RESUMEN TEMA 11 PROTECCIÓN DE DATOS

Data Protection and Its Legal Framework

Overview of Data Protection Objectives

• The purpose of data protection is to align Spanish law with the EU Regulation 2016/679 and ensure citizens' digital rights.

• It applies to any automated or partially automated processing of personal data, as well as non-automated processing contained in files.

• Exclusions include treatments related to deceased individuals and classified matters; it also applies supplementarily to various legal regimes like electoral laws and civil registries.

Rights Related to Deceased Individuals

• Relatives of deceased persons have rights to access, rectify, and delete data unless expressly prohibited by the deceased or mandated by law.

• If the deceased was a minor or disabled, these rights are exercised by their representative or public prosecutor.

Consent and Information Obligations

• Consent must be a free, specific, informed, and unequivocal expression through clear affirmative action for multiple purposes.

• When obtaining information from affected individuals, the responsible party must provide basic information including identity, purpose of processing, and how to exercise rights under Articles 15 to 22 of the regulation.

Access Rights and Data Rectification

• Article 15 mandates that access should be remote, direct, secure, and permanent; excessive requests (more than once every six months) may be deemed unreasonable.

• For rectification (Article 16), documentation is required; for deletion (Article 17), retention against marketing practices is noted. Limitations on data retention are specified under Article 18.

Financial Data Processing Regulations

• Treatment of financial obligation-related data is presumed lawful if certain conditions are met: provided by creditors for due debts not subject to administrative claims within five years maximum retention period.

• Consultation systems are limited strictly to contractual relationships involving monetary transactions or financing requests; notifications must inform affected parties accordingly when contracts end.

Surveillance Measures and Security Protocols

• Use of cameras for security purposes allows only essential capture; additional capture may occur for strategic assets but must be deleted within one month unless required by authorities post-event (72 hours).

• Information obligations include notifying about treatment existence, responsible identity, and rights under Articles 15–22 of the regulation.

Regulatory Compliance in Advertising Exclusion Systems

• Advertising exclusion systems can be general or sector-specific; they must communicate their creation details to regulatory authorities who will publish them electronically.

Technical Measures for Data Management

• Responsible parties determine technical measures ensuring compliance with regulations while maintaining records except for companies with fewer than 250 employees; designated delegates must report changes promptly within ten days.

Data Protection Delegates and Their Roles

Appointment and Responsibilities of Data Protection Delegates

• The Data Protection Delegate must hold a university degree in law and have practical experience in the field. They serve as an intermediary between the data controller and the relevant authority.

• In cases of violations, the delegate is responsible for documenting incidents and notifying the data controller. Codes of conduct are binding for those who adhere to them, approved by the agency or local authority.

International Data Transfers

• International data transfers are governed by regulations, laws, and circulars from both national agencies and local authorities. Binding corporate rules can be established at the request of entities based in Spain.

• Standard contractual clauses adopted by the Spanish Agency require prior authorization for international agreements that are non-normative, along with a memorandum of understanding within six months.

Structure and Functioning of the Spanish Data Protection Agency

Independence and Budget Management

• The Spanish Agency for Data Protection operates as an independent administrative authority at a state level, interacting with government through the Ministry of Justice.

• Budget modifications are categorized into three ranges: up to 3% authorized by presidency, 3%-5% by Treasury, and over 5% requires government approval.

Leadership Appointments

• The president and deputy director are appointed by the government upon proposal from the Ministry of Justice for five years with potential renewal.

• Two months before their term ends, a public announcement is made to solicit candidates based on merit evaluation; confirmation requires a majority vote from Congress.

Operational Procedures Within the Agency

Decision-Making Processes

• The president may assume responsibilities during absences or conflicts involving leadership roles. Dismissals occur due to serious misconduct or incapacity determined through voting processes.

Consultative Council Composition

• The Advisory Council includes representatives from various sectors such as judiciary members, consumer organizations, municipalities, business associations, labor unions, academia experts in transparency/security information.

Enforcement Mechanisms

Investigations and Audits

• The agency conducts investigations into actions taken against it; if there’s a complaint without judicial authorization required for data access.

Compliance Directives

• Directives issued by leadership regarding audit plans become mandatory once published. Autonomous community authorities also issue similar directives to ensure coherent regulation application.

Complaint Handling Procedures

Claim Process Overview

• Affected individuals can file complaints with the Spanish Data Protection Agency which then forwards them to delegates who respond within one month.

Admission Criteria for Complaints

• Complaints may be rejected if they lack foundation or involve abusive claims; this decision hinges on whether issues pertain directly to data protection matters.

This structured summary encapsulates key points discussed in relation to data protection delegates' roles within Spain's legal framework while providing timestamps for easy reference back to specific sections of interest.

Procedural Timelines and Notifications

Overview of Procedural Steps

• The initial agreement allows for a 6-month period from the start date, which serves as a warning or notification phase.

• If the case is accepted for processing, there is a maximum of 18 months allocated for preliminary actions between acceptance and the start of formal proceedings.

• Notification of acceptance to the affected party must occur within 3 months after the case is admitted for processing.

• Following the initiation of proceedings, specific timelines and procedures are outlined based on whether it is an administrative or legal process.