Operates a social platform, in Spain

Ley 34/2002, de 11 de julio, art. 16 · Read the law's page

• To keep the exemption from liability for information stored at the request of a recipient of your service, have no actual knowledge that the activity or the stored information is unlawful or injures the goods or rights of a third party that can be compensated, or, if you have such knowledge, act diligently to remove the data or make access to it impossible (Article 16(1)).
• The article treats you as having actual knowledge when a competent body has declared the data unlawful, ordered its removal or the disabling of access to it, or declared that the injury exists, and you knew of that resolution, without prejudice to voluntary detection and removal procedures and other means of actual knowledge (Article 16(1)).
• The exemption does not apply where the recipient of your service acts under your direction, authority or control (Article 16(2)).

Ley 34/2002, de 11 de julio, art. 17 · Read the law's page

• To keep the exemption from liability for the information you direct users to through links, directories or search tools, have no actual knowledge that the activity or the information you refer to or recommend is unlawful or injures the goods or rights of a third party that can be compensated, or, if you have such knowledge, act diligently to delete or disable the link (Article 17(1)).
• The article treats you as having actual knowledge when a competent body has declared the data unlawful, ordered its removal or the disabling of access to it, or declared that the injury exists, and you knew of that resolution, without prejudice to voluntary detection and removal procedures and other means of actual knowledge (Article 17(1)).
• The exemption does not apply where the content provider you link to, or whose location you supply, acts under your direction, authority or control (Article 17(2)).

Ley 34/2002, disposición adicional novena, servicios de la sociedad de la información · Read the law's page

• If you provide an information society service from an establishment in Spain, or operate a domain name registry or act as a registrar there, this binds you.
• Cooperate with the competent CERT in resolving cybersecurity incidents that affect the internet, and act on the security recommendations it indicates or that the codes of conduct establish (Disposición adicional novena, apartado 1).
• Supply the CERT and the competent authorities with the information needed to manage an incident, including the IP addresses that may be compromised or involved, while respecting the secrecy of communications (apartado 2).
• Identify the users affected by an incident the CERT notifies to you, tell them what they must do and by when, and, if they do not act within the recommended period, isolate the equipment or service from the network when the CERT requires it (apartado 4).

Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, art. 16, developed by Real Decreto 43/2021, de 26 de enero · Read the law's page

• Adopt adequate and proportionate technical and organisational measures to manage the risks to the networks and information systems you use to provide the service, and take measures to prevent and minimise the impact of incidents that affect you; as a digital service provider, determine the security measures you apply, taking into account at least the state of the art and the security of your systems and facilities, incident management, business-continuity management, monitoring, auditing and testing, and compliance with relevant international standards.
• If designated an operator of essential services, designate a responsable de la seguridad de la informacion within three months of your designation, notify the competent authority of the appointment, and file a Declaracion de Aplicabilidad of the security measures you apply within six months of designation, reviewing it at least every three years.
• This binds an operator of essential services designated under Ley 8/2011's critical-infrastructure regime and a digital service provider that is an online marketplace, online search engine or cloud computing service established in Spain, with its EU main establishment in Spain, or that has designated a Spain-based EU representative; a digital service provider that is a micro or small enterprise under Commission Recommendation 2003/361/EC is exempt, and so is an electronic-communications or trust-service operator not separately designated a critical operator.

Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, arts. 19, 21 y 22, developed by Real Decreto 43/2021, de 26 de enero · Read the law's page

• If you are an operator of essential services, notify the competent authority, through your reference CSIRT, of an incident that may have a significant disruptive effect on the provision of your service, making the initial notification without undue delay; if you are a digital service provider, notify the competent authority, through your reference CSIRT, of an incident that has a significant disruptive effect on your service, whether the incident is on your own networks or a third-party provider's.
• For a CRITICO-severity incident under the national notification instruction, notify immediately on becoming aware of it, follow up with an interim notification within 24 to 48 hours of the initial notification, and file a final notification within 20 days of the initial notification; for a MUY ALTO-severity incident, notify immediately on becoming aware of it, follow up within 72 hours of the initial notification, and file a final notification within 40 days of the initial notification; an ALTO-severity incident requires only an immediate initial notification (Real Decreto 43/2021, annex, section 6).
• This binds an operator of essential services and a digital service provider within the scope described on this jurisdiction's companion security-obligations row; a digital service provider's notification duty applies only when it has access to the information needed to assess the incident's impact.

Real Decreto-ley 24/2021, de 2 de noviembre, art. 73 · Read the law's page

• If you are an online content-sharing service provider as Article 66(6) defines it, obtain the rightholders' authorization before you offer the public access to protected works or other subject matter that your users upload, and negotiate it in good faith, with due diligence and transparency, without exercising a dominant position (Article 73(1)).
• Unless you hold an authorization, make your best efforts to obtain one; make your best efforts, under strict industry standards of professional diligence, to make unavailable the works for which rightholders gave you relevant and necessary information; and act expeditiously on a sufficiently substantiated notice from rightholders to disable access to the notified works or remove them from your website, and make your best efforts to prevent their future upload (Article 73(4)).
• Without an authorization, disable access to live content or remove it from your website during the broadcast of the live event (Article 73(4)).
• If you have operated in the Union for less than three years and your annual turnover is below 10,000,000 euros, you need meet only the best-efforts-to-obtain-an-authorization limb and the expeditious action on a sufficiently substantiated notice; if your average monthly unique visitors exceed five million, calculated on the previous annual year, you must also show best efforts to prevent new uploads of the notified works (Article 73(7)).
• Do not let cooperation with rightholders prevent users from uploading content that does not infringe, or that is used for quotation, analysis, commentary or criticism, review, illustration, parody or pastiche (Article 73(8)).
• You have no general monitoring obligation, but give rightholders who ask adequate information every six months on how your cooperation practices work and, where you have licensing agreements, on the use of the content they cover (Article 73(9)).
• Set up an agile and effective complaint and redress mechanism for users in a dispute over disabled or removed uploads, and do not keep the works under complaint accessible while it is resolved (Article 73(10)).
• Handle complaints within 10 working days, and have a person review every decision to disable access to uploaded content or remove it, without automated intervention (Article 73(11)).
• Tell your users about your general conditions and about the limits to intellectual property rights for the purposes of Article 73 and the Intellectual Property Act (Article 73(13)).

Ley 13/2022, de 7 de julio, arts. 88, 89 and 93 · Read the law's page

• If you run a video-sharing platform service as Article 2(13) defines it, take measures to protect the general public from audiovisual content that incites violence, hatred or discrimination, or that publicly provokes a crime such as terrorism, child pornography or incitement to hatred, hostility, discrimination or violence (Articles 88(b) and (c), 89(1)).
• Include the Article 88 obligations in your platform's terms of service and put them into practice (Article 89(1)(a)).
• Establish and operate transparent, easy-to-use mechanisms for users to notify you of content that breaches the Article 88 obligations (Article 89(1)(b)).
• Establish and operate systems through which you explain to users what became of their notifications (Article 89(1)(c)).
• Establish and apply easy-to-use systems for users to rate content that may breach the Article 88 obligations (Article 89(1)(d)).
• Establish and apply transparent, effective and easy-to-use procedures for handling and resolving users' complaints about how you apply these measures, and let a user whose complaint is not resolved satisfactorily take the dispute to an out-of-court consumer dispute resolution procedure under Ley 7/2017 (Article 89(1)(g) and (i)).
• Offer effective media-literacy measures and tools, and tell users that they exist (Article 89(1)(h)).
• Provide the information the CNMC requires and cooperate with it in its supervision and control (Article 93(5)).

Ley 15/2022, de 12 de julio, integral para la igualdad de trato y la no discriminación, arts. 2, 3, 4, 6, 17 y 25 a 30 · Read the law's page

• The Act names no technical accessibility standard: make your website and your application tend to meet the accessibility requirements that secure equal, non-discriminatory access for users, in particular persons with disabilities and older persons (Ley 15/2022, Art. 17(3)).
• If you offer goods or services to the public in a commercial or professional activity, do not discriminate in access to them on grounds that include disability (Arts. 17(1) and 2(1)); the Act reaches the internet, social networks and mobile applications (Art. 3(1)(n)).
• Treat a denial of the reasonable adjustments a person with a disability needs as direct discrimination: make the necessary and suitable modifications and adaptations that a particular case requires, unless they impose a disproportionate or undue burden (Art. 6(1)(a)).
• Apply methods sufficient to detect discrimination, adopt preventive measures and put an end to discriminatory situations (Art. 25(1)); a provider that has not met these obligations also answers for the damage discrimination causes within its organization (Art. 27(2)).
• Repair the damage you cause by discrimination with compensation and, where possible, by restoring the victim to the situation before the incident; moral damage is presumed once discrimination is established (Art. 27(1)).
• Where a claimant shows well-founded indications of discrimination, be ready to supply an objective and reasonable justification, sufficiently proved, of your measures and their proportionality (Art. 30(1)).

Ley 13/2022, de 7 de julio, arts. 88-90 · Read the law's page

• Applies to the provider of a video-sharing platform service.
• Set up and operate age verification systems for users, with respect to content that can harm the physical, mental or moral development of minors, that in every case prevent minors from reaching the most harmful audiovisual content, such as gratuitous violence or pornography.
• Provide parental control systems managed by the end user for content that can harm the physical, mental or moral development of minors.
• Do not process the personal data of minors collected or generated under these measures for commercial purposes such as direct marketing, profiling or behavioral advertising.

Ley 11/2023, de 8 de mayo, ampliaciones nacionales: arts. 2.2 g) a i), 3.2 y 15 y disposición adicional tercera · Read the law's page

• If you provide to consumers the website or a mobile application of an electricity, water or gas supply service, the website or a mobile application of a travel agency or tour operator, or a social network, meet the universal accessibility requirements of Sections III and IV of Annex I (Ley 11/2023, Arts. 2(2)(g) to (i) and 3(1)).
• Make your websites within Title I meet at least the intermediate level of the generally recognized web content accessibility criteria, taking standard UNE 139803 or its successor as the reference, without prejudice to the technical criteria of Real Decreto 1112/2018 (additional provision 3).
• Make the built environment that clients of the services use meet the accessibility requirements of Annex III, in accordance with the sectoral legislation in force (Art. 3(2)).
• Train your staff continuously on how to use accessible products and services, including supplying information, advice, advertising and attention to diversity (Art. 15).
• The service requirements and any obligation relating to compliance with them do not apply to a microenterprise, meaning an enterprise that employs fewer than 10 persons and whose annual turnover or annual balance sheet total does not exceed EUR 2 million (Arts. 3(3); Annex VII, point 16).

Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, text approved by the Consejo de Ministros on 14 January 2025 (transposing Directive (EU) 2022/2555) · Read the law's page

• As drafted, the Anteproyecto would require you to carry out an individualised risk assessment and put in place technical, operational and organisational measures, proportionate to the risk, to secure the networks and information systems you use and to prevent or minimise the impact of an incident.
• As drafted, the Anteproyecto would require you to designate a responsable de la seguridad de la informacion (information security officer) as your point of contact and technical coordinator, with accredited personnel in that role where your entity is classified as essential.
• As drafted, it would reach your service where you are classified as an essential or important entity under the Anteproyecto's sector criteria, which track NIS2's own classification of an online marketplace, online search engine and cloud computing service among the digital providers it names; the wider sector classes the Anteproyecto also reaches (energy, transport, banking, health, water, digital infrastructure, public administration and others) are reached too, by declaring that you are an essential or important entity.

Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, text approved by the Consejo de Ministros on 14 January 2025 (transposing Directive (EU) 2022/2555) · Read the law's page

• As drafted, the Anteproyecto would require you to notify the competent authority of a significant incident affecting the provision of your service, whether on your own networks or a third-party provider's.
• As drafted, the Anteproyecto would require you to send an early warning without undue delay, and in any event within 24 hours of becoming aware of a significant incident, to the competent authority through your reference CSIRT, stating, where applicable, whether the incident is suspected to result from an unlawful or malicious act or could have cross-border repercussions (Article 18(6)(a)).
• As drafted, the Anteproyecto would then require you to submit an incident notification to the competent authority, through your reference CSIRT, within 72 hours of becoming aware of the significant incident, updating the early warning with an initial assessment of the incident; a trust service provider whose services the incident affects would have to submit it within 24 hours instead (Article 18(6)(b)).
• As drafted, the Anteproyecto would require you to submit an interim report when your reference CSIRT or the competent authority asks for one, and a final report within one month of submitting the incident notification, or, if the incident is still ongoing, a status report then and a final report within one month of the incident being handled (Article 18(6)(c) to (e)).
• As drafted, the Anteproyecto would require you to communicate to the recipients of your service, as soon as possible, a significant cyberthreat that could affect them and any mitigating measures they can take.
• As drafted, it would reach your service where you are classified as an essential or important entity under the Anteproyecto's sector criteria; the wider sector classes are reached as on this jurisdiction's companion risk-management row.