2.5.7 Rules Applicable to the Protection of Personal Data
for the Purpose of the Investigation, Detection and Prosecution
of Crimes Through Electronic
Criminal penalty: Crime of disobedience (Art. 410, 556 of the Criminal Code).
Penalties vary significantly depending on whether the subject is an authority or
public servant or an individual.
2.5.8 Rules Applicable to the Electronic Processing of Personal Data
for Security and National Defence Purposes
Criminal penalty and, if it is not possible to establish criminal responsibilities,
according to Art. 10 of OL 4/1997, sanctions may be imposed according to the
corresponding disciplinary regime applicable to the offenders or, failing that,
according to the penalty regime regarding the automatic processing of personal data.
3 Private International Law Rules
3.1 The Scope of Application of Data Protection Rules
Processing of personal data will be governed by the OLPPD: (a) when the processing
is carried out in Spanish territory as part of the activities of an establishment
pertaining to the data controller; (b) when the data controller is not established on
Spanish territory but is subject to Spanish Law pursuant to the norms of Public
International Law; (c) when the data controller is not established on European Union
territory and uses means located on Spanish territory for the processing of data,
unless such means are only uses for transit purposes (Art. 2 LOPD).
28
3.2 Conditions, Under Which the Transfer of Personal Data
to a Foreign Jurisdiction Is Allowed
In accordance with the provisions of Art. 33 of the OLPPD, there may be no
temporary or permanent transfers of personal data which have been processed or
which were collected for the purpose of such processing to countries which do not
provide a level of protection comparable to that provided by this Law, except where,
in addition to complying with this Law, prior authorisation is obtained from the
Director of the SDPA, who may grant it only if adequate guarantees are obtained. In
28 For more information, see De Miguel Asensio (2015), pp. 359 and following.
Data Protection in the Internet: National Report Spain
393
for the Purpose of the Investigation, Detection and Prosecution
of Crimes Through Electronic
Criminal penalty: Crime of disobedience (Art. 410, 556 of the Criminal Code).
Penalties vary significantly depending on whether the subject is an authority or
public servant or an individual.
2.5.8 Rules Applicable to the Electronic Processing of Personal Data
for Security and National Defence Purposes
Criminal penalty and, if it is not possible to establish criminal responsibilities,
according to Art. 10 of OL 4/1997, sanctions may be imposed according to the
corresponding disciplinary regime applicable to the offenders or, failing that,
according to the penalty regime regarding the automatic processing of personal data.
3 Private International Law Rules
3.1 The Scope of Application of Data Protection Rules
Processing of personal data will be governed by the OLPPD: (a) when the processing
is carried out in Spanish territory as part of the activities of an establishment
pertaining to the data controller; (b) when the data controller is not established on
Spanish territory but is subject to Spanish Law pursuant to the norms of Public
International Law; (c) when the data controller is not established on European Union
territory and uses means located on Spanish territory for the processing of data,
unless such means are only uses for transit purposes (Art. 2 LOPD).
28
3.2 Conditions, Under Which the Transfer of Personal Data
to a Foreign Jurisdiction Is Allowed
In accordance with the provisions of Art. 33 of the OLPPD, there may be no
temporary or permanent transfers of personal data which have been processed or
which were collected for the purpose of such processing to countries which do not
provide a level of protection comparable to that provided by this Law, except where,
in addition to complying with this Law, prior authorisation is obtained from the
Director of the SDPA, who may grant it only if adequate guarantees are obtained. In
28 For more information, see De Miguel Asensio (2015), pp. 359 and following.
Data Protection in the Internet: National Report Spain
393