Since the announcement of the General Data Protection Regulation (GDPR) in 2016, the conversation about data protection and privacy has taken a decidedly proactive tone around the world. And while the GDPR is an EU-wide regulation, some European countries are beginning to establish their own data protection legislation. Specifically, the new Spanish data protection act (officially “Ley Orgánica de Protección de Datos Personales y Garantía” or, “Organic Law on Data Protection and Guarantee of Digital Rights”) was passed in December of 2018.
The new Spanish data protection act takes things a few steps further than the GDPR by outlining new digital rights and offering greater protections for user data in the process. Spain’s action brings with it a number of key components with which businesses operating in or planning to expand into Spain should be familiar.
The New Spanish Data Protection Act
The GDPR was first announced in 2016, but it didn’t go into effect until May of 2018. One of the GDPR’s primary goals was to give control back to users over how their personal data is created and used, and to dramatically simplify the regulatory environment for businesses that deal with the European Union in any capacity.
Spain’s law was first approved on October 18, 2018, before entering into force in December. The legislation contains no less than 97 articles (structured into 10 titles), along with six transitory provisions and sixteen final provisions, among other elements.
There are five key issues that are thoroughly addressed by the law, which include:
The Data Protection Law’s Objective
- As stated in Article 1 of the document, the purpose of this issue is to both further expand on the rules of the GDPR and establish data protection as a fundamental right under the Spanish Constitution. Likewise, it creates new digital rights beyond the scope of the GDPR, like the right to digital education.
Expanded Data Rights
- Article 12.1 further expands on the idea of a person’s data rights, which can be exercised personally or through the legal system. One such right has to do with the ability of parents to exercise the rights of access, rectification, suppression, and opposition on behalf of their children, for example.
The Data Protection Officer
- Article 37(4) states that certain types of organizations must have a DPO, including but not limited to public and private universities, bar associations, general counsels, and information society service providers, among others.
The Processing of Personal Data by Political Parties
- Spain’s law says that political parties, coalitions, and electoral groups can now use personal data they get from websites and other public access sources to carry out political activities during elections, which proved instantly controversial across the country.
Digital Rights in the Labor Field
- These include the right to use digital devices in the workplace, and the right to digitally disconnect in the workplace, among others.
While the entire law has major implications for anyone living in Spain, it is that last point in particular that significantly impacts employees of all kinds. Article 89 specifies that employees now have the right to privacy “against the use of video surveillance devices and sound recording in the workplace.” Article 90 states that people have a right against the use of geolocation systems in the workplace, while Article 91 breaks down the digital rights in collective bargaining situations.
Ensure Your Spanish Expansion Meets All Compliance Considerations
If a business is considering expanding into Spain, data privacy must now be carefully considered before any measure is adopted in the workplace. Even the right to digital disconnection is a significant one; an employer must now respect not only an employee’s rest time, but also vacations, being careful to make sure that their professional life does not bleed into and violate their private or family life.
If Spain is on your global expansion shortlist or you’ve decided it’s time to expand into the country, reach out to Velocity Global today. Our global Employer of Record solution streamlines the expansion process, and enables compliant, cost-effective, and quick market entry—virtually anywhere.
Ready to establish your presence in Spain with an experienced partner at your side?
