New LOPD for Authorities

Yes new LOPD, but nobody should panic because we are facing the Organic Law 7/2021, of May 26, on the protection of personal data processed for purposes of prevention, detection, investigation and prosecution of criminal offenses and enforcement of criminal penalties, whose scope of application is for the following Authorities:

— Security Forces and Corps

— Prison Administrations

— The Deputy Directorate of Customs Surveillance of the State Tax Administration Agency (Agencia Estatal de Administración Tributaria)

— The Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offences

— The Commission for the Oversight of Terrorist Financing Activities

— The judicial authorities of the criminal jurisdictional order and the Public Prosecutor’s Office.

The purpose of this LOPD is to establish the rules on the processing of personal data by the aforementioned Authorities in the face of threats to public safety.

The tasks of these Authorities are the investigation, detection, prevention and prosecution of criminal offenses as well as the execution of criminal sanctions and for these purposes it is necessary to process personal data owned by the affected parties.

This LOPD does not come to replace the LOPD-GDD 3/2018, nor the European Regulation 679/2018(RGPD), as these Regulations are also mandatory for these Authorities and their bases are also contemplated in the LOPD 7/2021 (Lawfulness, Loyalty, Transparency, Minimization, Accuracy, Integrity, etc.), but it is necessary to legislate on the peculiarities of the processing of personal data of these Authorities, which if limited by other Regulations, it would be impossible to comply with their obligations.

Please note that this law provides the same rights as the RGPD, (access, rectification, limitation, etc.) but these may be restricted if they hinder an investigation or endanger public or national security.

The Figure of the Data Protection DelegateThe figure of the Data Protection Delegate becomes relevant in this LOPD since it will be obligatory to designate one before the General Registry of the Spanish Data Protection Agency, who will be designated with the requirement of having professional qualities in general and specialized knowledge in legislation, experience in data protection and capacity to perform the functions, in particular.

Special mention should be made of the regulation provided by this Organic Law on the processing of personal data from images and sounds obtained by the Security Forces and Bodies, competent bodies for surveillance and control in prisons, by means of cameras and video cameras, including those obtained for the surveillance, regulation and disciplines of traffic, as they will be complemented with the LOPD-GDD, establishing a new system regarding the obligations of the Authorities and the different missions assigned to them.

In reference to other obligations established in the RGPD and the LOPD-GDD, such as the registration of processing activities, impact assessment, notification of security breaches, etc., are also applicable in this LOPD.

Whenever European Union law or Spanish law requires an exchange of personal data by the Spanish authorities with other European Union countries, it will not be limited or prohibited for reasons related to the protection of personal data.