More public security rules for ID cards, digital government, contracts and telecoms

Automatic summary, not yet reviewed

1. The national ID card (DNI) becomes the only document that by itself proves the holder's identity and personal data for all purposes. The electronic ID card is defined as the document that electronically proves identity and allows signing documents.
2. Electronic identification and signature systems that use shared passwords or other systems with prior user registration will need prior State authorization, which can only be denied on public security grounds. Their technical resources must be located in the European Union, and in Spain if special categories of data are processed. Distributed ledger technologies (such as blockchain) may not be used to identify oneself or sign before public authorities until there is specific regulation.
3. Systems managing the electoral census, municipal population registers, tax data and national health system user data must be located in the European Union. The General State Administration may also suspend, on national security grounds, data transfers between public authorities when the receiving authority wants to use the data for a new purpose.
4. The Public Sector Contracts Act is amended to strengthen data protection at every stage of public contracting. Contract documents must mention data protection obligations, state the purpose of transferred data and the location of servers; omitting this makes the contract void. The main contractor is also responsible for its subcontractors in this area.
5. The Government may, exceptionally and temporarily, take over the direct management of, or intervene in, electronic communications networks and services when public order, public security or national security are at stake. The Ministry of Economy and Business gets stronger sanctioning and precautionary powers, including ordering activity to stop without a prior hearing in the face of serious and immediate threats. Public authorities must report their own networks that use public domain infrastructure.
6. The National Cryptologic Center coordinates the technical response of the public sector's computer security incident response teams and acts as the liaison with international teams.

Who it affects

• Public authorities: Must obtain prior State authorization for their password-based identification and signature systems, and locate technical resources in the EU or Spain.
• Companies contracting with the public sector: Must meet data protection obligations in contract documents and declare where their servers will be located.
• Telecommunications operators: Can face government intervention or suspension of activity if their networks threaten public order or national security.
• Citizens: Can only use approved systems to identify themselves or sign before public authorities, and the DNI becomes the sole identity document.

Words worth knowing

Real decreto-ley (royal decree-law)

A rule with the force of law that the Government can approve urgently, without going through Parliament first, in situations of extraordinary and urgent need.

Clave concertada (shared key)

An identification system using a username and password, instead of a digital certificate.

Tecnologías de registro distribuido (distributed ledger technologies)

Technologies, such as blockchain, where information is stored in a shared way across many points rather than on a single central server.

Pliegos (contract documents)

Documents in a public contract setting out the conditions a bidding company must meet.

CSIRT

Teams that respond to computer security incidents, acting when there are cyberattacks or security failures.

It summarizes the law as published in the BOE. It is written by artificial intelligence and may contain mistakes: the official text is what counts. Read the official text · How we make summaries