Currently, a draft for a new OLPPD adapted to the requirements of the General
Data Protection Regulation (GDPR) is being prepared.
13
2.2 Data Protection in the Electronic Communications Sector
As far as the regulatory framework is concerned, we must say that, as a general rule,
the OLPPD is applied, and the GTA is applied specifically in the electronic communications sector (particularly Art. 34 and 38). This act is developed in Royal
Decree 424/2005 of 15 April, which approves the regulations on conditions for the
provision of services of electronic communications, universal service and the protection of users (Title V). In addition, we must take into account Law 25/2007 of
October 18, on the retention of data related to electronic communications
14 and
public communication networks, and Royal Decree 899/2009 of 22 May, which
approves the rights of users of electronic communication services (Art. 31).
15
The entities subject to these legal rules are:
– Operators of public electronic communications networks or operators providing
publicly available electronic communications services, including publicly available communications networks that provide support to devices for the identification and collection of data (Art. 41.1 GTA).
– Providers of publicly available electronic communications services or providers
that operate public communications networks (Art. 2 of Law 25/2007).
16
In the field of electronic communications, we talk about communication data to
refer to the process in which information is shared among two or more entities. It
requires four basic elements: sender, message, channel and receiver. Law 25/2007
refers to the data subject to retention, and it establishes a difference based on whether
it is fixed network telephony and mobile telephony or internet access, internet-based
electronic mail and internet telephony: (a) data necessary to trace and identify the
source of a communication; (b) data necessary to identify the destination of a
13 For commentary on this provision, see, Piñar Mañas (2016) and Aragonés Salvat (2016).
14 This law has not been repealed, in spite of the fact that the judgement from the Court of Justice of
the European Union of 8 April 2014 (CJEU 2014\104), Digital Rights Ireland Ltd v. Minister for
Communications, Marine and Natural Resources, with case no. C-293/12 and C-594/12, declared
Directive 2006/24/EC of the European Parliament and the Council of 15 March 2006, on the
retention of data generated or processed in connection with the provision of publicly available
electronic communications services to be invalid, because it considered that it represented “a wideranging and particularly serious interference” with the fundamental rights to respect for privacy and
the protection of personal data.
15 See Dávara Rodríguez (2000), and, more recently, the study of comparative law carried out by
Quesada Rodríguez (2015).
16 This law does not apply to the provision of instant messaging services, according to Report 0343/
2013 of the SDPA.
Data Protection in the Internet: National Report Spain
383
Data Protection Regulation (GDPR) is being prepared.
13
2.2 Data Protection in the Electronic Communications Sector
As far as the regulatory framework is concerned, we must say that, as a general rule,
the OLPPD is applied, and the GTA is applied specifically in the electronic communications sector (particularly Art. 34 and 38). This act is developed in Royal
Decree 424/2005 of 15 April, which approves the regulations on conditions for the
provision of services of electronic communications, universal service and the protection of users (Title V). In addition, we must take into account Law 25/2007 of
October 18, on the retention of data related to electronic communications
14 and
public communication networks, and Royal Decree 899/2009 of 22 May, which
approves the rights of users of electronic communication services (Art. 31).
15
The entities subject to these legal rules are:
– Operators of public electronic communications networks or operators providing
publicly available electronic communications services, including publicly available communications networks that provide support to devices for the identification and collection of data (Art. 41.1 GTA).
– Providers of publicly available electronic communications services or providers
that operate public communications networks (Art. 2 of Law 25/2007).
16
In the field of electronic communications, we talk about communication data to
refer to the process in which information is shared among two or more entities. It
requires four basic elements: sender, message, channel and receiver. Law 25/2007
refers to the data subject to retention, and it establishes a difference based on whether
it is fixed network telephony and mobile telephony or internet access, internet-based
electronic mail and internet telephony: (a) data necessary to trace and identify the
source of a communication; (b) data necessary to identify the destination of a
13 For commentary on this provision, see, Piñar Mañas (2016) and Aragonés Salvat (2016).
14 This law has not been repealed, in spite of the fact that the judgement from the Court of Justice of
the European Union of 8 April 2014 (CJEU 2014\104), Digital Rights Ireland Ltd v. Minister for
Communications, Marine and Natural Resources, with case no. C-293/12 and C-594/12, declared
Directive 2006/24/EC of the European Parliament and the Council of 15 March 2006, on the
retention of data generated or processed in connection with the provision of publicly available
electronic communications services to be invalid, because it considered that it represented “a wideranging and particularly serious interference” with the fundamental rights to respect for privacy and
the protection of personal data.
15 See Dávara Rodríguez (2000), and, more recently, the study of comparative law carried out by
Quesada Rodríguez (2015).
16 This law does not apply to the provision of instant messaging services, according to Report 0343/
2013 of the SDPA.
Data Protection in the Internet: National Report Spain
383