Spain
Rights and Duties of Data Providers/Principals 6.1. Rights and remedies Right to grievance redressal and appeal In addition to the remedies provided under Articles 77 to 79 of the GDPR, the Spanish DP Law establishes a detailed administrative procedure for the protection of data subjects' rights before the Spanish Data Protection Agency (AEPD). Articles 63 to 69 of the Spanish DP Law regulate the lodging and processing of complaints, including mechanisms for resolving them through a simplified procedure introduced by Law 11/2023. The AEPD may initiate investigations, issue warnings or sanctions, and require corrective measures. The law sets a maximum deadline of twelve months for resolving complaints, starting from their admission for processing. Processing of Children or Minors’ data The GDPR establishes that the processing of personal data of a child in relation to information society services is only lawful when the child is at least 16 years old, unless a Member State sets a lower During the blocking period, the data cannot be used for any other purpose and must be securely retained until final deletion becomes possible.
age threshold, which may not be below 13 years. In Spain, Article 7 of the Spanish DP Law (LOPDGDD) sets this threshold at 14 years of age. Therefore, children aged 14 or older may provide valid consent for the processing of their personal data in the context of information society services. However, an important exception applies: if the act or legal transaction the child wishes to carry out requires parental or guardian authorization, then the consent for data processing must also be granted by the parents or legal representatives, regardless of the child’s age. A typical example would be online purchases, which usually fall within this category of acts requiring legal capacity and parental authorization under Spanish civil law. Regulatory Authorities 8.1. Overview of relevant statutory authorities Each Member State is obliged to create its own internal authority to oversee data protection in the country. Under article 44 of the Spanish DP Law, the Spanish Data Protection Agency (“Agencia Española de Protección de Datos”, “ AEPD ”) is the statutory authority with jurisdiction in data protection matters in the country.
https://lopez-iborabogados.com/en/
Made with FlippingBook - PDF hosting