2.1.7 Other Obligations in Order to Protect Personal Data Conveyed
and Stored Through Electronic Means
Art. 4.5 of the OLPPD stipulates that personal data shall be kept in a form which
permits identification of data subjects for no longer than necessary for the purposes
for which they are processed. Art. 8.6 of the ROLPPD admits that the data may be
stored for as long as some kind of liability may be imposed, derived from a legal
obligation, the performance of a contract or the implementation of pre-contractual
measures requested by the data subject. In this case, the cancellation must be carried
out by blocking the data, which will only be available to the PA, judges and courts,
for the fulfilment of the abovementioned responsibilities (Art. 16.3 OLPPD). After
this period, the data must be destroyed. By way of exception, Art. 4.5 also contemplates the possibility of preserving certain data in their entirety if their historical,
statistical or scientific value is addressed by specific legislation (particularly, the
provisions of act 12/1989 of 9 May on the Public Statistical Function, Law 16/1985
of 25 June, on the Spanish Historical Heritage, and Law 14/2011 of 1 June, on
Science, Technology and Innovation, as well as their respective implementing provisions and the autonomous legislation on these matters).
2.1.8 Security Obligations and Data Breach Notifications Concerning
Data Processed by Electronic Means
When regulating the basic and medium security measures applicable to electronic
files and processing, Art. 90 and 100 of the ROLPPD provide for a register of
incidents. However, this is a record obligation of an internal nature within the entity
or the organization.
In the field of telecommunications, providers of electronic communication services to the public are obliged to notify about security breaches to the SDPA and, in
some cases, also to their subscribers or clients (Art. 41.3 LGT). In this area, we must
also bear in mind the newly approved Royal Decree-Law 12/2018 of 7 September,
which transpose into Spanish law Directive (EU) 2016/1148 of the European
Parliament and of the Council of 6 July 2016, concerning measures for a high
common level of security of network and information systems across the Union.
2.1.9 Specific Legislation on Sectorial Areas
In the banking area in general, Law 44/2002 of 22 November, on measures to reform
the financial system, is particularly relevant. It often refers to the OLPPD, but it
includes some specific provisions related, for example, to the contents of the
information coming from reporting entities, the rights of access, rectification and
cancellation, as well as use and transfer of data by the Bank of Spain and the
retention of data. Law 10/2014 of 26 June on the regulation, supervision and
Data Protection in the Internet: National Report Spain
381
and Stored Through Electronic Means
Art. 4.5 of the OLPPD stipulates that personal data shall be kept in a form which
permits identification of data subjects for no longer than necessary for the purposes
for which they are processed. Art. 8.6 of the ROLPPD admits that the data may be
stored for as long as some kind of liability may be imposed, derived from a legal
obligation, the performance of a contract or the implementation of pre-contractual
measures requested by the data subject. In this case, the cancellation must be carried
out by blocking the data, which will only be available to the PA, judges and courts,
for the fulfilment of the abovementioned responsibilities (Art. 16.3 OLPPD). After
this period, the data must be destroyed. By way of exception, Art. 4.5 also contemplates the possibility of preserving certain data in their entirety if their historical,
statistical or scientific value is addressed by specific legislation (particularly, the
provisions of act 12/1989 of 9 May on the Public Statistical Function, Law 16/1985
of 25 June, on the Spanish Historical Heritage, and Law 14/2011 of 1 June, on
Science, Technology and Innovation, as well as their respective implementing provisions and the autonomous legislation on these matters).
2.1.8 Security Obligations and Data Breach Notifications Concerning
Data Processed by Electronic Means
When regulating the basic and medium security measures applicable to electronic
files and processing, Art. 90 and 100 of the ROLPPD provide for a register of
incidents. However, this is a record obligation of an internal nature within the entity
or the organization.
In the field of telecommunications, providers of electronic communication services to the public are obliged to notify about security breaches to the SDPA and, in
some cases, also to their subscribers or clients (Art. 41.3 LGT). In this area, we must
also bear in mind the newly approved Royal Decree-Law 12/2018 of 7 September,
which transpose into Spanish law Directive (EU) 2016/1148 of the European
Parliament and of the Council of 6 July 2016, concerning measures for a high
common level of security of network and information systems across the Union.
2.1.9 Specific Legislation on Sectorial Areas
In the banking area in general, Law 44/2002 of 22 November, on measures to reform
the financial system, is particularly relevant. It often refers to the OLPPD, but it
includes some specific provisions related, for example, to the contents of the
information coming from reporting entities, the rights of access, rectification and
cancellation, as well as use and transfer of data by the Bank of Spain and the
retention of data. Law 10/2014 of 26 June on the regulation, supervision and
Data Protection in the Internet: National Report Spain
381