Spain

A works council has the right to be informed by the company of the parameters, rules, and instructions on which an algorithm or artificial intelligence system that affects decisions on working conditions, access to employment, or continued employment is based, including profiling, per new Article 64.4.d) of the Estatuto de los Trabajadores.

The obligation was introduced by Ley 12/2021, which formally replaced the earlier Real Decreto-ley 9/2021 (the so-called Ley Rider) after parliamentary processing, carrying the same substantive text forward.

A controller must notify the AEPD within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk.

LOPDGDD Article 69 gives the AEPD its own provisional-measures power, including a cautionary data block tied specifically to international-transfer risk (Art. 69.2), and Titulo IX makes late, incomplete, or missing breach notification its own separate administrative infraction (Art. 73(r)-(s)), confirmed against Titulo IX's own text rather than inferring it from General Data Protection Regulation (GDPR) alone.

Spain gives the General Data Protection Regulation (GDPR) domestic effect through the Ley Organica 3/2018 (LOPDGDD, Organic Law on the Protection of Personal Data and the Guarantee of Digital Rights), in force since 7 December 2018.

Unlike a bare implementing act, the LOPDGDD carries substantial national additions, confirmed against the BOE text: a freestanding Titulo X on digital rights (Arts. 79-97), a Titulo VI chapter on international transfers (Arts. 40-43) layered on GDPR Chapter V, and a Titulo IX administrative sanctioning regime (Arts. 70-78) calibrated onto GDPR Article 83's fine tiers.

Article 8, read verbatim, tightens rather than loosens GDPR's public-interest and legal-obligation bases: such processing is valid only where a Union-law norm or a Spanish statute-rank norm so provides.

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. LOPDGDD Titulo VI (Arts. 40-43), confirmed against the article headings, adds a national administrative-procedure layer: cases the AEPD may itself authorize, cases requiring AEPD prior authorization, and cases requiring prior notice to the competent authority.

LOPDGDD Article 72.1(l) separately makes an unauthorized international transfer its own "muy grave" national infraction category.

LOPDGDD Titulo III (Arts. 11-18) mirrors General Data Protection Regulation (GDPR) Articles 12-22 domestically: transparency, access, rectification, erasure, restriction, portability, and objection.

Titulo X then layers freestanding rights with no GDPR counterpart, confirmed against the article titles: Article 93's right to be forgotten against internet search engines, Article 94's equivalent against social-network services, Article 95's social-network portability right, and Article 96's right to a digital will governing a deceased person's digital accounts.

The AEPD is Spain's supervisory authority; LOPDGDD Titulo IX (Arts. 70-78) sorts infractions into muy graves, graves, and leves, each defined by direct cross-reference to a General Data Protection Regulation (GDPR) Article 83 tier rather than an independent Spanish fine scale, confirmed against the text. GDPR Article 82 arms an individual with a direct private right of action.

The specific Spanish instrument transposing the EU Representative Actions Directive for collective data-protection claims is not confirmed; LOPDGDD's own Disposicion final septima only modifies a narrow amicus provision, not a class-action mechanism.

LOPDGDD Article 9 supplies no independent biometric definition; it operates entirely within General Data Protection Regulation (GDPR) Article 9's special-category frame.

The AEPD's November 2023 guide on biometric presence-control systems (itself marked "en revision", under review, so treated as the AEPD's current stated position rather than a settled rule), concludes that current Spanish law contains no sufficiently specific statutory authorization for biometric employee time-and-attendance processing, applying the Tribunal Constitucional's STC 76/2019 reserva-de-ley standard.

The AEPD fined Mercadona EUR 2,520,000 (Resolucion PS/00120/2021) for a facial-recognition system matching shoppers against people with criminal convictions or restraining orders, holding the processing categorically prohibited under Article 9.1 with no Article 9.2 exception available.

Accessing or facilitating access to all or part of an information system, or remaining in it against the will of whoever has the legitimate right to exclude the actor, is a crime carrying six months to two years' imprisonment, but only where the actor breaches security measures established to prevent that access and lacks due authorization.

Intercepting non-public data transmissions to, from, or within an information system by technical means, without authorization, carries a separate penalty of three months to two years' imprisonment or a fine. Because the offense in the first paragraph requires vulnerating an established security measure, accessing a page with no access control in place, the ordinary case of public-web crawling, does not fall within Article 197 bis on the text of the article alone.

No authorization from an intellectual-property rights holder is needed for reproductions of legitimately accessible works made for text and data mining purposes, per Article 67(1). That exception does not apply where rights holders have expressly reserved the use of their works through machine-readable means or other adequate means, per Article 67(3), an opt-out a crawler must honor to keep the general exception available.

A separate, unconditional exception in Article 67(4) covers research organizations and cultural-heritage institutions carrying out text and data mining for scientific research, without the opt-out that limits the general exception.

A database maker who shows a substantial investment, evaluated qualitatively or quantitatively, in obtaining, verifying, or presenting its content may prohibit the extraction or reuse of the whole or a substantial part of that content, per Article 133.1. The right runs for 15 years from completion of the database, or from first making it available to the public if that happens before the term expires, per Article 136.

A legitimate user may extract or reuse a substantial part without authorization for private, non-electronic use, or for illustrative teaching or scientific-research purposes within the limits justified by the non-commercial aim and citing the source, per Article 135.1.

Article 16 requires an operator of essential services (an undertaking designated in the energy, transport, banking, financial-market-infrastructure, health, drinking-water or digital-infrastructure sectors under Ley 8/2011's critical-infrastructure regime) and a digital service provider under this Real Decreto-ley to adopt technical and organisational measures, proportionate to the risk, to manage the risks to the networks and information systems used to provide the service, even where that management is outsourced.

A digital service provider must additionally address, at minimum, the security of its systems and facilities, incident management, business-continuity management, monitoring, auditing and testing, and compliance with international standards.

Real Decreto 43/2021 develops this duty: an operator of essential services must designate a responsable de la seguridad de la informacion within three months of its designation and file a Declaracion de Aplicabilidad of the security measures it applies with the competent authority within six months, reviewed at least every three years.

This transposes the original NIS Directive (Directive (EU) 2016/1148) and, according to the Departamento de Seguridad Nacional, remains in full effect and covers the most critical operators within the State pending the NIS2 transposition described on this jurisdiction's Anteproyecto rows.

Article 19 requires an operator of essential services to notify the competent authority, through its reference CSIRT, of an incident that may have a significant disruptive effect on its service, and requires a digital service provider to notify an incident with a significant disruptive effect on its service, limited to cases where the provider has access to the information needed to assess the incident's impact.

Article 22 sets an initial notification made without undue delay (sin dilacion indebida), followed by interim and final notifications.

Real Decreto 43/2021's own national incident-notification and management instruction (its Anexo) fixes the clock by severity: for a CRITICO-severity incident, the initial notification is immediate, the interim notification is due within 24 to 48 hours and the final notification within 20 days; for a MUY ALTO-severity incident, the interim notification is due within 72 hours and the final notification within 40 days; an ALTO-severity incident requires only an immediate initial notification, and a MEDIO- or BAJO-severity incident carries no notification duty under the instruction.

This is a looser, severity-gated clock than the fixed 24-hour early warning and 72-hour notification Directive (EU) 2022/2555 itself sets, and it remains, according to official trackers, in full force pending the NIS2 transposition described on this jurisdiction's Anteproyecto rows.

Classifies unsolicited access to pornography as a form of violence against minors and requires public administrations to develop educational campaigns on the risks of pornography exposure and to promote parental control mechanisms, but does not impose a direct age verification obligation on pornography providers themselves.

Sets 14 as the minimum age at which a minor can independently consent to processing of personal data for an information society service, including registering for a social media account. Parental or guardian consent is required for processing based on consent for users under 14.

Press publishers and news agencies established in Spain hold an exclusive reproduction and making-available right over their press publications for online use by information-society service providers, per Article 129 bis(1). The right does not reach hyperlinking, per Article 129 bis(6)(b). It also does not reach the use of single words or very short, insignificant extracts that does not harm the publishers' investment, per Article 129 bis(6)(c).

Negotiated authorizations must follow good-faith, due-diligence, transparency and free-competition principles, and disputes go to the Comisión de Propiedad Intelectual rather than a designated bargaining process.

Periodic compilations of press articles presented as citations or press reviews are exempt from authorization, but a compilation that consists essentially of mere reproduction for commercial purposes requires equitable remuneration to the author unless the author expressly objects, per Article 32.1.

Since the 2021 amendment, a content-aggregation service provider that makes press text or text fragments available to the public needs the Article 129 bis authorization from the rights holder, per Article 32.2. A search engine's keyword-search tool is exempt from authorization and remuneration when its display is strictly limited to what is needed for non-commercial search results and includes a link to the source page.

No authorization from an intellectual-property rights holder is needed for reproductions of legitimately accessible works made for text and data mining purposes, per Article 67(1) of Real Decreto-ley 24/2021's own Fourth Book. That general exception does not apply where rights holders have expressly reserved the use of their works through machine-readable means or other adequate means, per Article 67(3), which is the opt-out.

A separate, non-waivable exception in Article 67(4) covers research organizations and cultural-heritage institutions carrying out text and data mining for scientific research, without the opt-out that limits the general exception.