Rules for how police and courts handle your personal data

Automatic summary, not yet reviewed

1. The law regulates how personal data is handled by authorities that investigate crimes, enforce penalties and protect public security. Competent authorities include the security forces, prison administrations, criminal courts, the Public Prosecutor's Office and other bodies such as customs surveillance.
2. Public administrations and any person or company must give courts, the prosecutor or the police the data needed to investigate crimes or prevent a serious danger to public security. As a rule, the person affected will not be told that their data was shared.
3. Data may only be kept as long as necessary and must be reviewed at least every three years. As a general rule, data must be deleted within a maximum of twenty years, unless there are justified exceptions.
4. The rights of access, rectification, erasure and restriction of processing are recognized. These rights can be restricted for limited reasons, for example to avoid obstructing an investigation or to protect public security.
5. Especially sensitive data, such as genetic or biometric data, may only be processed when strictly necessary and with safeguards. Automated decisions that harm a person are banned unless authorized by a rule with the force of law.
6. The law regulates cameras used by the security forces: fixed cameras require a prior assessment and public notice, and mobile ones need authorization for a maximum of one month, renewable once. Recordings must be handed to the judge within 72 hours if they show possible crimes, and destroyed within three months otherwise.
7. Personal data security breaches must be reported to the data protection authority within 72 hours and, if there is high risk, also to the person affected. Data controllers must appoint a data protection officer, except for processing for judicial purposes.
8. A sanctioning regime is established with minor, serious and very serious offenses. Fines range from €6,000 to €1,000,000 depending on severity, and offenses expire between six months and three years after being committed.

Who it affects

• Public administrations and companies or individuals: They must give data to courts, the prosecutor or the police when requested for criminal investigations, and must not tell the person affected.
• Competent authorities (police, prisons, prosecutors, etc.): They must follow processing principles, retention periods, record-keeping, security measures and appoint a data protection officer.
• People whose data is processed in criminal investigations or proceedings: They can exercise rights of access, rectification, erasure and restriction, although these can be restricted during investigations.
• Security forces using cameras: They must follow specific rules on installing, authorizing and keeping camera recordings.

Words worth knowing

Responsable del tratamiento (data controller)

The authority that decides which data is processed and for what purpose.

Datos biométricos (biometric data)

Data such as fingerprints or facial images that uniquely identify a person.

Evaluación de impacto (impact assessment)

A prior analysis of the risks that data processing may cause to people.

Delegado de protección de datos (data protection officer)

A person who advises and oversees that data processing complies with the law.

Fines jurisdiccionales (judicial purposes)

Those related to the courts' function of judging cases.

It summarizes the law as published in the BOE. It is written by artificial intelligence and may contain mistakes: the official text is what counts. Read the official text · How we make summaries