On October 13, the Spanish Data Protection Agency (DPA) released its annual report that summarizes activity during 2013 and also the current state of data protection, privacy and future insights in Spain.

As numbers show, Spaniards are concerned about their data protection and privacy.

During 2013, the Spanish DPA received more than 100,000 questions, mainly about how to notify databases and processing of personal data  followed by the exercise of rights.

Also during 2013, the Spanish DPA imposed fines for a total of €22,339,440, a 6.1-percent increase over 2012 at €21,054,656. The telecommunications sector gathered €15.035.008 of those fines, though that represents a slight decrease from the previous year. Another €2,084,901 in fines has been imposed to the water and energy distribution and commercialization sector.

Among other challenges, the Spanish DPA has focused in its annual report on Internet privacy, cookies, cloud computing, minors' privacy and international data flows. Also, the “right to be forgotten” was a major theme in the DPA's annual report.

Internet Privacy

According to the Spanish DPA, it is necessary to restore consumers´ trust in Internet services, so data protection and privacy shall be a central issue in the business models of the digital economy during the next years. In this sense, data protection and privacy are not an obstacle to innovation and development but a “necessary condition” to generate trust in the digital economy. Furthermore, trust is a key aspect to develop a “robust” or solid business model.

Lastly, regarding Internet privacy, the Spanish DPA also points out how important it is to keep a constant and fluent cooperation between the industry and DPAs, taking also into consideration that Internet privacy requires a global approach.

Cloud Computing

In April 2013, the Spanish DPA released two guidelines on cloud computing that addressed, on the one hand, providers of cloud computing services and, on the other hand, clients or users of such services. José-Luis Piñar and Miguel Recio wrote for The Privacy Advisor regarding this topic.

These guidelines follow Opinion 5/2012 on Cloud Computing, adopted on July 1, 2012, of the Article 29 Data Protection Working Party, available here in English, as well as a public consultation that the Spanish DPA carried out in 2011.

Minors' Privacy

To educate and raise awareness among minors about data protection and privacy, the Spanish DPA has created a website, launched in October 2013, that provides a platform of information and addresses those between the ages of 10 and 15.

The Spanish Law on Data Protection (Organic Law 15/1999 of 13 December on the Protection of Personal Data) provides that 14-year-old minors can give their consent. In any other case, parents, tutors or legal representatives shall supply minors´consent for the processing of their personal data.

Finally, to  verify minors' ages online, Royal Decree 869/2013, of November 8^, has amended Royal Decree 1553/2005, of December 23 on the issuing of the national identity card and its certificates for digital signature. Therefore, with this electronic certificate already activated, Internet service providers  can check minors' ages online.

International Data Flows

Any international data transfer outside of the EU to a third country without an adequate level of protection, requires an authorization from the Spanish DPA based on guarantees. In particular, during 2013 the Spanish DPA granted a total of 170 authorizations, which shows an upward trend.

Latin American countries are at the top of countries that import personal data, followed by the U.S. Nevertheless, during the last year, India has received 42 of these authorizations, almost doubling the number from the previous year.

A high percentage of the international transfers, 72 percent, involve a relationship between a data controller established in Spain and a data processor in a third country.

Also, in 2013, a total of 10 applications of Binding Corporate Rules have been submitted to the Spanish DPA.

The Right To Be Forgotten

The DPA highlights the fact that Spanish citizens have been the first ones in the EU to exercise their right to the right to be forgotten or “right to cancellation and opposition.”

In 2007, the first complaints were submitted, and the number has been increasing during the last years. In 2013, the number of complaints before the DPA were 184, a slightly higher number than in 2012, which had 181. Also, during 2013, a total number of 226  complaints were resolved. Such complaints were mainly directed to search engines, official gazettes and mass media.