communication; (c) data necessary to identify the date, time and duration of a
communication; (d) data necessary to identify the type of communication; (e) data
necessary to identify the communication device or what purports to be the communication device; (f) data necessary to identify the location of mobile communication
equipment.
17
Art. 3i of the OLPPD, in contrast, defines the “Assignment or communication of
data” as “any disclosure of data to a person other than the data subject”. The OLPPD
establishes a difference between data communication as such—which must take
place to fulfil the purposes directly related to the legitimate functions of the transferor and the transferee and which requires, except in the cases specifically provided
for in the Law, the consent of the data subject. This consent may be revoked and
shall be null and void if the information provided to the data subject does not allow
them to understand unequivocally the purpose for which the relevant data shall be
used
18
—and the access to data by third parties when said access is necessary to
provide a service to the person responsible for the processing of data, in which case
the access is not classified as data communication.
19 Art. 21 of the OLPPD establishes specific regulations for the communication of data between PA, which must be
connected to Art. 155 of the Law 40/2015 of 1 October on the legal regime of the
public sector.
Operators of public electronic communications networks or operators providing
publicly available electronic communications services must guarantee the confidentiality of communications (Art. 18.3 and 55.2 SC) and adopt all necessary technical
measures to ensure it. However, they are obliged to execute the interceptions
authorized in accordance with Art. 579 of the Criminal Procedure Act (hereafter,
CPA); with OL 2/2002 of 6 May, regulating preliminary judicial control of the
National Intelligence Centre; and with other regulations having the force of organic
laws (Art. 39 GTA).
Art. 41.1 GTA establishes that operators of public electronic communications
networks or operators providing publicly available electronic communications services, including publicly available communications networks that provide support to
devices for the identification and collection of data, must adopt all necessary
technical and management techniques to maintain the security of use of their
network or the provision of services, in order to guarantee the protection of personal
data. These measures may be examined by the SDPA—which may issue recommendations—and they will include, at least: (a) the guarantee that only authorized
personnel will have access to the personal data and for the purposes authorized by
the Law; (b) the protection of the personal data stored or communicated from
accidental or unlawful destruction, accidental loss or alteration, or unauthorized or
17 The transfer of these data is referred to in Art. 7 of Law 25/2007.
18 Art. 11.2 of the OLPPD specifies the cases in which consent from the data subject is not
necessary.
19 See Art. 12 of the OLPPD.
384
F. M. Corvo López
communication; (d) data necessary to identify the type of communication; (e) data
necessary to identify the communication device or what purports to be the communication device; (f) data necessary to identify the location of mobile communication
equipment.
17
Art. 3i of the OLPPD, in contrast, defines the “Assignment or communication of
data” as “any disclosure of data to a person other than the data subject”. The OLPPD
establishes a difference between data communication as such—which must take
place to fulfil the purposes directly related to the legitimate functions of the transferor and the transferee and which requires, except in the cases specifically provided
for in the Law, the consent of the data subject. This consent may be revoked and
shall be null and void if the information provided to the data subject does not allow
them to understand unequivocally the purpose for which the relevant data shall be
used
18
—and the access to data by third parties when said access is necessary to
provide a service to the person responsible for the processing of data, in which case
the access is not classified as data communication.
19 Art. 21 of the OLPPD establishes specific regulations for the communication of data between PA, which must be
connected to Art. 155 of the Law 40/2015 of 1 October on the legal regime of the
public sector.
Operators of public electronic communications networks or operators providing
publicly available electronic communications services must guarantee the confidentiality of communications (Art. 18.3 and 55.2 SC) and adopt all necessary technical
measures to ensure it. However, they are obliged to execute the interceptions
authorized in accordance with Art. 579 of the Criminal Procedure Act (hereafter,
CPA); with OL 2/2002 of 6 May, regulating preliminary judicial control of the
National Intelligence Centre; and with other regulations having the force of organic
laws (Art. 39 GTA).
Art. 41.1 GTA establishes that operators of public electronic communications
networks or operators providing publicly available electronic communications services, including publicly available communications networks that provide support to
devices for the identification and collection of data, must adopt all necessary
technical and management techniques to maintain the security of use of their
network or the provision of services, in order to guarantee the protection of personal
data. These measures may be examined by the SDPA—which may issue recommendations—and they will include, at least: (a) the guarantee that only authorized
personnel will have access to the personal data and for the purposes authorized by
the Law; (b) the protection of the personal data stored or communicated from
accidental or unlawful destruction, accidental loss or alteration, or unauthorized or
17 The transfer of these data is referred to in Art. 7 of Law 25/2007.
18 Art. 11.2 of the OLPPD specifies the cases in which consent from the data subject is not
necessary.
19 See Art. 12 of the OLPPD.
384
F. M. Corvo López