1.3 The Supervision Authorities
In Spain, the role of ensuring compliance with the rules on data protection is
attributed to the Spanish Data Protection Agency (hereafter, SDPA). It is a publicly
constituted legal body with legal personality, an independent body with its own
budget and full functional autonomy that acts in accordance with the provisions of
the OLPPD and its own statute.
4 It is subject to administrative law both in the
exercise of its powers and with regard to its property and recruitment regimes.
Art. 28.1 of Directive 95/46 establishes that “Each Member State shall provide
that one or more public authorities are responsible for monitoring the application
within its territory of the provisions adopted by them.” That is the reason why, in
Spain, different autonomous agencies have been created: in Madrid (2001), in
Catalonia (2003), in the Basque Country (2004) and in Andalusia (2014). The
Data Protection Agency of the Community of Madrid was abolished in 2013 and
its functions were assumed by the SDPA.
The SDPA is responsible for ensuring compliance with legislation on data
protection and monitoring its implementation, especially with regard to the rights
of information, access, rectification, opposition and cancellation of data (ARCO
rights). Its functions are contained in Art. 37 of the OLPPD and can be succinctly
described as follows:
A. In connection with those affected
• Complying with their requests and complaints.
• Reporting about the rights recognized in the law.
• Promoting campaigns through the media.
• Ensuring the publicity of data files of a personal nature.
B. In relation to those processing data
• Issuing authorisations provided for in the law.
• Demanding corrective action.
• Ordering, in case of illegality, termination of the treatment and cancellation
of data.
• Exercising the power of sanction under title VII of the OLPPD.
• Asking those responsible for processing files for assistance and information
necessary for the exercise of its functions.
• Authorizing international transfers of data.
C. In relation to the development of standards
• Compulsorily report on the draft standards that develop the OLPPD.
• Reporting on draft regulations that involve data protection.
• Issuing precise instructions and recommendations to adapt automatic
processing to the principles of the OLPPD.
4 Royal Decree 428/1993 of 26 March, which approves the statute of the SDPA.
Data Protection in the Internet: National Report Spain
373
In Spain, the role of ensuring compliance with the rules on data protection is
attributed to the Spanish Data Protection Agency (hereafter, SDPA). It is a publicly
constituted legal body with legal personality, an independent body with its own
budget and full functional autonomy that acts in accordance with the provisions of
the OLPPD and its own statute.
4 It is subject to administrative law both in the
exercise of its powers and with regard to its property and recruitment regimes.
Art. 28.1 of Directive 95/46 establishes that “Each Member State shall provide
that one or more public authorities are responsible for monitoring the application
within its territory of the provisions adopted by them.” That is the reason why, in
Spain, different autonomous agencies have been created: in Madrid (2001), in
Catalonia (2003), in the Basque Country (2004) and in Andalusia (2014). The
Data Protection Agency of the Community of Madrid was abolished in 2013 and
its functions were assumed by the SDPA.
The SDPA is responsible for ensuring compliance with legislation on data
protection and monitoring its implementation, especially with regard to the rights
of information, access, rectification, opposition and cancellation of data (ARCO
rights). Its functions are contained in Art. 37 of the OLPPD and can be succinctly
described as follows:
A. In connection with those affected
• Complying with their requests and complaints.
• Reporting about the rights recognized in the law.
• Promoting campaigns through the media.
• Ensuring the publicity of data files of a personal nature.
B. In relation to those processing data
• Issuing authorisations provided for in the law.
• Demanding corrective action.
• Ordering, in case of illegality, termination of the treatment and cancellation
of data.
• Exercising the power of sanction under title VII of the OLPPD.
• Asking those responsible for processing files for assistance and information
necessary for the exercise of its functions.
• Authorizing international transfers of data.
C. In relation to the development of standards
• Compulsorily report on the draft standards that develop the OLPPD.
• Reporting on draft regulations that involve data protection.
• Issuing precise instructions and recommendations to adapt automatic
processing to the principles of the OLPPD.
4 Royal Decree 428/1993 of 26 March, which approves the statute of the SDPA.
Data Protection in the Internet: National Report Spain
373