Jose Felgueroso
Abogado | Attorney
The Right to Data Protection in the Spanish Constitution
info@josefelgueroso.com
2021-06-14
"The law will limit the use of information technology to guarantee the honor and personal and family privacy of citizens and the full exercise of their rights" (Spanish Constitution, art. 18.4). This right is known as the right to data protection, but it has also been given other names, such as "information self-determination", "habeas data," and "digital freedom". This article describes the content and limitations of the right to data protection, based on two judgments of the Constitutional Court that have interpreted it.
Constitutional Court Judgments
In the following two judgments, the Court defined the scope of the right to data protection and indicated under what circumstances it may be limited.
The plaintiff asked the civil governor of Guipúzcoa and the Ministry of the Interior for information about files containing personal data about the plaintiff in the possession of the administration. His request received no response, and the ordinary courts upheld the alleged denial of the request. The plaintiff filed an action to enforce constitutional rights before the Court.
The Court concluded that the plaintiff was entitled to know about the existence of public administration files containing personal data about him. According to the Court, the essential aspect of the right to data protection is the right to control the use of personal data contained in a computer program. To that end, individuals have the right to know whether the public administration has automated files containing personal data about them.
In 1999, the Spanish Parliament approved the Organic Law on Personal Data Protection. The Ombudsman filed a constitutional challenge against the content of two articles of the Organic Law. One of them allowed a normative text lower than a statute to regulate the transfer of personal data between public administrations for a purpose other than the original one, without informing data subjects or obtaining their consent. The other challenged article allowed exceptions to the rights recognized in the Organic Law for reasons of public interest or to protect the legitimate interests of third parties.
The Court concluded that the Organic Law violated the Constitution because it allowed the unauthorized use of personal data and established inadequate limitations. According to the Court, the right to data protection includes the right of individuals to object to the use of their personal data without their consent. On the other hand, the Court indicated that limitations to the right to data protection (1) must be established by statute, (2) must be necessary to protect interests recognized in the Constitution, (3) must be proportionate, (4) must be adequate, and (5) must respect the essential content of the fundamental right.
Therefore, the Court invalidated several provisions of the Organic Law.
The Protection of Private Life and Technological Advances
The Constitution recognizes the right to honor and privacy, which aims to protect personal and family privacy. But it also recognizes in another provision of the same article the right to data protection, which is an autonomous right whose objective is to guarantee individuals control over their personal data, whether intimate or not.
The drafters of the Constitution recognized the potential of information technology to collect and communicate personal data, so they included a guarantee of the exercise of the right to honor and privacy and other rights of the individual. Concerns, however, were not limited to information technology: several members of the Constituent Assembly indicated that the potential risks were not just related to information technology, but rather related to technological advances in general.
On the other hand, the Court indicated in its judgment on the Organic Law that the processing of personal data that requires the consent of the individual may or may not be performed with information technology.
Content of the Right to Data Protection
International Context
Starting in the 1970s, concerns about the impact of technological advances on fundamental rights led to the recognition of the right to data protection. The Portuguese Constitution of 1976 was the first to recognize this right, West Germany enacted a data protection law in 1977, and Spain included it in its 1978 Constitution. Furthermore, in 1981 the Council of Europe adopted a convention ("Convention 108") on the automatic processing of personal data.
The legal framework reflected in these texts regulates (1) the collection of personal data, (2) individuals' right to obtain information about the use and destination of their personal data, (3) their right to consent to the use or transfer of their personal data, and (4) their right to rectification and erasure of those data.
Statutory Development
The Constitution orders the Spanish Parliament to develop the content of the right to data protection. Since this is a fundamental right, the statute that develops it must be organic. If there were no legislation to develop it, however, other public authorities could not regulate it. The Court has determined that the Constitution establishes a minimum content for this fundamental right, and used Convention 108 to define its content in the absence of a statute developing this right.
Control over Personal Data
The main purpose of the right to data protection is to prevent the illegitimate processing of personal data, whether performed with information technology or not, and whether carried out by the state or a private individual.
The personal data protected by this fundamental right are not limited to those related to private life: they also include data that serve to create ideological, sexual, racial, economic, or other types of profiles. It also includes data related to activities involving an evaluation of the individual, such as applying for employment, loans, or admission to certain groups.
The right to data protection consists of the following:
- individuals have the right to know who holds personal data about them, what personal data they hold about them and for what purposes;
- the collection and use of personal data requires the prior consent of the data subject;
- individuals have the right to object to the use of their personal data for a purpose other than that for which it was collected;
- individuals have the right to be informed about the destination and use of their personal data;
- individuals have the right to access, correct, and erase their personal data.
Limitations of the Right to Data Protection
The right to data protection may be limited to protect other fundamental rights or other interests protected by the Constitution. The Court has indicated that any limit to this fundamental right must be necessary to achieve a legitimate aim and must be proportionate.
On the other hand, any limitation of the right to data protection must respect its essential content. A statute limiting this right in such a way as to make it impracticable would violate the Constitution. Similarly, a statute authorizing another public authority to set limits on the right to data protection would also violate the Constitution, especially if those limits involved the collection, storage, processing, use, and transfer of personal data. Finally, a statute establishing uncertain limits to this fundamental right would also violate the Constitution.
Conclusion
The drafters of the Constitution included the right to data protection in a relatively short article that does not include details about its content. The Court has interpreted the scope of this fundamental right and its possible limitations.
Despite what the Constitution indicates, the right to data protection has a minimum content even in the absence of a statute developing it: the right to control the use of personal data inserted in a computer program.
Similarly, this fundamental right is not limited to information technology. The Portuguese Constitution is explicit on this point: the article recognizing the right to data protection is entitled "Use of Information Technology", but its last paragraph indicates that it is also applicable to manual files.
The international context is key to understanding this fundamental right. Given that personal data in electronic format often crosses borders, several international texts recognize the right to data protection, such as Convention 108 and the Charter of Fundamental Rights of the European Union. The fundamental rights recognized in the Constitution are interpreted according to the international human rights treaties ratified by Spain. In connection with the right to data protection, the Court relied on Convention 108 to define its scope in its first judgment on this right.
Sources
Spanish Constitution (in English)
Judgment of the Constitutional Court 254/1993
Judgment of the Constitutional Court 292/2000
Comentarios a la Constitución Española de 1978, Artículo 18: Derecho al honor, a la intimidad y a la propia imagen, César Sempere Rodríguez, 2006
Tratado de protección de datos (varios autores), 2019