Processes personal data, in Spain

Ley 41/2002, arts. 7, 16 and 17 · Read the law's page

• If you run a public or private health centre or service in Spain, adopt measures that keep patients' health data confidential and allow access to it only with prior authorization backed by law (Ley 41/2002, Article 7).
• If you hold clinical records, limit administrative and management staff to the data related to their own functions, bind everyone who accesses the data to secrecy, and keep clinical documentation maintained and secure for at least five years from discharge from each care process (Ley 41/2002, Articles 16(4), 16(6) and 17(1)).

Ley 41/2002, de 14 de noviembre, arts. 18 and 19 · Read the law's page

• If you run a public or private health centre or service in Spain, let a patient (or a duly accredited representative) access the clinical record and obtain a copy of the data in it, through a procedure you regulate, while protecting third persons' confidential data and professionals' subjective notes (Ley 41/2002, Article 18(1) to (3)).
• If you are a health centre or individual practitioner holding the record of a deceased patient, give access only to persons connected to the patient for family or de facto reasons, unless the deceased prohibited it, and keep the clinical records under an active and diligent custody mechanism (Ley 41/2002, Articles 18(4) and 19).

Ley 14/2007, art. 5 · Read the law's page

• If you carry out biomedical research in Spain, keep the personal data and biological samples it produces confidential, disclose personal data to third parties outside the care or research activity only with the person's express written consent, and do not use health data for purposes other than those consented to (Ley 14/2007, Article 5(1) to (3)).
• Bind everyone who accesses personal data in a care or research activity to secrecy, including after the activity ends, and publish results that identify a participant only with that person's prior and express consent (Ley 14/2007, Article 5(4) and (5)).

Regulation (EU) 2016/679, Arts. 33-34; LOPDGDD, Art. 73(r)-(s), Art. 74(m)-(n) · Read the law's page

• Notify the AEPD without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Spain, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).

Regulation (EU) 2016/679, Arts. 44-49; LOPDGDD, Arts. 40-43, 72.1(l) · Read the law's page

• Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Spain outside the EEA, and check whether LOPDGDD Articles 41-43 require AEPD authorization or prior notice for the specific transfer.

Regulation (EU) 2016/679, Arts. 82-83; LOPDGDD, Art. 47, Arts. 70-78 · Read the law's page

• Compensate any person in Spain who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

LOPDGDD, Arts. 11-18, 93-96 · Read the law's page

• Give a person in Spain a path to exercise access, rectification, erasure, restriction, portability, and objection rights under LOPDGDD Articles 11-18.
• Honor a Spanish right-to-be-forgotten request against a search-engine or social-network service under LOPDGDD Articles 93-94, distinct from and beyond the general GDPR erasure right.

LOPDGDD, Ley Orgánica 3/2018, de 5 de diciembre, artículo 72.1.p) · Read the law's page

• Do not deliberately reverse an anonymization procedure so as to allow the people concerned to be re-identified; doing so is an infringement considered very serious under LOPDGDD Article 72(1)(p).

LOPDGDD, Ley Orgánica 3/2018, de 5 de diciembre, disposición adicional decimoséptima, apartado 2, letras d) a g) · Read the law's page

• If you use pseudonymized personal data in Spain for health research, and in particular biomedical research, keep the research team technically and functionally separate from whoever carries out the pseudonymization and holds the information that makes re-identification possible, under LOPDGDD additional provision 17(2)(d)1.
• Give the research team access to pseudonymized health research data in Spain only where it has expressly committed to confidentiality and to carrying out no re-identification activity, and specific security measures are in place to prevent re-identification and access by unauthorized third parties, under LOPDGDD additional provision 17(2)(d)2.
• Re-identify pseudonymized health research data at its source in Spain only where the research reveals a real and concrete danger to the safety or health of a person or group, a serious threat to their rights, or re-identification is necessary to guarantee adequate health care, under LOPDGDD additional provision 17(2)(d).
• If you process personal data in Spain for public health or biomedical research under the safeguards of GDPR Article 89, carry out an impact assessment that specifically covers the risks of re-identification linked to the anonymization or pseudonymization of the data, under LOPDGDD additional provision 17(2)(f)1.
• Obtain the prior report of the research ethics committee before using pseudonymized personal data in Spain for public health or biomedical research, or, where no committee exists, the prior report of the data protection officer or an expert, under LOPDGDD additional provision 17(2)(g).

Ley Organica 3/2018, de 5 de diciembre, de Proteccion de Datos Personales y garantia de los derechos digitales (BOE-A-2018-16673) · Read the law's page

• Establish a GDPR Article 6 lawful basis before processing personal data of a person in Spain, and rely on a statute-rank Spanish or EU norm rather than mere regulation if the basis is public interest or legal obligation, per LOPDGDD Article 8.
• Follow LOPDGDD Titulo V's controller and processor obligations, including its DPO qualification rule at Article 35.