By Javier Sanchez
On April 19th , a new Data Protection Regulation entered into force, developing the Spanish Data Protection Act, which is the law by means of which the European Directive 95/46/CE was implemented in 1999 in Spain. This new regulation states some detailed rules concerning the information to be provided to, and the consent to be obtained from, the data protection subject. It also determines the array of security measures to be implemented by any processor of personal data.
One of the most important features of the new regulation is that it foresees specific security measures for paper databases. Any infringement to these measures is subject to a fine with an amount between 60,000 euros and 300,000 euros. Furthermore, the new regulation also includes provisions concerning the personal data of minors. The new regulation is very strict on the processing of personal data concerning children of less than 14 years-old, which will be the cause of serious concern for those processors operating online and thus facing difficulties in ascertaining the age of the relevant users.
When reviewing these new regulations, it has always to be borne in mind that the Spanish Data Protection Agency, the public authority that supervises the compliance with the data protection legislation, is very strict and very active in the application of the law. With fines that can amount to up to 600,000 Euros, it is more than advisable for companies processing personal data with a link to Spain to study if they are subject to its authority and, if so, to duly abide by the relevant laws.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.