The unambiguous consent of the data subject is the main requirement for the processing of personal data (cf. Article 6 of the LOPD).
According to the LOPD, consent of the data subject is defined as “(…) any free, unequivocal, specific and informed indication of his wishes by which the data subject consents to the processing of personal data relating to him (cf. Article 3.h).
The processing of sensitive personal data (i.e. data relating to political, moral and religious beliefs, ethnic origin, health, as well as sex life and trade union membership) requires express and written consent of the data subject (cf. Article 7.2 of the LOPD). See conditions for processing personal data
Legal age of consent
Until recently, the legal age of consent in Spain was 13. In 2013, however, the legal age for consent was raised to 16 (Burgen 2013).
Obligation to provide information
Data subjects are entitled to be informed “explicitly, precisely and unequivocally” of the following:
a) The existence of the database in which their personal data will be included;
b) The purpose of the information collected;
c) The recipients of the information collected;
d) The obligatory or voluntary nature of the reply to the questions put to them;
e) The consequences of obtaining the data or of refusing to provide them;
f) The possibility of exercising rights of access, rectification, erasure and objection;
g) The identity and address of the controller or of his representative, if any (cf. Article 5.1 of the LOPD).
The obligation to inform the data subject does not apply if for instance the processing is provided for by law, when the processing is for historical, statistical or scientific purposes (cf. Article 5.5 of the LOPD). Alternatively, the following circumstances may provide exemption from the obligation to inform:
- when it is not possible to inform the data subject;
- or where this would involve a disproportionate effort in the view of the Data Protection Agency;
- or the corresponding regional body, in view of the number of data subjects, the age of the data and the possible compensatory measures (cf. Article 5.5 of the LOPD).
Exemption from consent
The processing of personal data may be exempted from obtaining the consent of the data subject if for instance the transfer of the data is made between public administrations and “concerns the retrospective processing of the data for historical, statistical or scientific purposes” Article 11.2 e of the LOPD).
Duty of confidentiality
The data controller or any other person involved in the processing of personal data is subject to professional secrecy and the duty to keep them confidential (cf. Article 10 of the LOPD).
Burgen, Stephen. 2013. “Spain raises age of consent from 13 to 16”. The Guardian. [Online]. Available at: http://www.theguardian.com/world/2013/sep/04/spain-raises-age-of-consent, [accessed 17.07.2014].
LOPD. Organic Law 15/1999 of 13 December on the Protection of Personal Data (LOPD). Agencia Española de Protección de Datos (AEPD). [Online]. Unofficial English translation available at: http://www.agpd.es/portalwebAGPD/english_resources/regulations/common/pdfs/Ley_Orgaica_15-99_ingles.pdf, [accessed 17.07.2014].