Infractions and sanctions of the LOPD
Infractions in the LOPD
Article 43 of the LOPD establishes as those responsible
subject to the sanctioning regime:
1. Those
responsible and those in charge of the treatment of private files.
2. Those
responsible for public files, which, as will be seen later, are governed by
their own procedure.
Article 44.2 of the LOPD establishes which are minor
offenses:
1. Do not
send the notifications provided for in this Law or in its development
provisions to the Spanish Agency for Data Protection.
2. Do not request
the registration of the personal data file in the General Data Protection
Registry.
3. The
breach of the duty of information to the affected party about the processing of
their personal data when the data is collected from the interested party.
4. The
transmission of the data to a person in charge of the treatment without
complying with the formal duties established in article 12 of this Law.
Article 44.3 of the LOPD establishes which are the serious
infractions:
1. Proceed
to the creation of publicly owned files or initiate the collection of personal
data for them, without authorization of a general provision, published in the
Official State Gazette or corresponding official gazette.
2. Processing
personal data without obtaining the consent of the affected persons, when it is
necessary in accordance with the provisions of the regulations on data
protection.
3. Process
personal data or use them later in violation of the principles and guarantees
established in article 4 of the LOPD and in the RLOPD, except when it
constitutes a very serious infringement.
4. The
violation of the duty to keep secret about the processing of personal data
referred to in article 10 of the LOPD.
5. The
impediment or obstruction of the exercise of the rights of access, rectification,
cancellation and opposition.
6. The
breach of the duty of information to the affected party about the processing of
their personal data when the data has not been collected from the interested
party.
7. Failure
to comply with the remaining notification or requirement duties to the affected
party, imposed by the regulations on data protection.
8. Maintain
files, premises, programs or equipment that contain personal data without the
proper security conditions established in the RLOPD.
9. Not
meeting the requirements or warnings of the Spanish Data Protection Agency or
not providing it with all the documents and information requested by it.
10. The
obstruction of the exercise of the inspection function.
11. The
communication or transfer of personal data without having legitimacy for it in
the terms provided in this Law and its development regulations, unless it is
constitutive of a very serious infringement.
Article 44.4 of the LOPD establishes which are very serious
infractions:
1. The
collection of data in a false or deceitful way.
2. Process
or transfer the personal data referred to in sections 2, 3 and 5 of article 7
of the LOPD, except in the cases in which it authorizes it or violate the
prohibition contained in section 4 of article 7.
3. Do not
cease the illegal processing of personal data when there is a prior request
from the Director of the Spanish Agency for Data Protection to do so.
4. The
international transfer of personal data to countries that do not provide a
comparable level of protection without authorization from the Director of the
Spanish Agency for Data Protection, except in cases where, according to the
data protection regulations, said authorization does not it is necessary.
Offenses committed by public administrations
When the infractions that are established in the LOPD were
committed in files of public ownership or in relation to treatments whose
managers would be responsible for files of this nature, the sanctioning body
(the Spanish Agency for Data Protection or the Autonomous Agencies ) will issue
a resolution establishing the measures to be adopted to cease or correct the
effects of the offense.
This resolution will be notified to the person responsible
for the file , to the body on which it depends hierarchically and to those
affected, if any. The sanctioning body may also propose the initiation of
disciplinary actions, if applicable. The procedure and the sanctions to be
applied will be those established in the legislation on the disciplinary regime
of public administrations.