SpainLOPDGDD Título III and Título X, Data-Subject and Digital Rights
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Give a person in Spain a path to exercise access, rectification, erasure, restriction, portability, and objection rights under LOPDGDD Articles 11-18.NIST Privacy FrameworkCT.PO-P3
- Honor a Spanish right-to-be-forgotten request against a search-engine or social-network service under LOPDGDD Articles 93-94, distinct from and beyond the general General Data Protection Regulation (GDPR) erasure right.NIST Privacy FrameworkCT.DM-P4
These lines are LexLint's reading of the law's text. Also read by: Agencia Española de Protección de Datos (the Spanish Data Protection Agency) (guidance, recorded ); Case C-460/20 TU, RE v Google LLC, judgment of the Court of Justice (Grand Chamber) of (recorded ).
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0460
- Guidance link
- https://www.aepd.es/preguntas-frecuentes/17-internet-y-redes-sociales/FAQ-1706-ejercicio-del-derecho-al-olvido
- Case citation
- Case C-460/20 TU, RE v Google LLC, judgment of the Court of Justice (Grand Chamber) of
- Guidance body
- Agencia Española de Protección de Datos (the Spanish Data Protection Agency)
- Open questions
- Which services count as 'servicios de la sociedad de la información equivalentes' to social-network services under Article 94(1) of the LOPDGDD, so that a person can demand erasure of the data they supplied 'a su simple solicitud'?
What it makes you log
Logging duty
The controller bears the burden of proving that it answered a rights request, which it can show only from a record of the request and the answer. The text names no log, no audit and no one entitled to ask for the proof in advance.
- Kind
- Implicit
- As of
- Provision
- LOPDGDD, Art. 12(4)
- Trigger
- personal_data_processing
What this law does
LOPDGDD Titulo III (Arts. 11-18) mirrors General Data Protection Regulation (GDPR) Articles 12-22 domestically: transparency, access, rectification, erasure, restriction, portability, and objection.
Titulo X then layers freestanding rights with no GDPR counterpart, confirmed against the article titles: Article 93's right to be forgotten against internet search engines, Article 94's equivalent against social-network services, Article 95's social-network portability right, and Article 96's right to a digital will governing a deceased person's digital accounts.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .