indication of the provisions of this Article; and emphasises the duty of the data
controller to set up the procedures that guarantee that the age of the minor and
authenticity of the consent given by the parents, guardians or legal representatives
have been effectively checked. The draft of the OL reduces the age when the minor
may give his consent to 13 years.
OL 1/1996 of 15 January, on the Legal Protection of Minors, for its part, allows
the collection and processing of all necessary data without consent of the minor
concerned (including data related to the minor, their social or family environment) in
order to adopt appropriate protection measures to safeguard the best interests of the
minor. In this regard, the general regulations on data protection must be followed,
and high security measures must be adopted (Art. 22d).
6
2.1.4 The Right to Be Forgotten
Spanish law does not regulate the “right to be forgotten” but establishes the rights of
rectification, cancellation and opposition (Art. 16 and 17 OLPPD). In order to
exercise the rights of cancellation and opposition, the citizen must address primarily
the entity that has the data. If the entity does not answer the request made or the
citizen thinks that the answer is wrong, the citizen may ask the SDPA to supervise
that the entity responsible fulfils its obligations. Depending on the circumstances of
each particular case, the Agency shall determine whether the request for cancellation
or opposition is applicable or not. This decision of the Agency, in turn, may be
appealed to the courts.
7
2.1.5 The Protection of Personal Data in the Context of Electronic
Communications for Marketing Purposes
Law 34/2002, OLPPD and its secondary legislation (particularly those regulations
related to the collection of personal data, information to interested parties, creation
and maintenance of personal data files), RTGLDCU, Law 9/2014, of 9 May, the
General Telecommunications Act (hereafter, GTA) and the regulations on advertising, cover the protection of personal data in the context of electronic communications for marketing purposes.
In accordance with the provisions of Art. 21 of Law 34/2002, it is forbidden to
send marketing or promotional communications through electronic mail or any
equivalent electronic communication medium which has not been previously
requested or expressly authorized by the recipients of the messages. This prohibition
6 For information on this subject, see Andreu Martínez (2013).
7 The application of the doctrine of the European Court of Justice in its judgement of 13 May 2014
(CJEU 2014\85) by Spanish courts is particularly relevant. See, inter alia. Corvo López (2017),
pp. 175–245.
Data Protection in the Internet: National Report Spain
377
controller to set up the procedures that guarantee that the age of the minor and
authenticity of the consent given by the parents, guardians or legal representatives
have been effectively checked. The draft of the OL reduces the age when the minor
may give his consent to 13 years.
OL 1/1996 of 15 January, on the Legal Protection of Minors, for its part, allows
the collection and processing of all necessary data without consent of the minor
concerned (including data related to the minor, their social or family environment) in
order to adopt appropriate protection measures to safeguard the best interests of the
minor. In this regard, the general regulations on data protection must be followed,
and high security measures must be adopted (Art. 22d).
6
2.1.4 The Right to Be Forgotten
Spanish law does not regulate the “right to be forgotten” but establishes the rights of
rectification, cancellation and opposition (Art. 16 and 17 OLPPD). In order to
exercise the rights of cancellation and opposition, the citizen must address primarily
the entity that has the data. If the entity does not answer the request made or the
citizen thinks that the answer is wrong, the citizen may ask the SDPA to supervise
that the entity responsible fulfils its obligations. Depending on the circumstances of
each particular case, the Agency shall determine whether the request for cancellation
or opposition is applicable or not. This decision of the Agency, in turn, may be
appealed to the courts.
7
2.1.5 The Protection of Personal Data in the Context of Electronic
Communications for Marketing Purposes
Law 34/2002, OLPPD and its secondary legislation (particularly those regulations
related to the collection of personal data, information to interested parties, creation
and maintenance of personal data files), RTGLDCU, Law 9/2014, of 9 May, the
General Telecommunications Act (hereafter, GTA) and the regulations on advertising, cover the protection of personal data in the context of electronic communications for marketing purposes.
In accordance with the provisions of Art. 21 of Law 34/2002, it is forbidden to
send marketing or promotional communications through electronic mail or any
equivalent electronic communication medium which has not been previously
requested or expressly authorized by the recipients of the messages. This prohibition
6 For information on this subject, see Andreu Martínez (2013).
7 The application of the doctrine of the European Court of Justice in its judgement of 13 May 2014
(CJEU 2014\85) by Spanish courts is particularly relevant. See, inter alia. Corvo López (2017),
pp. 175–245.
Data Protection in the Internet: National Report Spain
377