f) There are also rules aimed at controlling the transborder flow of data that openly
conditions it to the existence of an adequate level of protection, despite some
exceptions that can permit the transfer;
g) The dimension of specific rules on data protection on the internet is still
underdeveloped, but growing. In any case, though causing problems of inexistence of norms more suited to regulate special problems related to the internet,
perhaps with the exception of some sanctionatory matters, does not leave the
field unregulated because general norms and rules related to data protection in
the telecommunications field are applicable, and courts have powers to interpret
broadly ordinary law and appeal directly to the constitutional rights that protect
privacy and data;
h) Rules on data protection gathered by intelligence agencies—both civil and
military—lack precision and may create hermeneutical problems, specially
related to powers to obtain information on the internet by communication
monitoring or analysis of metadata and related judicial control, but as far as
the organisation and capacity of the services are still limited the problem is
frozen for a while;
i) With regard to data protection in criminal proceedings, though permissible
under the law, the regime inserted in the Code of Criminal Procedure and in
the Cybercrime (and Digital Evidences) Act is rather strict and marked by a
principle of judicial authorisation and by the possibility of exclusion of evidence obtained by arbitrary intervention in private life;
j) Another important feature is the existence of an independent administrative
agency, the National Authority on Data Protection, specially designed to protect
data, through preventive intervention by necessary authorisation to data controllers; advice prior to data treatment, powers to impose sanction, and competence to receive complaints;
k) Appellative role of courts; for this reason, despite the existence of a special
administrative agency, courts, specially the Constitutional Court, are involved
in this field without much space to be excessively deferential with decisions of
the National Authority on Data Protection;
l) Common remedies to protect data are part of the system, namely the possibility
of lodging complaints in administrative agencies, starting civil proceedings for
liability in data processing, and the possibility of seeking criminal responsibility
through the Office of the Public Prosecutor, but it has two special procedures
that can permit access to the Constitutional Court: a general remedy for civil
and political rights judicial defence that can be used to protect both the general
right to privacy and the safeguards linked to data protection, the Recurso de
Amparo, a Constitutional Complaint; and a special writ to protect data, the
Habeas Data.
m) The sanctionary regime is not yet complete and though a tendency of its
toughen up is visible in the last amendment to the general law on data protection
and in new special legislation in this field, it follows a path of moderation both
at the administrative and criminal domains.
110
J. Pina-Delgado
conditions it to the existence of an adequate level of protection, despite some
exceptions that can permit the transfer;
g) The dimension of specific rules on data protection on the internet is still
underdeveloped, but growing. In any case, though causing problems of inexistence of norms more suited to regulate special problems related to the internet,
perhaps with the exception of some sanctionatory matters, does not leave the
field unregulated because general norms and rules related to data protection in
the telecommunications field are applicable, and courts have powers to interpret
broadly ordinary law and appeal directly to the constitutional rights that protect
privacy and data;
h) Rules on data protection gathered by intelligence agencies—both civil and
military—lack precision and may create hermeneutical problems, specially
related to powers to obtain information on the internet by communication
monitoring or analysis of metadata and related judicial control, but as far as
the organisation and capacity of the services are still limited the problem is
frozen for a while;
i) With regard to data protection in criminal proceedings, though permissible
under the law, the regime inserted in the Code of Criminal Procedure and in
the Cybercrime (and Digital Evidences) Act is rather strict and marked by a
principle of judicial authorisation and by the possibility of exclusion of evidence obtained by arbitrary intervention in private life;
j) Another important feature is the existence of an independent administrative
agency, the National Authority on Data Protection, specially designed to protect
data, through preventive intervention by necessary authorisation to data controllers; advice prior to data treatment, powers to impose sanction, and competence to receive complaints;
k) Appellative role of courts; for this reason, despite the existence of a special
administrative agency, courts, specially the Constitutional Court, are involved
in this field without much space to be excessively deferential with decisions of
the National Authority on Data Protection;
l) Common remedies to protect data are part of the system, namely the possibility
of lodging complaints in administrative agencies, starting civil proceedings for
liability in data processing, and the possibility of seeking criminal responsibility
through the Office of the Public Prosecutor, but it has two special procedures
that can permit access to the Constitutional Court: a general remedy for civil
and political rights judicial defence that can be used to protect both the general
right to privacy and the safeguards linked to data protection, the Recurso de
Amparo, a Constitutional Complaint; and a special writ to protect data, the
Habeas Data.
m) The sanctionary regime is not yet complete and though a tendency of its
toughen up is visible in the last amendment to the general law on data protection
and in new special legislation in this field, it follows a path of moderation both
at the administrative and criminal domains.
110
J. Pina-Delgado