It was reported in November, the Court of Justice of the European Union (“CJEU”) declared that Spain’s refusal to permit the “legitimate interest” justification for the processing of personal data — instead, requiring data subjects’ consent as the way of carrying out the majority of the data processing in Spain — violated section 7.f of the European Data Protection Directive 95/46/EC. The Spanish Supreme Court has now incorporated the CJEU’s ruling into Spanish law. The Spanish Supreme Court also annulled article 10.2(b) of the Royal Decree developing the Spanish Data Protection Law (“DPL”). This modification will have significant consequences for the ways in which companies process personal data in Spain since, until today, the Spanish data protection framework was organized around obtaining data subject consent.
Read more
