The Spanish Data Protection Agency may accede to the centralised procurement systems established by the Public Administrations and participate in the shared management of common services provided for in the Article 85 of Law 40/2015 of 1 October, of Public Sector Legal Regime.

Additional provision twenty-first. Digital education.

The education authorities shall carry out the mandate contained in the second subparagraph of Article 83(1) of this organic law within one year of its entry into force.

Additional provision twenty-second. Access to public and ecclesiastical archives.

The competent public authorities shall facilitate access to public and ecclesiastical archives in relation to data requested in connection with police or judicial investigations of missing persons, and shall promptly and diligently respond to requests by religious institutions or congregations to which requests for access are made.

Additional provision twenty-third. Claims filing models.

The Spanish Data Protection Agency may establish models for filing complaints to the Agency in all areas in which it has competence, which will be mandatory for interested parties regardless of whether or not they are obliged to interact electronically with public administrations.

The models will be published in the ''Official State Gazette'' and at the Electronic Headquarters of the Spanish Data Protection Agency and will be bound to comply with the month of its publication in the ''Official State Gazette'''.

It is added by final provision 9.10 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Text added, published on 09/05/2023, in force from 10/05/2023.

Transitional provision 1st. Statute of the Spanish Data Protection Agency.

1. The Statute of the Spanish Agency for Data Protection, approved by Royal Decree 428/1993 of 26 March 1993shall remain in force in what is not opposed to the provisions of Title VIII of this organic law.

2. The provisions of paragraphs 2, 3 and 5 of article 48 and article 49 of this organic law shall apply once the mandate of the person who has the status of Director of the Spanish Data Protection Agency has expired upon the entry into force of the Act.

Transitional provision 2nd. Type codes entered in data protection authorities in accordance with the Organic Law 15/1999 of 13 December 1999Personal Data Protection.

The promoters of the type codes entered in the register of the Spanish Data Protection Agency or the regional data protection authorities shall adapt their content to the provisions of Article 40 of the Convention. Regulation (EU) 2016/679 within one year of the entry into force of this organic law.

If, after that period, the approval provided for in article 38.4 of this organic law has not been requested, the registration shall be cancelled and its promoters notified.

Transitional provision 3 Transitional arrangements for procedures.

1. The procedures already initiated upon the entry into force of this organic law shall be governed by the previous regulations, unless this organic law contains provisions more favourable to the person concerned.

2. The provisions of the preceding paragraph shall also apply to proceedings in respect of which the pre-trial proceedings referred to in Chapter III, Section 2a, of Title IX of the Rules of Procedure have already been initiated. Organic Law 15/1999 of 13 December 1999Personal Data Protection, approved by Royal Decree 1720/2007 of 21 December 2007.

Transitional provision 4 Treatments Directive (EU) 2016/680.

Treatments Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016on the protection of natural persons with regard to the processing of personal data by the competent authorities for the purposes of preventing, investigating, detecting or prosecuting criminal offences or for the enforcement of criminal sanctions, and on the free movement of such data and repealing Council Framework Decision 2008/977/JHA, shall continue to be governed by the Organic Law 15/1999 of 13 December 1999and in particular Article 22, and its implementing provisions, until the rule transposing the provisions of that Directive into Spanish law enters into force.

Please note that Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 has been transposed by Organic Law 7/2021 of 26 May. Ref. BOE-A-2021-8806

Transitional provision fifth. Contracts of the controller.

The processing officer’s contracts entered into before 25 May 2018 under the provisions of the Article 12 of Organic Law 15/1999 of 13 December 1999Personal Data Protection shall remain in force until the expiration date specified therein and in the event of an indefinite agreement, until 25 May 2022.

During these periods either party may require the other party to amend the contract in order to ensure that the contract complies with Article 28 of the Treaty. Regulation (EU) 2016/679 and in Chapter II of Title V of this organic law.

Transitional provision 6th. Re-use of personal data collected prior to the entry into force of this organic law for health and biomedical research purposes.

The re-use for health and biomedical research purposes of personal data lawfully collected prior to the entry into force of this organic law shall be considered lawful and compatible if any of the following circumstances occur:

(a) That such personal data is used for the specific purpose for which consent has been given.

(b) That, having obtained consent for a specific purpose, such data are used for purposes or areas of research related to the medical or research specialty in which the initial study was scientifically integrated.

Single derogation provision. Repeal of regulations.

1. Without prejudice to the provisions of the fourteenth additional provision and the fourth transitional provision, the Organic Law 15/1999 of 13 December 1999Personal Data Protection.

2. The Royal Decree-Law 5/2018 of 27 July, of urgent measures for the adaptation of Spanish law to European Union data protection legislation.

3. Any provisions of the same or lower rank contradict, oppose or are incompatible with the provisions of the Convention shall also be repealed. Regulation (EU) 2016/679 and in the present organic law.

Final provision one. Nature of this law.

This Act is of the nature of an organic law.

However, they have the status of ordinary law:

– Title IV,

– Title VII, with the exception of Articles 52 and 53, which are of an organic nature,

– Title VIII,

– Title IX,

– Title X, Articles 79, 80, 81, 82, 88, 95, 96 and 97,

– additional provisions, except for the second additional provision and the seventeenth additional provision, which are organic in nature,

– transitional provisions,

– and the final provisions, except for the first, second, third, fourth, eighth, tenth and sixteenth final provisions, which are of an organic nature.

Final provision two. Competence degree.

1. This organic law is enacted under the protection of Article 149.1.1.a of the Constitution, which gives the State exclusive competence to regulate the basic conditions that guarantee the equality of all Spaniards in the exercise of rights and in the fulfilment of constitutional duties.

2. Chapter I of Title VII, Title VIII, the fourth additional provision and the first transitional provision shall apply only to the General Administration of the State and its public bodies.

3. Articles 87 to 90 are ruled under exclusive jurisdiction that Article 149.1.7.a and 18a of the Constitution reserves the State with regard to labour legislation and the basis for the statutory regime of public officials, respectively.

4. The fifth additional provision and the seventh and sixth final provisions are made under the jurisdiction of the Court of Justice. Article 149.1.6.a of the Constitution assigns the State to procedural legislation.

5. The third additional provision is made under the Article 149.1.18.a of the Constitution.

6. Article 96 shall be read under the Article 149.1.8.a of the Constitution.

Final provision three. Amendment of Organic Law 5/1985 of 19 June 1985, of the General Electoral Regime.

The Organic Law 5/1985 of 19 June 1985of the General Electoral Regime, which reads as follows:

One. Article 39(3) shall read as follows:

‘3. Within the previous period, any person may make a complaint to the Provincial Delegation of the Electoral Census Office concerning his census data, although only those referring to the rectification of errors in personal data, changes of domicile within the same constituency or the non-inclusion of the claimant in any Census Section of the district may be taken into account even though he is entitled to such a complaint. The requests of voters who object to their inclusion in the copies of the electoral roll to be made available to representatives of the candidates for the purpose of postal mailings of electoral propaganda will also be met. Those which reflect a change of residence from one constituency to another, carried out after the date of closure of the census for each election, shall not be taken into account in the election, and shall exercise their right in the section corresponding to their previous domicile.’

Two. A new Article 58a is added, with the following content:

‘Article 58a. Use of technological means and personal data in electoral activities.

1. (Cancelled)

2. Political parties, coalitions and electoral groups may use personal data obtained on websites and other sources of public access for the conduct of political activities during the electoral period.

3. The sending of electoral propaganda by electronic means or messaging systems and the hiring of electoral propaganda on social networks or equivalent means shall not be considered as commercial activity or communication.

4. The above-mentioned publicity activities will identify their electoral nature in a prominent manner.

5. A simple and free way of exercising the right of opposition shall be provided to the addressee.’

It is declared contrary to the Constitution and null and void the provisions of paragraph 2 by judgment of SS 76/2019, of 22 May. Ref. BOE-A-2019-9548

Final provision four. Amendment of Organic Law 6/1985 of 1 July, of the Judiciary.

The Organization Act of 1 July 1985 on the Judiciary is amended as follows:

One. A third paragraph is added to Article 58, as follows:

‘Article 58.

Third. The application for authorisation for the declaration provided for in the fifth additional provision of the Organic Law on the Protection of Personal Data and Guarantee of Digital Rightswhere such request is made by the General Council of the Judiciary.’

Two. A point (f) is added to Article 66, as follows:

‘Article 66.

(f) The application for authorization for the declaration provided for in additional provision 5 of the Organic Law on the Protection of Personal Data and Guarantee of Digital Rightswhere such request is made by the Spanish Data Protection Agency.’

Three. A point (k) is added to paragraph 1 and a new paragraph 7 is added to Article 74, as follows:

‘Article 74.

1. […]

(k) The application for authorization for the declaration provided for in additional provision 5 of the Organic Law on the Protection of Personal Data and Guarantee of Digital Rightswhere such request is made by the data protection authority of the respective Autonomous Community.

[…]

7. It is for the Administrative Chambers of the High Courts of Justice to authorise, by order, the request for information by regional data protection authorities to operators providing publicly available electronic communications services and information society service providers, where necessary in accordance with specific legislation.’

Four. A new paragraph 7 is added to Article 90:

‘7. It is for the Central Administrative Courts to authorise, by order, the Spanish Data Protection Agency and other independent administrative authorities at the State level to request information from operators providing electronic communications services available to the public and information society service providers, where necessary in accordance with the specific legislation.’

Final provision five. Amendment of Law 14/1986 of 25 AprilGeneral of Health.

A new Chapter II is added to the Title VI of Law 14/1986 of 25 AprilHealth General with the following content:

‘CHAPTER II

Processing of data from health research

Article 105 bis.

The processing of personal data in health research shall be governed by the provisions of the 17th Additional Provision of the Organic Law on the Protection of Personal Data and Guarantee of Digital Rights.»

Final provision six. Amendment of Act 29/1998 of 13 July 1998, regulator of the Administrative-Dispute Jurisdiction.

The Act 29/1998 of 13 July 1998the regulation of the Administrative Jurisdiction is amended as follows:

One. A new paragraph 7 is added to Article 10:

‘7. They shall be aware of the request for authorisation under Article 122b, when made by the data protection authority of the respective Autonomous Community.’

Two. A new paragraph 5 is added to Article 11:

‘5. It shall be aware of the request for authorisation under Article 122b, when made by the Spanish Data Protection Agency.’

Three. A new paragraph 4 is added to Article 12:

‘4. He shall be aware of the request for authorization under Article 122b, when made by the General Council of the Judiciary.’

Four. A new Article 122b is inserted, reading as follows:

‘Article 122b. Procedure for judicial authorization pursuant to a decision of the European Commission on the international transfer of data.

1. The procedure for obtaining the judicial authorization referred to in the fifth additional provision of the Organic Law on the Protection of Personal Data and Guarantee of Digital Rights, shall be initiated by the request of the data protection authority addressed to the competent Court for a ruling on the conformity of a decision of the European Commission on the international transfer of data with European Union law. The application shall be accompanied by a copy of the file pending resolution before the data protection authority.

2. In addition to the data protection authority, the parties to the proceedings before it and, in any event, the European Commission, shall be the parties to the proceedings.

3. The admission or inadmissibility agreement for the procedure shall confirm, modify or terminate the suspension of the procedure for possible violation of the data protection rules processed before the data protection authority, for which this judicial authorization procedure is brought.

4. The competent court shall notify the data protection authority of the application for transfer to those involved in the proceedings before the data protection authority within three days. The European Commission will also be forwarded to the same effect.

5. After the period referred to in the preceding paragraph, the application for authorisation shall be forwarded to the parties concerned in order to make known within 10 days what they deem appropriate, and at that time they may request the use of such evidence as they deem necessary.

6. After the probationary period, if one of the parties has requested it and the court considers it appropriate, a hearing shall be held. The Court may decide on the scope of the issues on which the parties should focus their submissions on such a hearing.

7. After the completion of the proceedings referred to in the preceding three paragraphs, the competent court shall, within 10 days, adopt one of these decisions:

(a) If it considers that the decision of the European Commission is in accordance with the law of the European Union, it shall give a judgment declaring it in this way and refusing the authorisation requested.

(b) If it considers that the decision is contrary to European Union law, it shall issue an order for a preliminary ruling on the validity of that decision before the Court of Justice of the European Union, in accordance with Article 267 of the Treaty. Treaty on the Functioning of the European Union.

The authorisation may only be granted if the decision of the European Commission in question is declared invalid by the Court of Justice of the European Union.

8. The remedies scheme shall be that provided for in this Act.’

Final provision seven. Amendment of Law 1/2000 of 7 JanuaryCivil prosecution.

The Article 15 bis of Law 1/2000 of 7 JanuaryCivil Procedure, which reads as follows:

‘Article 15a. Intervention in competition and data protection processes.

1. The European Commission, the National Commission on Markets and Competition and the competent bodies of the Autonomous Communities within their competence may intervene in competition and data protection proceedings, without being party, on their own initiative or at the request of the judicial body, by providing information or submitting written observations on questions relating to the application of Articles 101 and 102 of the Treaty. Treaty on the Functioning of the European Union or the Articles 1 and 2 of Law 15/2007 of 3 July, of Defense of Competition. They may also submit oral observations, with the permission of the relevant judicial body. To that end, they may request the competent court to forward to them or to send them all the documents necessary for an assessment of the case in question.

The provision of information shall not cover the data or documents obtained in the context of the circumstances under which the exemption or reduction in the amount of fines provided for in the Articles 65 and 66 of Act No. 15/2007 of 3 July 2007, of Defense of Competition.

2. The European Commission, the National Commission on Markets and Competition and the competent bodies of the Autonomous Communities shall provide the information or submit the observations provided for in the previous issue 10 days before the conclusion of the act of the trial referred to in Article 433 or within the time limit for opposition or challenge of the appeal.

3. The provisions of the preceding procedural paragraphs shall also apply where the European Commission, the Spanish Data Protection Agency and the autonomous data protection authorities, within their competence, consider their involvement in a process affecting questions relating to the implementation of the Convention to be necessary. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.»

Final provision 8th. Amendment of Organic Law 6/2001 of 21 December 2001Colleges.

A new point (l) is included in paragraph 2 of the Article 46 of Organic Law 6/2001 of 21 December 2001, of Universities, with the following content:

'(l) Training in the use and security of digital media and the guarantee of fundamental rights on the Internet.'

Final provision ninth. Amendment of Law 41/2002 of 14 November 2002, basic regulation of patient autonomy and of rights and obligations in the field of clinical information and documentation.

Paragraph 3 is amended Article 16 of Law 41/2002 of 14 November 2002the basic regulation of patient autonomy and of rights and obligations in the field of clinical information and documentation, which becomes as follows:

‘Article 16. [...]

3. Access to medical records for judicial, epidemiological, public health, research or teaching purposes is governed by the provisions of the legislation in force concerning the protection of personal data, and in the Law 14/1986 of 25 April, General Health, and other implementing rules in each case. Access to the medical history for these purposes requires the preservation of the patient's personal identification data, separated from those of a clinical-care nature, so that anonymity is generally assured, unless the patient himself has given his consent not to separate them.

Except for the investigation cases provided for in paragraph 2 of the seventeenth additional provision of the Organic Law on the Protection of Personal Data and Guarantee of Digital Rights.

The exception is also made for cases of investigation by the judicial authority, where it is considered essential to consolidate the identifying data with the clinical assistance, in which the judges and the courts will be at the disposal of the relevant proceedings. Access to data and documents in the medical history is strictly limited to the specific purposes of each case.

Where this is necessary for the prevention of a serious risk or danger to the health of the population, the health authorities to which the Act No. 33/2011 of 4 October 2011, General of Public Health, will be able to access the identification data of patients for epidemiological reasons or for the protection of public health. Access shall in any event be made by a health professional subject to professional secrecy or by another person subject to an equivalent obligation of secrecy, subject to a statement of reasons from the administration requesting access to the data.’

Final provision 10th. Amendment of Organic Law 2/2006 of 3 MayEducation.

A new point (l) is included in paragraph 1 of the Article 2 of Organic Law 2/2006 of 3 MayEducation, which reads as follows:

"(l) Training to ensure the full inclusion of students in digital society and the learning of the safe use of digital media and respectful of human dignity, constitutional values, fundamental rights and, in particular, with respect for and guarantee of individual and collective privacy."

Eleventh final disposition. Amendment of Law 19/2013 of 9 December 2013transparency, access to public information and good governance.

The Law 19/2013 of 9 December 2013transparency, access to public information and good governance, as follows:

One. A new Article 6a is added as follows:

‘Article 6a. Registration of treatment activities.

The subjects listed in Article 77(1) of the Organic Law on the Protection of Personal Data and Guarantee of Digital Rights, publish their inventory of treatment activities pursuant to Article 31 of the aforementioned Organic Law.’

Two. Article 15(1) shall read as follows:

‘1. If the requested information contains personal data revealing ideology, trade union affiliation, religion or belief, access may only be authorized if it is provided with the express written consent of the person concerned, unless the data has been made publicly available by that person prior to the request for access.

If the information includes personal data referring to racial origin, health or sexual life, includes genetic or biometric data or contains data relating to the commission of criminal or administrative offences that do not involve public reprimand to the offender, access may only be authorized if the person concerned has express consent or if he is covered by a rule of law.’

Final disposition twelfth. Amendment of Law 39/2015 of 1 October 2015the Common Administrative Procedure of the Public Administrations.

Paragraphs 2 and 3 of the Annex are amended Article 28 of Act No. 39/2015 of 1 October 2015the Common Administrative Procedure of the Public Administrations, which are now worded as follows:

‘Article 28. [...]

2. The interested parties have the right not to provide documents which are already in the hands of the acting Administration or have been produced by any other Administration. The acting administration may consult or obtain such documents unless the person concerned objects. There shall be no opposition where the contribution of the document is required in the course of the exercise of sanctioning or inspection powers.

Public administrations shall collect documents electronically through their corporate networks or through consultation with data intermediation platforms or other electronic systems enabled for this purpose.

In the case of mandatory reports already drawn up by an administrative body other than the one handling the procedure, they must be submitted within 10 days of their request. Within this time limit, the person concerned shall be informed that he or she may submit this report or await its submission by the competent body.

3. The Administrations shall not require interested parties to submit original documents unless, on an exceptional basis, the applicable regulatory rules provide otherwise.

In addition, public administrations shall not require data or documents not required by the applicable regulatory rules or previously provided by the interested party to any administration. For this purpose, the data subject shall indicate at what time and before which administrative body the aforementioned documents were submitted, and the Public Administrations must collect them electronically through their corporate networks or through a consultation of the data intermediation platforms or other electronic systems authorized for that purpose, unless the express opposition of the data subject or the applicable special law requires his express consent in the proceedings. Exceptionally, if the public authorities are unable to obtain the said documents, they may request their contribution from the person concerned again.’

Final provision thirteenth. Amendment of Consolidated text of the Workers' Statute Act.

A new Article 20a is added to the Consolidated text of the Workers' Statute Act, approved by Royal Legislative Decree 2/2015, of 23 Octoberwith the following content:

‘Article 20a. Workers' rights to privacy in relation to the digital environment and disconnection.

Workers have the right to privacy in the use of digital devices made available to them by the employer, to digital disconnection and to privacy from the use of video surveillance and geolocation devices in the terms set out in the legislation in force on the protection of personal data and the guarantee of digital rights.’

Fourteenth final disposition. Amendment of the consolidated text of the Basic Staff Regulations Act.

A new point (ja) is added to the Article 14 of the consolidated text of the Law on the Basic Statute of Public Employees, approved by Royal Legislative Decree 5/2015, of 30 Octoberwhich shall read as follows:

'(ja) To privacy in the use of digital devices made available to them and in relation to the use of video surveillance and geolocation devices, as well as digital disconnection in the terms set out in the current legislation on the protection of personal data and the guarantee of digital rights.'

Final disposition 15th. Policy development.

The Government is empowered to develop the provisions of articles 3.2, 38.6, 45.2, 63.3, 96.3 and the sixth additional provision, as set out therein.

Final disposition sixteenth. Entry into force.

This organic law shall enter into force on the day following its publication in the Official Gazette of the State.

Therefore,

I command all Spaniards, private individuals and authorities to keep and enforce this organic law.

Madrid, December 5, 2018.

FELIPE R.

The President of the Government,

PEDRO SÁNCHEZ PÉREZ-STEJON