unlawful storage, processing, access or disclosure; (c) the guarantee of an effective
implementation of a security policy regarding the processing of personal data.
Art. 41.2 envisages the eventuality of a specific risk for the violation of the
security of a public network or the service of electronic communications, and
establishes that operators must inform their clients about the risks and the measures
that may be adopted.
In the case of a personal data breach,
20 the operator must notify the SDPA of the
breach without delay (Art. 41.3). The operator must also inform without undue delay
the client or the individual if this breach may have a negative impact on their privacy
or personal data, unless the operator can prove, to the satisfaction of the SDPA, that
the necessary technological protection measures have been applied and that said
measures have been applied to the data affected by the security breach (e.g. measures
that render the data incomprehensible to any person without an authorization to
access them). The notification to the client or the individual must describe, at least,
the nature of the personal data breach and the contact points in which they can obtain
more information, as well as recommended measures to mitigate the possible
adverse effects of said breach. The notification to the SDPA must also describe the
consequences of the breach and the measures that have been proposed or
implemented by the provider to manage the breach.
The law obliges the providers to have a record of the personal data breaches that
allows the SDPA to verify that the notification requirements have been fulfilled. In
addition, the law empowers the SDPA to adopt guidelines or even issue instructions
about the circumstances in which the provider must inform about the personal data
breach, the format of the notification and the way in which this notification has to be
managed.
At this point, we must remember that the Directive (EU) 2016/1148 of the
European Parliament and of the Council of 6 July 2016, concerning measures for a
high common level of security of network and information systems across the
Union, has been recently, transposed into Spanish law by Royal Decree-Law
12/2018 of 7 September.
The supervising body in charge of the control of the processing of personal data in
the context of electronic communications is the SDPA, according to the provisions
of Art. 41 of the GTA.
21 However, the National Commission on Markets and
Competition has the power to sanction, for example, the unauthorized interception
of telecommunications not addressed to the general public as well as the publication
of those contents; and the non-compliance of providers with their obligations
regarding the legal interception of communications laid down in the implementation
of Art. 39 of the GTA (Art. 72.3 GTA).
20 A personal data breach is interpreted as a security breach that leads to the accidental or unlawful
destruction, loss, alteration, revelation of or unauthorized access to personal data transmitted, stored
or processed in any other way with regard to the provision of publicly available electronic
communications services.
21 This provision ultimately specifies that the OLPPD and ROLPPD are applicable. Therefore, the
penalty regime established in it is also applicable.
Data Protection in the Internet: National Report Spain
385
implementation of a security policy regarding the processing of personal data.
Art. 41.2 envisages the eventuality of a specific risk for the violation of the
security of a public network or the service of electronic communications, and
establishes that operators must inform their clients about the risks and the measures
that may be adopted.
In the case of a personal data breach,
20 the operator must notify the SDPA of the
breach without delay (Art. 41.3). The operator must also inform without undue delay
the client or the individual if this breach may have a negative impact on their privacy
or personal data, unless the operator can prove, to the satisfaction of the SDPA, that
the necessary technological protection measures have been applied and that said
measures have been applied to the data affected by the security breach (e.g. measures
that render the data incomprehensible to any person without an authorization to
access them). The notification to the client or the individual must describe, at least,
the nature of the personal data breach and the contact points in which they can obtain
more information, as well as recommended measures to mitigate the possible
adverse effects of said breach. The notification to the SDPA must also describe the
consequences of the breach and the measures that have been proposed or
implemented by the provider to manage the breach.
The law obliges the providers to have a record of the personal data breaches that
allows the SDPA to verify that the notification requirements have been fulfilled. In
addition, the law empowers the SDPA to adopt guidelines or even issue instructions
about the circumstances in which the provider must inform about the personal data
breach, the format of the notification and the way in which this notification has to be
managed.
At this point, we must remember that the Directive (EU) 2016/1148 of the
European Parliament and of the Council of 6 July 2016, concerning measures for a
high common level of security of network and information systems across the
Union, has been recently, transposed into Spanish law by Royal Decree-Law
12/2018 of 7 September.
The supervising body in charge of the control of the processing of personal data in
the context of electronic communications is the SDPA, according to the provisions
of Art. 41 of the GTA.
21 However, the National Commission on Markets and
Competition has the power to sanction, for example, the unauthorized interception
of telecommunications not addressed to the general public as well as the publication
of those contents; and the non-compliance of providers with their obligations
regarding the legal interception of communications laid down in the implementation
of Art. 39 of the GTA (Art. 72.3 GTA).
20 A personal data breach is interpreted as a security breach that leads to the accidental or unlawful
destruction, loss, alteration, revelation of or unauthorized access to personal data transmitted, stored
or processed in any other way with regard to the provision of publicly available electronic
communications services.
21 This provision ultimately specifies that the OLPPD and ROLPPD are applicable. Therefore, the
penalty regime established in it is also applicable.
Data Protection in the Internet: National Report Spain
385