SpainLey 34/2002 de servicios de la sociedad de la información y de comercio electrónico (LSSI), Consent for Storage and Retrieval Devices on Terminal Equipment (Article 22(2))
Ley 34/2002, de 11 de julio, art. 22(2)
In force since .
A device storage and tracking consent rule binding private bodies.
- Obligation class
- Consent, Disclosure
As of .
What it requires
- Before you store information on a recipient's terminal equipment or access information already stored there, obtain the recipient's consent after giving them clear and complete information about its use, in particular about the purposes of the data processing (Article 22(2)).
- Where it is technically possible and effective, you may collect that consent through the appropriate settings of the browser or other applications (Article 22(2)).
- No consent is needed for technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network or, to the extent strictly necessary, for providing an information society service the recipient expressly requested (Article 22(2)).
- If you are an advertising network or agent that places advertisements directly with a provider, take measures to require that provider to give users the information and obtain their consent (Article 37).
If you get it wrong
Private right of actionYes
Penalty structure
Using storage and retrieval devices without the information or consent article 22(2) requires is a minor infraction fined up to 30,000 euros (articles 38(4)(g) and 39(1)(c)). A repeat declared by a final decision within the previous three years is a serious infraction fined from 30,001 to 150,000 euros (articles 38(3)(i) and 39(1)(b)).
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 150,000
Who enforces it
Enforcement body
The Agencia Española de Protección de Datos imposes the sanctions for infractions of article 22(2) (Article 43(1)).
What this law does
Article 22(2) lets service providers use data storage and retrieval devices on recipients' terminal equipment on condition that the recipients have given their consent after being given clear and complete information about their use, in particular about the purposes of the data processing. The text refers to Ley Orgánica 15/1999 for the data-processing rules.
Ley Orgánica 3/2018 repealed Ley Orgánica 15/1999, without prejudice to its fourteenth additional provision and its fourth transitional provision. When technically possible and effective, the recipient's consent to accept the data processing may be given through the appropriate settings of the browser or other applications.
The consent rule does not prevent technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network or, to the extent strictly necessary, for providing an information society service the recipient expressly requested. Article 22(2) was amended by final provision 2.5 of Ley 9/2014, de 9 de mayo.
Using storage and retrieval devices without having provided the information or obtained the consent that article 22(2) requires is a minor infraction under article 38(4)(g). A repeat of that minor infraction, declared by a final decision within the three years before the sanction proceeding opens, is a serious infraction under article 38(3)(i). A minor infraction is fined up to 30,000 euros and a serious infraction from 30,001 to 150,000 euros under article 39(1).
Where the infraction is due to installing such devices through a provider's cession of its own spaces for displaying advertising, the advertising network or agent that manages the placement of the advertisements directly with the provider is also responsible if it has not taken measures to require the provider to meet the duties to inform and to obtain the user's consent.
The Agencia Española de Protección de Datos imposes the sanctions for the infractions in article 38(4)(g) and article 38(3)(i).
When LexLint raises it
When your app profile says your app tracks devices.