Spain: Supreme Court declares part of secondary legislation void

Spain's Supreme Court, which had submitted a question for a preliminary ruling to the European Court of Justice (ECJ) on the criteria for the processing of personal data without consent, has now declared void Article 10.2.b of the Spain's data protection law's secondary regulation. This article required that the data appeared in public sources, in addition to the legitimate interest of the data controller, to provide a legal basis for the processing of personal data.

The ECJ affirmed that Article 7 of the EU Data Protection Directive that defines legitimating circumstances for lawfully processing personal data prevents the application of national rules and has direct effect.

Javier Fernández-Samaniego, Head of the Data Protection Group at Bird & Bird Madrid said: "The judgement of the Spanish Supreme Court and, in particular, the judgment of the European Court of Justice arrive in a critical moment, as the EU is undertaking a full review of the European legal framework on data protection. In this respect, the latest landmark has been the publication of a draft Regulation on data protection at the end of January. However, as the ECJ has pointed out, in spite of Regulation's declared objectives to approve one single law which will do away with the current fragmentation and costly administrative burdens, leading to savings for businesses of around €2.3 billion a year, helping to reinforce consumer confidence in online services and providing a much needed boost to growth, jobs and innovation in Europe, this will not be worth the paper it is written on if it ignores the legitimate interest of data controllers".

Bird & Bird acted for ASNEF (National Association of Financial Institutions, Spain) that brought the case.