Regulation and data
LOPDGDD
The LOPDGDD is Spain's Organic Act 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights. It does not replace the GDPR: it adapts Spanish law to it, fills in what the regulation leaves to each State and recognises digital rights. It has been in force since 7 December 2018.
Also known asOrganic Act 3/2018 · Spanish Data Protection Act · Ley Orgánica 3/2018
What it adds to the GDPR
The GDPR applies directly across the Union, but it leaves some decisions to each State. In Spain the LOPDGDD takes them (art. 1), and several of them land squarely on a colegio mayor (a Spanish hall of residence with a formative programme) or a student residence:
- The age of consent: fourteen (art. 7). Below it, consent is given by whoever holds parental authority or guardianship; this is developed under children's data.
- A limit on consent: on its own it is not enough to process data whose main purpose is to identify a person's ideology, trade union membership, religion, sexual orientation, beliefs or racial or ethnic origin (art. 9.1).
- Repeated access requests: asking more than once in six months may be treated as repetitive, unless there is a legitimate reason (art. 13.3).
- A list of entities that always need a data protection officer, with teaching centres at any level of education and universities among them (art. 34).
- Photos of minors on social media: publishing them requires their consent or that of their legal representatives (art. 92).
Worth knowing
Infringements are classified here, not in the GDPR. The regulation sets the maximum fines; the LOPDGDD sorts infringements into very serious, serious and minor ones, which become time-barred after three years, two years and one year respectively (arts. 72 to 74). Processing data with no legal basis, or special categories with no exception under art. 9, is very serious. The body that enforces it is the AEPD, which the act itself sets up as an independent authority (art. 44).
Sources
Related terms
- GDPRThe GDPR is Regulation (EU) 2016/679, the EU rule that governs the processing of personal data. It has applied directly since 25 May 2018, and in Spain the LOPDGDD completes it. It binds a colegio mayor, a private student residence and a coliving in exactly the same way.
- AEPD (Spanish Data Protection Agency)The AEPD, the Spanish Data Protection Agency, is the independent administrative authority that enforces the GDPR and the LOPDGDD in Spain: it handles complaints, inspects and sanctions, receives breach notifications and the appointment of data protection officers, and publishes guides and tools.