Your rights over your personal data and online

Automatic summary, not yet reviewed

1. The law adapts Spanish law to the European data protection Regulation and also guarantees citizens' digital rights. The right to data protection is a fundamental right protected by the Spanish Constitution.
2. Relatives or heirs of a deceased person can request access to that person's data and its rectification or erasure, unless the deceased expressly forbade it. The same applies to the deceased person's digital content.
3. Consent to process data must be a statement or a clear action by the person; tacit consent is no longer valid. Minors can only give consent on their own from age fourteen.
4. Specific processing activities are regulated: video surveillance cameras may only record public spaces when strictly necessary and images must be deleted within one month at most. Debt listing files may only include certain, due and enforceable debts, for a maximum of five years.
5. Many entities must appoint a data protection officer, such as schools, universities, health centers, banks, insurers or advertising companies. The appointment must be reported to the Spanish Data Protection Agency within ten days.
6. The Spanish Data Protection Agency is set up as an independent administrative authority, linked to the Government through the Ministry of Justice. Its President and Deputy are appointed by the Government and confirmed by the Congress by a three-fifths majority.
7. Violations are classified as very serious, serious and minor, with limitation periods of three, two and one year respectively. Fines are published in the Official State Gazette when they exceed one million euros and the offender is a legal entity.
8. Digital rights are recognized, such as net neutrality, universal access to the Internet, the right to disconnect at work, the right to be forgotten on search engines and social networks, and the digital will.

Who it affects

• Any person: Can exercise rights of access, rectification, erasure, objection and portability over their data, and request the removal of links from search engines and social networks.
• Workers and public employees: Have the right to privacy when using digital devices provided by the employer and the right to disconnect outside working hours.
• Companies and entities that process data: Must meet information, security and record-keeping duties, and appoint a data protection officer where required; they can be fined if they fail to comply.
• Minors and their families: Minors under fourteen need their parents' or guardians' consent for their data to be processed, and their protection online is strengthened.
• Relatives of deceased persons: Can access the deceased person's data and digital content and request its rectification or erasure, unless there is an express prohibition.

Words worth knowing

Responsable del tratamiento (data controller)

The person or entity that decides which data is collected and for what purpose it is used.

Encargado del tratamiento (data processor)

The person or entity that processes data on behalf of the controller, for example a service provider.

Delegado de protección de datos (data protection officer)

A person who monitors an entity's compliance with data protection rules and acts as the link with the Agency.

Portabilidad (portability)

The right to receive your data in a format you can take to another company or service.

Bloqueo de datos (data blocking)

Keeping data reserved and unusable, usually while a claim or check about them is pending.

It summarizes the law as published in the BOE. It is written by artificial intelligence and may contain mistakes: the official text is what counts. Read the official text · How we make summaries