2.3.3 Data Retention
With regard to the retention of data, we must highlight Law 25/2007, in which Art.
6 mentions that all data retained according to this Law can only be transferred
according to what is provided for in the Law, for the purposes established in it and
with prior authorization of a judicial authority. This transfer will be carried out in
electronic format and only to the authorized agents (that is, members of the State
security forces and public officials of the Deputy Office of Customs Surveillance
when working in the capacity of Judicial Police, and personnel of the National
Intelligence Centre within their security investigations of individuals or entities).
The court’s decision will specify the data that must be transferred (Art. 7).
25
In the field of criminal proceedings, we must take into account Art. 588g of the
CPA, which allows the Public Prosecutor’s Office or the Judicial Police to request
that any individual or legal entity retains and protects specific data or information
included in a digital storage system under their control until a judicial authorization
for the transfer of said data is obtained, according to the provisions laid down in the
previous articles of the Law. These data will be retained for a maximum period of
90 days, renewable only once until the transfer is authorized or up to a maximum of
180 days. According to the provisions laid down in the law, the individual or legal
entity that receives the request is obliged to cooperate and to keep the confidentiality
regarding the development of these measures, and may be charged for a crime of
disobedience in case of non-compliance (Art. 588c e 3 CPA).
2.4 Data Protection and Electronic Surveillance for Security
and Defence Purposes
According to Art. 2 of the OLPPD: (1) the provisions of this law shall not apply to
“files established for the investigation of terrorism and serious forms of organised
crime. However, in such cases, the person responsible for the file shall previously
inform the SDPA of its existence, its general characteristics and its purpose”; (2) the
processing of personal data contained in the Civil Register and the Central Criminal
Register, and those that derive from images and sound recorded with video cameras
by the security forces in accordance with the relevant legislation—that is, OL 4/1997
of 4 August, regulating the use of video cameras by security forces and units in
public open and closed spaces—among others, shall be governed by the specific
provisions, and by any special provisions, of this Law.
26
25 For more information, see De Miguel Asensio (2015), pp. 355–359.
26 The installation of cameras must be authorized by the corresponding administrative authorities.
The public must be informed about the installation of fixed cameras, and the image and sound
captured by any of the devices established by the law must be destroyed within a month after they
were obtained, except in the case in which they are related to serious or very serious criminal or
Data Protection in the Internet: National Report Spain
389
With regard to the retention of data, we must highlight Law 25/2007, in which Art.
6 mentions that all data retained according to this Law can only be transferred
according to what is provided for in the Law, for the purposes established in it and
with prior authorization of a judicial authority. This transfer will be carried out in
electronic format and only to the authorized agents (that is, members of the State
security forces and public officials of the Deputy Office of Customs Surveillance
when working in the capacity of Judicial Police, and personnel of the National
Intelligence Centre within their security investigations of individuals or entities).
The court’s decision will specify the data that must be transferred (Art. 7).
25
In the field of criminal proceedings, we must take into account Art. 588g of the
CPA, which allows the Public Prosecutor’s Office or the Judicial Police to request
that any individual or legal entity retains and protects specific data or information
included in a digital storage system under their control until a judicial authorization
for the transfer of said data is obtained, according to the provisions laid down in the
previous articles of the Law. These data will be retained for a maximum period of
90 days, renewable only once until the transfer is authorized or up to a maximum of
180 days. According to the provisions laid down in the law, the individual or legal
entity that receives the request is obliged to cooperate and to keep the confidentiality
regarding the development of these measures, and may be charged for a crime of
disobedience in case of non-compliance (Art. 588c e 3 CPA).
2.4 Data Protection and Electronic Surveillance for Security
and Defence Purposes
According to Art. 2 of the OLPPD: (1) the provisions of this law shall not apply to
“files established for the investigation of terrorism and serious forms of organised
crime. However, in such cases, the person responsible for the file shall previously
inform the SDPA of its existence, its general characteristics and its purpose”; (2) the
processing of personal data contained in the Civil Register and the Central Criminal
Register, and those that derive from images and sound recorded with video cameras
by the security forces in accordance with the relevant legislation—that is, OL 4/1997
of 4 August, regulating the use of video cameras by security forces and units in
public open and closed spaces—among others, shall be governed by the specific
provisions, and by any special provisions, of this Law.
26
25 For more information, see De Miguel Asensio (2015), pp. 355–359.
26 The installation of cameras must be authorized by the corresponding administrative authorities.
The public must be informed about the installation of fixed cameras, and the image and sound
captured by any of the devices established by the law must be destroyed within a month after they
were obtained, except in the case in which they are related to serious or very serious criminal or
Data Protection in the Internet: National Report Spain
389