AEPD (Spain)

AEPD (Spain)
Name	Agencia Española de Protección de Datos
Native name	Agencia Española de Protección de Datos
Formation	1992
Headquarters	Madrid
Chief1 name	Pedro Manuel
Chief1 position	Director

AEPD (Spain) is the Spanish data protection authority responsible for supervising and enforcing data protection and privacy laws across Spain. It was established to implement and apply national statutes and European Union regulations relating to personal data, interacting with courts, ministries, parliaments, and international bodies. The agency engages with stakeholders including businesses, technology firms, media organizations, civil society groups, and judicial institutions.

History

The agency was created in the early 1990s amid debates in the Cortes Generales, following legislative initiatives inspired by the Council of Europe's work and the European Parliament's directives. Its formation coincided with lawmaking in the Gobierno de España and the promulgation of national statutes influenced by the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and developments in the European Union. Over subsequent decades the body responded to advances driven by corporations such as Telefonica, Google, Facebook, and regulatory shifts stemming from landmark measures like the Data Protection Directive and later the General Data Protection Regulation. Its history intersects with rulings from the Tribunal Constitucional, litigation involving media groups such as Prisa, and policy debates in the Comisión Europea and among member states like Germany, France, and Italy.

Legal framework and mandate

The agency operates under national legislation enacted by the Cortes Generales and within the framework of EU instruments adopted by the Conseil de l'Union européenne and interpreted by the Court of Justice of the European Union. Its mandate derives from statutes similar to the Ley Orgánica series and is aligned with obligations under the Charter of Fundamental Rights of the European Union. The legal basis references judgments from the Tribunal Supremo and decisions of the Tribunal de Justicia de la Unión Europea that shape rights articulated in instruments associated with the Council of Europe and recommendations by the Organization for Security and Co-operation in Europe. The agency's remit covers processing by public authorities such as the Ministerio del Interior and private entities including multinational companies like Amazon, Microsoft, and Apple.

Organization and governance

The agency is structured with an executive head appointed under procedures involving the Congreso de los Diputados and oversight linked to institutions like the Defensor del Pueblo and the Tribunal Constitucional. Internal divisions correspond to functions interacting with sectors represented by organizations such as the Cámara de Comercio de España, unions like the Comisiones Obreras, and industry groups including the Asociación Española de la Economía Digital. Governance practices reference standards promoted by the European Data Protection Board and coordination mechanisms with national authorities in countries such as Portugal and Poland. Leadership has engaged with figures from academia at institutions like the Universidad Complutense de Madrid and policy networks including the OCDE.

Functions and activities

The agency supervises compliance by entities ranging from broadcasters like RTVE to financial institutions such as Banco Santander and insurers like Mapfre. Activities include handling complaints from individuals, conducting inspections at companies including Inditex and technology platforms like Twitter and TikTok, issuing guidance used by municipal bodies such as the Ayuntamiento de Madrid, and launching public awareness campaigns in collaboration with educational institutions such as the Universidad de Barcelona. It publishes opinions and technical reports referenced by regulators like the Autorité nationale de sécurité and engages in standard setting with bodies such as the International Organization for Standardization and the European Telecommunications Standards Institute.

Enforcement, sanctions and case law

The authority has imposed administrative fines and measures against corporations including major digital platforms and national firms, prompting appeals before the Audiencia Nacional and cases reaching the Tribunal Supremo and the Court of Justice of the European Union. Precedents involve interactions with media conglomerates like Vocento and legal challenges from advocacy organizations such as Facua and Amnistía Internacional's Spanish section. Its sanctioning practice aligns with enforcement patterns seen in other regulators like the Commission Nationale de l'Informatique et des Libertés and has influenced jurisprudence cited by courts in jurisdictions including Belgium and Ireland.

International cooperation and influence

The agency participates in EU networks including the European Data Protection Board and bilateral cooperation with authorities such as the Information Commissioner's Office in the United Kingdom, the Bundesbeauftragte für den Datenschutz in Germany, and the Data Protection Commission in Ireland. It contributes to global dialogues hosted by the United Nations and the Council of Europe, and cooperates with multilateral arrangements involving the Organisation for Economic Co-operation and Development and the World Bank on data governance. Its rulings and guidance have been referenced in cross-border disputes involving firms headquartered in the United States, China, and India, and inform policy debates in regional bodies like the Ibero-American General Secretariat.

Category:Data protection authorities Category:Public bodies of Spain