may, these and other constitutional norms are always applicable even in the absence
of legislation and even if contradicted by legislation.
The Republic’s Information Service Regulation, in its article 6(3), considers that
threats which the Office has the obligation to prevent have to be especially serious,
such as, for example, action by radical and anti-democratic groups and other acts
against the constitutional principles, transnational organised crimes and mafias,
terrorism, speculation with capital, destructive sects, both religious and exoteric,
proliferation and smuggling of arms and its use by criminal groups, technological
crimes and the use of cybernetic technology with criminal purposes.
It would seem that this is the main explicit requirement according to the law,
because, apparently, an order leading to the gathering and to the storage of information and data is not subject to previous judicial authorisation, nor has it to be
validated ex post factum, as long as it is necessary for the purposes that justify the
existence of the intelligence service in general, and the specific threat. In addition, it
would create the impression that, in principle, any entity and person, national or
foreign, can be the subject of data processing for those purposes, and for the time that
is deemed necessary to counter the threat. This is not the best interpretation,
however, because constitutional norms that protect privacy and personal data condition interference with mail—including electronic mail—and all kinds of methods
of communication do so by using an authorisation established by law and a judicial
warrant. Besides this, additional control is related with the existence of a commission
composed by three members of the Public Prosecution’s Service that supervise the
Data Centre (article 15) and the general political oversight of a special parliamentary
commission that shall monitor the intelligence service according to the Law (Articles
20 and 21).
3.5 Remedies and Sanctions
The Personal Data Protection Act provides for a myriad of remedies, both civil,
administrative and ordinary judicial ones, because it recognises that “without prejudice to the right to submit a complaint to the CNPD, according to the law any
individual may seek legal recourse regarding violations of rights granted him by the
present law” (article 30).
Thus, the Personal Data Protection Act allows data subjects to lodge complaints
with the Authority in cases of administrative offences, specifically negligence in the
obligation to notify the Authority of processing of data, presentation of false
information or inobservance of requirements of information in authorisation
requests, continuance of permission of access to open data transmission networks
to controllers who fail to comply with the provisions of the law can be fined to a
minimum of 300,000 CVE (around US$3000/€27,244) and a maximum of
3,000,000 CVE (around US$30,000/€27,244) if a legal entity or to a minimum of
$50,000 CVE (around US$515/€454) and a maximum of $500,000 CVE (around US
$5159/€4540) if a physical person, with the possibility of applying double that
104
J. Pina-Delgado
of legislation and even if contradicted by legislation.
The Republic’s Information Service Regulation, in its article 6(3), considers that
threats which the Office has the obligation to prevent have to be especially serious,
such as, for example, action by radical and anti-democratic groups and other acts
against the constitutional principles, transnational organised crimes and mafias,
terrorism, speculation with capital, destructive sects, both religious and exoteric,
proliferation and smuggling of arms and its use by criminal groups, technological
crimes and the use of cybernetic technology with criminal purposes.
It would seem that this is the main explicit requirement according to the law,
because, apparently, an order leading to the gathering and to the storage of information and data is not subject to previous judicial authorisation, nor has it to be
validated ex post factum, as long as it is necessary for the purposes that justify the
existence of the intelligence service in general, and the specific threat. In addition, it
would create the impression that, in principle, any entity and person, national or
foreign, can be the subject of data processing for those purposes, and for the time that
is deemed necessary to counter the threat. This is not the best interpretation,
however, because constitutional norms that protect privacy and personal data condition interference with mail—including electronic mail—and all kinds of methods
of communication do so by using an authorisation established by law and a judicial
warrant. Besides this, additional control is related with the existence of a commission
composed by three members of the Public Prosecution’s Service that supervise the
Data Centre (article 15) and the general political oversight of a special parliamentary
commission that shall monitor the intelligence service according to the Law (Articles
20 and 21).
3.5 Remedies and Sanctions
The Personal Data Protection Act provides for a myriad of remedies, both civil,
administrative and ordinary judicial ones, because it recognises that “without prejudice to the right to submit a complaint to the CNPD, according to the law any
individual may seek legal recourse regarding violations of rights granted him by the
present law” (article 30).
Thus, the Personal Data Protection Act allows data subjects to lodge complaints
with the Authority in cases of administrative offences, specifically negligence in the
obligation to notify the Authority of processing of data, presentation of false
information or inobservance of requirements of information in authorisation
requests, continuance of permission of access to open data transmission networks
to controllers who fail to comply with the provisions of the law can be fined to a
minimum of 300,000 CVE (around US$3000/€27,244) and a maximum of
3,000,000 CVE (around US$30,000/€27,244) if a legal entity or to a minimum of
$50,000 CVE (around US$515/€454) and a maximum of $500,000 CVE (around US
$5159/€4540) if a physical person, with the possibility of applying double that
104
J. Pina-Delgado