2.5 Remedies and Sanctions
The infringement of Spanish data protection rules may result in administrative, civil
or criminal liability. Find below the penalties imposed by some of our rules on data
protection.
2.5.1 General Personal Data Protection Rules
Administrative penalty: A fine of an amount that varies depending on the type of
sanction: minor (€900–40,000), serious (€40,001–300,000) or very serious
(€300,001–600,000), which may be graded according to the criteria established in
Art. 45.4 of the OLPPD. The SDPA has imposed fines of up to €1,200,000
(specifically to Facebook, in September 2017).
27
Civil penalty: compensation for the infringement of the right to honour, privacy
and self-image (OL 1/1982).
Criminal penalty: Crimes of illegal interference with information or data systems
(Art. 264 to 264d); crimes of discovery and revelation of secrets (Art. 197 to 197e of
the Criminal Code).
2.5.2 Rules Regarding the Protection of Personal Data in the Context
of Services Provided at a Distance, by Electronic Means, at
the Individual Request of a Recipient of Services
Administrative penalty: A fine of an amount that varies depending on the type of
sanction: minor (up to €30,000), serious (€30,001–150,000) or very serious
(€150,001–600,000), which may be graded according to the criteria established in
Art. 39b and 40 of Law 34/2002.
Civil penalty (consumer protection): Cancellation of the distance contract at the
request of the consumer (Art. 100 RTGLDCU).
Criminal penalty: fraud (Art. 248 onwards of the Criminal Code).
2.5.3 Rules Regarding the Protection of Personal Data in the Context
of Electronic Communications for Marketing Purposes
Administrative penalty: According to Art. 43.1 of Law 34/2002, the SDPA is
responsible for imposing sanctions for infractions classified as “serious” in Art.
38.3 c), d) and i) and infractions classified as “minor” in Art. 38.4 d), g) and h) of
27 “The Spanish DPA fines Facebook for violating data protection regulations”, available on http://
www.agpd.es/portalwebAGPD/revista_prensa/revista_prensa/2017/notas_prensa/news/2017_09_
11-ides-idphp.php.
Data Protection in the Internet: National Report Spain
391
The infringement of Spanish data protection rules may result in administrative, civil
or criminal liability. Find below the penalties imposed by some of our rules on data
protection.
2.5.1 General Personal Data Protection Rules
Administrative penalty: A fine of an amount that varies depending on the type of
sanction: minor (€900–40,000), serious (€40,001–300,000) or very serious
(€300,001–600,000), which may be graded according to the criteria established in
Art. 45.4 of the OLPPD. The SDPA has imposed fines of up to €1,200,000
(specifically to Facebook, in September 2017).
27
Civil penalty: compensation for the infringement of the right to honour, privacy
and self-image (OL 1/1982).
Criminal penalty: Crimes of illegal interference with information or data systems
(Art. 264 to 264d); crimes of discovery and revelation of secrets (Art. 197 to 197e of
the Criminal Code).
2.5.2 Rules Regarding the Protection of Personal Data in the Context
of Services Provided at a Distance, by Electronic Means, at
the Individual Request of a Recipient of Services
Administrative penalty: A fine of an amount that varies depending on the type of
sanction: minor (up to €30,000), serious (€30,001–150,000) or very serious
(€150,001–600,000), which may be graded according to the criteria established in
Art. 39b and 40 of Law 34/2002.
Civil penalty (consumer protection): Cancellation of the distance contract at the
request of the consumer (Art. 100 RTGLDCU).
Criminal penalty: fraud (Art. 248 onwards of the Criminal Code).
2.5.3 Rules Regarding the Protection of Personal Data in the Context
of Electronic Communications for Marketing Purposes
Administrative penalty: According to Art. 43.1 of Law 34/2002, the SDPA is
responsible for imposing sanctions for infractions classified as “serious” in Art.
38.3 c), d) and i) and infractions classified as “minor” in Art. 38.4 d), g) and h) of
27 “The Spanish DPA fines Facebook for violating data protection regulations”, available on http://
www.agpd.es/portalwebAGPD/revista_prensa/revista_prensa/2017/notas_prensa/news/2017_09_
11-ides-idphp.php.
Data Protection in the Internet: National Report Spain
391