The ánicadeProteccióndeDatosdeCaráOrganic Law 15/1999 of December 13 on Protection of Personal Data (, LOPD) was Spanish organic law that guaranteed and protected the processing of personal data, public liberties, and fundamental human rights, and especially of personal and family honor and privacy. It was approved by the General Court on December 13, 1999. This law was developed based on Article 18 of the Spanish Constitution of 1978, the familiar and personal right to privacy, and the secrecy of communications.
Its main objective was to regulate the treatment of data and files, of a personal nature, regardless of the support in which they are treated, the rights of citizens over them and the obligations of those who create or treat them. This law affected all data that referred to registered humans on any support, computer or otherwise. Excluded from this regulation are those data collected for domestic use, classified materials of the state and those files that collected data on Terrorism and other forms of organized crime (not simple delinquency).
Based on this law, the Spanish Agency for Data Protection was created, at the state level, which ensures compliance with this Law.
This act was repealed by the passage of a new data protection act, the Organic Law 3/2018 of December 5, about protection of personal data and guarantees of digital rights, to conform the Spanish legislation with the General Data Protection Regulation
Regulatory development
The Royal Decree 994/1999 on Security Measures for automated files that containing personal data of June 11, 1999 (RMS): It is a regulation that develops the Organic Law 5/1992, of October 29, of Regulation of the Automated Treatment of Personal Data (LORTAD), regulates the technical and organizational measures that must be applied to the information systems in which personal data are processed in an automated way. (Repealed since April 19 of 2010) The Royal Decree 1720/2007, of December 21 on the development of the Organic Law on Data Protection. It is a development of the Organic Law 15/99 of Data Protection of December 13; develops the principles of the law, and the security measures to be applied in the information systems. It applies to files in automated support, as in any other type of media.
Control bodies and possible sanctions
The body responsible for monitoring compliance with data protection regulations at Spanish territory, in general, is the Spanish Agency for Data Protection (AEPD), there are other Data Protection Agencies of an autonomous nature, in Autonomous Communities of Catalonia and in Basque Country.
The sanctions are divided into three groups depending on the seriousness of the act committed, Spain being the country of the European Union that has the highest sanctions in terms of protection of data. These sanctions depend on the violation committed. The last company sanctioned has been the company Grupon, sanctioned by the state data protection agency, with 20 000 euros for storing the CVV codes of the Credit cards from their customers without informing them.
They are divided into:
Despite the amount of sanctions, there are many companies in Spain that have not yet adapted to it, or have done so in a partial manner or do not periodically review its adequacy; so that, maintenance and review of the adequacy carried out is essential.
In the public sector, the mentioned Law also regulates the use and management of information and files with personal data used by all public administrations.
The Spanish Agency for Data Protection (AEPD) was created in 1994 in accordance with the provisions of the repealed LORTAD. Its headquarters are located in Madrid, although the Autonomous Communities of Madrid, the Basque Country and Catalonia have created their own autonomous Agencies.
Inspection and guardianship of Rights Procedures
Spanish Agency for Data Protection (AEPD)
Year 2012
In 2012 complaints filed with the AEPD, increased by 12%. The activity of the Agency has grown significantly in 2012, with an increase of 15% in the files registered and almost 40% in the resolutions issued. The allegations of identity theft, especially in the supply and commercialization of energy and water (222%) and in telecommunications (92%), have experienced a substantial increase. Of the 863 infringement decisions declared to private managers, more than 34% concluded in a warning, without imposing a penalty. On the other hand, most of the sanctions affect the telecommunications sector, which represents 73% of the total. Three of the main operators accumulate 70.94% of the total amount of fines.