solvency of credit institutions merely points out the following: when marketing loans
or credits, the Ministry of Economy and Competitiveness may establish rules that
promote compliance with the regulation on data protection; the Bank of Spain has
the possibility to access the information and data it requires (a possibility covered by
the OLPPD); all other entities and individuals who are subject to these regulations
are obliged to maintain confidentiality with regard to all information related to
account balances, items, transactions and any other operations of their clients, except
in some specific cases (e.g. money laundering), without prejudice to the provisions
of the rules on data protection. Law 22/2007 of 11 July on distance marketing of
consumer financial services does not contain specific provisions regarding the
processing of personal data.
a) Unmanned aerial vehicles
Royal Decree 1036/2017 of 15 December regulating the civil use of
unmanned aircraft systems does not contain specific rules on the processing of
data; in this regard, it refers to the OLPPD. Therefore, if the use of drones
involves the recording of images of identified or identifiable individuals, it will
be necessary to have a valid reason to process personal data, to inform the data
subjects (Art. 5 OLPPD) and to inform the SDPA about the characteristics of
said data processing (Art. 26 OLPPD). The rules insist on the need to adopt all
necessary measures to respect the privacy of individuals.
b) Mobile health
The following regulations refer to the general rules on data protection:
– The General Health Act 14/1986 of 25 April, and the Basic Law 41/2002 of
14 November, on the autonomy of the patient and the rights and obligations
with regard to clinical information and documentation (data processed in the
context of a healthcare activity carried out by health centres, services and
professionals who are connected in a specific health information system or
become part of the Electronic Health Record).
– Royal Decree 1591/2009 of 16 October, that regulates medical devices (apps
intended by the manufacturer to be used “specifically for diagnostic or
therapeutic purposes and involved in their proper functioning”.)
– Law 39/2015 of 1 October, on the Common Administrative Procedure of PA
(apps that allow users to access information and to initiate a procedure with a
PA, such as the request of doctors’ appointments).
c) IoT
At this point, we need to mention the Royal Decree 188/2016 of 6 May,
which approves the regulation laying down the requirements for marketing,
placing in service and use of radioelectric equipment; and which regulates the
procedure for compliance assessment, market surveillance and regime of sanctions of telecommunications equipment, transposes Directive 2014/53/EU. And
also the OL 1/2015 of 30 March, amending the Criminal Code, transposes
Directive 2013/40/EU.
382
F. M. Corvo López
or credits, the Ministry of Economy and Competitiveness may establish rules that
promote compliance with the regulation on data protection; the Bank of Spain has
the possibility to access the information and data it requires (a possibility covered by
the OLPPD); all other entities and individuals who are subject to these regulations
are obliged to maintain confidentiality with regard to all information related to
account balances, items, transactions and any other operations of their clients, except
in some specific cases (e.g. money laundering), without prejudice to the provisions
of the rules on data protection. Law 22/2007 of 11 July on distance marketing of
consumer financial services does not contain specific provisions regarding the
processing of personal data.
a) Unmanned aerial vehicles
Royal Decree 1036/2017 of 15 December regulating the civil use of
unmanned aircraft systems does not contain specific rules on the processing of
data; in this regard, it refers to the OLPPD. Therefore, if the use of drones
involves the recording of images of identified or identifiable individuals, it will
be necessary to have a valid reason to process personal data, to inform the data
subjects (Art. 5 OLPPD) and to inform the SDPA about the characteristics of
said data processing (Art. 26 OLPPD). The rules insist on the need to adopt all
necessary measures to respect the privacy of individuals.
b) Mobile health
The following regulations refer to the general rules on data protection:
– The General Health Act 14/1986 of 25 April, and the Basic Law 41/2002 of
14 November, on the autonomy of the patient and the rights and obligations
with regard to clinical information and documentation (data processed in the
context of a healthcare activity carried out by health centres, services and
professionals who are connected in a specific health information system or
become part of the Electronic Health Record).
– Royal Decree 1591/2009 of 16 October, that regulates medical devices (apps
intended by the manufacturer to be used “specifically for diagnostic or
therapeutic purposes and involved in their proper functioning”.)
– Law 39/2015 of 1 October, on the Common Administrative Procedure of PA
(apps that allow users to access information and to initiate a procedure with a
PA, such as the request of doctors’ appointments).
c) IoT
At this point, we need to mention the Royal Decree 188/2016 of 6 May,
which approves the regulation laying down the requirements for marketing,
placing in service and use of radioelectric equipment; and which regulates the
procedure for compliance assessment, market surveillance and regime of sanctions of telecommunications equipment, transposes Directive 2014/53/EU. And
also the OL 1/2015 of 30 March, amending the Criminal Code, transposes
Directive 2013/40/EU.
382
F. M. Corvo López