Data Protection Laws and Freedom of Expression: Spain
Constitutional/Primary Law Background - see also ECHR and EU Charter
Section 18 and 20 of the contemporary Spanish Constitution (1978 as revised 2011) respectively set out a number of rights in this area including limited express data protection provisions. Section 20 recognises and protects the right to freely express and spread thoughts, ideas and opinions, the right to literary, artistic, scientific and technical production and creation, the right to academic freedom and the right to freely communicate and receive truthful information. It prohibits censorship and provides that seizure of any means of information requires a court order. The article provides that professional secrecy will be regulated by law and that exercise of these freedoms are limited by other recognised rights including their legal implementation and especially the right to honour, reputation, image and to child and youth protection. Section 18 guarantees the right to personal and family privacy, honour and image and establishes the inviolability of home (with unconsented entry requiring a legal warrant other than in cases of flagrante delicto) and secrecy of communications (except through a court order). It also requires that the law restrict data processing in order to guarantee the citizen’s hoou, personal and family private and full exercise of their rights.
The first relevant provision is article 145 of the 1808 Constitution which provided that freedom of the press would established within two years of its full operation. The law of the press was made an integral part of the 1856 Constitution (art. 92(6)) and the 1869 Constitution protected the right to freely express ideas and opinions (art 17(1)), generally prohibited unconsented entry into homes (except based on judicial order and in daylight) (art 5) and prohibited interception of the mail or telegrams by the administrative authorities (art 7). The first express protection of personal and family honour (of citizens only) is found in article 4 of 1945 Charter of the Spanish People adopted during the Francoist period. The current rights provisions trace back to the adoption of the democratic constitution in 1978.
First-Generation Statutory Law
|
Spain Organic Law 5/1992, on 31 October 1992.
Special Expression Derogation
There was no specific provision.
Broad Expression Derogation
An exclusion was provided for data files containing technological or commercial information reproducing data which have already been published in official bulletins, newspapers or directories (art. 2(2)(c)).
An exclusion was also set out for automated files in public ownership whoses legally established object was the storage of data for general publicity (art. 2(2)(a)).
Personal Exemption
An exclusion was provided for data processing by natural persons for exclusively personal purposes (art. 2(2)(b)).
Knowledge Facilitation Framework
Pursuant to Article 30, personal data could be used in opinion polls, for market, scientific or medical research and similar activities only if the person concerned has given his or her consent. Article 33(c) excluded personal data processed for medical purposes and for epidemiological from the prohibition on international data transfers. |
Parliamentary Debates
Special and Broad Expression Derogations
In the debate in the lower Chamber, the Minister of Justice, De la Quadra-Salcedo (Partido Socialista), noted that it was necessary to exclude certain types of files from the application of the law as their very purpose was the opposite of fundamental idea of the law to protect privacy namely to make publicly available data.[1] Other than this implicit mention of the exception in Art. 2(2)(c), there was no other discussion.
Personal Exemption
MP Santos Miñon (Centro Democràtico y Social) argued that it was appropriate to limit the personal scope of the law, given the excessive costs individuals would otherwise have to bear.[2] No other debate took place on the personal exemption.
Knowledge Facilitation Framework
Senator Cercos Peres (Partido Socialista) noted that no fundamental right is absolute. Exceptions from the data protection provisions of the law for statistical purposes were thus reasonable and can be justified, not least because the law on statistics provided for a number of safeguards including statistical confidentiality or the consultation and information of the affected data subject.[3] No further debates took place on this issue.
Second-Generation Statutory Law
|
Spain adopted its Organic Law 15/1999 on the Protection of Personal Data, on 13 December 1999.
Special Expression Derogation
No specific provision was adopted..
Broad Expression Derogation
No specific provision was adopted.
Personal Exemption
Files maintained by natural persons in the exercise of purely personal or household activities were excluded from the application of the law (art. 2(2)(a)).
Knowledge Facilitation Framework
Notwithstanding the time limit principle an entire set of particular data could be kept in accordance with specific legislation because of tehir historica, statistical or scientific value (art. 4(5)) and processing of personal data for historical, statistical or scientific purposes was not in principle considered incompatible with the purposes for which they were collected (art. 4(2)).However, exemption from a requirement of data subject consent for the communication of non-public personal data to a third party only applied where personal data were transferred between public administrations (art. 11(e)). No exemption was provided from proactive direct, the reactive transparency rules, the international data transfer rules or the DPA notification requirements. In contrast, the law did provide a categorial exemption from the proactive indirect transparency rule for processing of personal data for historical, statistical or scientific purposes (art. 5(5)). With regard to sensitive data, no derogation was permissible except for health data in the context of epidemiological studies within the meaning of central or regional government health legislation (art. 11(2) read with art. 7(3)). The law also contained various specific to market research which granted such activity certain advantages enabling receipt of a copy of the electoral roll) alongside additional requirements (e.g. otherwise requiring names and addresses were only used with consent).See arts. 5(5), 28(2), 30 and 31.
|
Parliamentary Debates
Special Expression Derogation
No relevant debates took place.
Broad Expression Derogation
No relevant debates took place.
Personal Exemption
Other than the brief observation made during the debate by MP Santos Miñon (Centro Democrático y Social) that it is appropriate to limit the scope of the law and exclude the processing of data by natural persons for purely personal or household activities[4], the personal exemption was neither discussed in Parliament in 1992 nor in 1999.
Knowledge Facilitation Framework
In the parliamentary debates leading up to the adoption of the law, MP Castellano Cardalliaguet (Izquierda Unida) emphasized that the private or public processing of personal data for historical, statistical or scientific purposes would require prior approval of the Data Protection Agency.[5] However, no substantial debates seemed to have followed his intervention, with the main focus of the debate being the collection of data relating to terrorism or serious crime threats.
Third-Generation Statutory Law
|
Spain adopted Organic Law 3/2018, on 5 December 2018.
Special Expression Derogation
Spain has failed to establish any explicit derogation in favour of journalism or other types of special expression within its statutory data protection law.
Broad Expression Derogation
Pursuant to Article 85 (“Right to Rectification on the Internet”), everyone has the right to freedom of expression on the internet. Those responsible for social networks and equivalent services are required to adopt appropriate protocols to enable the exercise of the right of rectification before users who disseminate content that violates the right to honor, personal and family privacy on the internet and the right to freely communicate or receive truthful information in accordance with Organic Law 2/1982. A response from the digital media must include publication of a clarifying notice, which must appear in a visible place together with the origin, showing that the original dissemination does not reflect the current situation. In addition, under Article 86 (“Right to update Information in Digital Media”), everyone has the right to reasonably request from the digital media the inclusion of a sufficiently visible update notice next to the news that concerns them when the information contained in the original news item does not reflect their current situation as a result of circumstances that have taken place after publication, which cause harm. Such a notice must particularly be published where the original information referred to police or judicial actions which have been effected by subsequent judicial decisions in which case the notice must refer to this decision.
Personal Exemption – see GDPR, art. 2(2)(c)
Knowledge Facilitation Framework – see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
Pursuant to the seventeenth additional provision on health data treatment, health authorities and public institutions with powers in public health surveillance may carry out scientific studies without the consent of those affected in situations of exceptional relevance and seriousness for public health. Moreover, the reuse of personal data for health and biomedical research purposes will be considered lawful and compatible when, having obtained consent for specific purposes, the data is used for research purposes or areas related to the area in which the initial study is scientifically integrated. No further provisions allowing for knowledge facilitation derogations were adopted.
|
Parliamentary Debates
Special Expression Derogation
No relevant parliamentary debates were recorded.[6]
Broad Expression Derogation
The Grupo Parlamentario Socialista proposed the adoption of new article entitled ‘The Freedom of Expression on the Internet’. This proposed article aimed to ensure that the freedom of expression on the Internet was guaranteed to all its users. Social media networks, digital platforms and equivalent services would be required to guarantee the truthfulness of the information.[7] This provision ultimately became Article 85 of the current law. No other mention was made of the freedom of expression in the presently relevant context.
Knowledge Facilitation Framework
In her elaborations on the proposed Data Protection Act implementing the GDPR, the Director of the Spanish Data Protection Agency mentioned that several scientific associations have expressed concern regarding proposed article 6 which requires the ‘specific and unequivocal consent’ for the processing of personal data for scientific purposes. It was criticized that such consent requirement would constitute an obstacle to the biomedical research in Spain. However, pursuant to the Director of the Spanish Data Protection Agency, article 6 would not change existing regulation on research in the health context. She emphasized that exemptions from the consent requirement existed for health-related research which would be of benefit not just the individual data subject but society as a whole. She also clarified that the purpose ‘scientific research’ must be interpreted broadly so as to include technological development, fundamental research, applied research, and research funded by the private sector.[8]
Responding to a question relating to the possibility of introducing an amendment clarifying that data may be used for scientific purposes even if they were initially collected for other purposes, the Director of the Spanish Data Protection Agency noted that it was not possible to assume an individual’s consent to the processing of data for scientific purposes where such data was initially collected for other purposes. Such an assumption would not be compatible with the GDPR.[9]
In the parliamentary debates which followed, multiple MPs emphasized the need to appropriately balance the right to have one’s data protected and the need to adequately enable to use of medical and health data for scientific purposes. However, no substantive contributions as to how such a balance could be achieved were made.
Intervening in the parliamentary debate, Martinez Martinez, the Former President of the Spanish Professional Privacy Association observed that the existing provisions on scientific research required data subjects to expressly and specifically consent to the use of their data for such purposes. However, Mr Martinez noted that the GDPR would open up the possibility for a broader notion of consent, which deems the processing of data for scientific purposes as compatible with data protection. He therefore advocated to clarify this position in the proposed law.[10] Relying on various international documents including the TEU, the TFEU and the EUCFR, the current President of the Professional Privacy Association concurred. Focusing primarily on biomedical research, Ms Alvarez Rigaudias argued that while there would need to be adequate safeguards to protect the right to privacy of the affected data subject, consent per se would not necessarily adequately serve this purpose. She moreover alluded to the German system which broadly exempts scientific research from the consent and other data protection provisions. Emphasising in particular that the right to access could jeopardise the results of scientific studies, she pleaded for a broader derogation for scientific purposes.[11] Data protection rights would have to be limited in order to avoid seriously impeding scientific research.
Discussing the amendment proposed by the Grupo Parlamentario Confederal de Unidos Podemos-En Comú Podem-En Marea to Art. 6 in light of these debates, reference was made to a number of recitals of the GDPR which support a broad interpretation of scientific research and consequently the derogation from data protection provisions.[12] It was emphasized that under no circumstances should public health authorities process data for profit or transfer such data to the private for-profit sector.[13] The proposed amendment by the Grupo Parlamentario Vasco (EAJ-PNV) similarly aimed at enabling the subsequent compatible use of data initially obtained with the consent of the data subject with reference to the GDPR’s objective to enable innovation.[14] It was argued that article 26 should accordingly subject the processing of personal data for scientific research to the provisions set out in the GDPR as well as Law 14/2007 of 3 July, on biomedical research and its implementing regulation, Law 14/2001, of 1 June, on Science, Technology and Innovation, Law 16/185, of 25 June, on Spanish Historical Heritage, and Royal Decree 1708/2011, of 18 November, establishing the Spanish Archive System and regulating the Archive System of the General State Administration and its Public Bodies and its Access Regime as well as regional legislation.[15] The Grupo Parlamentario Ciudadanos proposed to clarify that ‘scientific research, and in particular biomedical research, shall be considered to be a task carried out in the public interest, under the terms laid down by law’.[16] The Grupo Parlamentario Socialista, in contrast, proposed an elaborate regime in the form of several new articles detailing the use of personal data for scientific and medical purposes, subjecting it to a number of conditions including the prior approval of the Research Ethics Committee and compliance with Art. 13 GDPR.[17] The Grupo Parlamentario Popular en el Congreso elaborated that the GDPR would not impose any additional conditions on the lawful processing of personal data for scientific and biomedical research purposes. However, they argued that an amendment should clarify that Art. 9(2)(g)-(j) GDPR were applicable.[18]
[1] Cortes Generales – Diario de Sesiones del Congreso de los Diputados – Pleno y Diputación permanente Año 1991 IV Legislatura Núm 151. Sesión Plenaria 145, Thursday 28 November 1991, p. 7574.
[2] Ibid, p. 7580.
[3] Cortes Generales – Diario de Sesiones del Senado – Pleno Año 1992 IV Legislatura Núm 129 Wednesday 30 September 1992, P. 6895-6.
[4] Cortes Generales – Diario de Sesiones del Congreso de los Diputados – Pleno y Diputación permanente Año 1991 IV Legislatura Núm 151. Sesión Plenaria 145, Thursday 28 November 1991, 7580.
[5] Cortes Generales – Diario de Sesiones del Congreso de los Diputados – Pleno Y Diputación Permanente Año 1999 VI Legislatura Núm 263. Sesión Plenaria 253, Thursdat 30 September 1999, p. 13982.
[6] For an overview of all documents of the legislative process, see https://www.senado.es/web/actividadparlamentaria/iniciativas/detalleinic... (last accessed 24 March 2021).
[7] Boletín Oficial De Las Cortes Generales, Congreso de Los Diputados’ (18 April 2018) Núm. 13-2/1, p. 197.
[8] ‘Dario De Sesiones Del Congreso De Los Diputados: Comisiones’ (27 February 2018) XII Legislatura Núm 4448/1, p. 6 http://www.congreso.es/public_oficiales/L12/CONG/DS/CO/DSCD-12-CO-448.PDF (last accessed 30 July 2020).
[9] Ibid, p. 13.
[10] ‘Cortes Generales, Dario De Sesiones Del Congreso De Los Diputados, Comisiones’ (15 March 2018) XII Legislatura Núm. 464/1, pp. 8 et seq. http://www.congreso.es/public_oficiales/L12/CONG/DS/CO/DSCD-12-CO-464.PDF (last accessed 30 July 2020).
[11] Ibid, pp. 41-2.
[12] ‘Boletín Oficial De Las Cortes Generales, Congreso de Los Diputados’ (18 April 2018) Núm. 13-2/1, pp. 4 et seq.
[13] This amendment does not seem to have been adopted, see version of the draft passed by the Congreso de Los Deputados https://www.congreso.es/public_oficiales/L12/CONG/BOCG/A/BOCG-12-A-13-6.PDF (last accessed 18 April 2021).
[14] Ibid, p. 28.
[15] In the version adopted by the Congreso de Los Deputados and the final version of the law reference is only made to Law 16/1985 on Spanish Historical Heritage and Royal Decree 1708/2011 which establishes the Spanish Archives System and regulates the Archives System of the General Administration of the State and its Public Bodies. The amendment was therefore not adopted.
[16] Ibid, p. 50; this amendment was not adopted.
[17] Ibid, p. 172; this amendment was not adopted.
[18] Ibid, p. 235; this amendment was not adopted.
Twitter
Email