Adapts Spanish data protection rules to the EU regulation

Automatic summary, not yet reviewed

1. Investigation activity by the Spanish Data Protection Agency will be carried out by Agency officials or by outside officials expressly authorized by its Director. Investigators act as officers of the law, must keep information secret, and can inspect equipment, request documents and copies. Entering homes requires following procedural rules and, when needed, prior judicial authorization.
2. The penalty regime applies to data controllers and processors, their representatives, certification bodies and bodies supervising codes of conduct. Data protection officers are excluded. Violations are those in Article 83(4), (5) and (6) of the EU regulation.
3. Violations under Article 83(5) and (6) of the regulation expire after three years, and those under Article 83(4) after two. Fines expire in one year (up to €40,000), two years (€40,001 to €300,000) or three years (over €300,000).
4. It sets out how the Agency handles complaints: it must decide whether to admit them, with notification within three months, and determine whether the case is national or cross-border before anything else. If the Agency is not the main supervisory authority, it forwards the complaint to the one that is and provisionally closes the procedure.
5. Deadlines are set: six months to resolve complaints about failure to answer rights requests, nine months for penalty procedures (which lapse when the deadline passes) and twelve months for preliminary investigations. Deadlines are suspended when information must be requested from the EU or from authorities of other member states.
6. The Agency can adopt provisional measures, such as the precautionary blocking of data or the immediate duty to honor the requested right. It also represents Spain on the European Data Protection Board and will publish many of its decisions. The rule remains in force until the new organic data protection law takes effect.

Who it affects

• Companies and entities that process personal data: They can be fined under the EU regulation and be subject to inspections by the Agency.
• Individuals who file complaints with the Spanish Data Protection Agency: Their complaints have admission and resolution deadlines, and they can consider the complaint upheld if no decision comes within six months.
• Data protection officers: They cannot be penalized under this rule.
• Spanish Data Protection Agency: It gains specific rules to investigate, fine, represent Spain on the European Board and publish its decisions.

Words worth knowing

Prescripción (statute of limitations)

The maximum time to impose or collect a penalty; once it passes, no action can be taken.

Responsable del tratamiento (data controller)

Whoever decides how and why personal data is used.

Encargado del tratamiento (data processor)

Whoever processes data on behalf of the controller, for example a service provider.

Tratamiento transfronterizo (cross-border processing)

Data processing affecting several countries, so several supervisory authorities are involved.

Caducidad (lapse of proceedings)

If the procedure does not finish within the set deadline, it closes and the case file is archived.

It summarizes the law as published in the BOE. It is written by artificial intelligence and may contain mistakes: the official text is what counts. Read the official text · How we make summaries