A decision by the Court of Justice of the European Union (ECJ) introduces an important change to the Spanish data protection framework. In the past, companies had to rely on data subjects’ consent as the way of carrying out the majority of the data processing in Spain because they did not recognize the “legitimate interest” justification for the processing of personal data. The ECJ concluded that the “legitimate interest” justification for the processing of personal data as set forth in the Data Protection Directive also should be available in Spain. However, the Spanish Data Protection Agency (SDPA) stated that companies may not carry out the processing of data exclusively based on their “legitimate interest,” but will be required to balance both their “legitimate interest” and fundamental rights and freedoms of the data subjects involved in the data processing.
Read more
