Stage of legislative progress 
Eg. pre-consultation, in consultation

Public consultation ended on 28 February 2017. Draft Data Protection Bill published on 23 June 2017.

Approach to implementation 
Eg. amendments to existing law, total repeal of old laws

Organic Law 15/1999 to be repealed and replaced by new Data Protection Act.

Timescale for implementation 
Eg. pre-consultation, in consultation

New Data Protection Act should be published by May 2018.

Areas where Member States must have local laws:

Personal data and freedom of expression 




Areas where Member States may have local laws:

Professional secrecy 


Scientific, historical or statistical purposes 

Draft Bill allows for processing by public statistic bodies.


Data processing for the purposes of whistleblowing and preparing anonymous reports is allowed. Draft Bill allows CCTV recordings for supervision of employees as part of the employment relationship.

Personal data of deceased persons 

Heir of deceased entitled to access, request deletion and rectification of data held by information society service providers. Executors can also act as heirs. If heir is minor or disabled then Public Prosecutor can act on their behalf.

Children online

Draft Bill lowers to 13.

Special rules for special categories of data
In draft Bill individual's consent will not serve as legitimate ground for processing ideological, trade union membership, sexual orientation, beliefs or ethnic origin data. Additional grounds are needed.

Genetic, biometric or health data

Legislation to be drafted within 2 years.

Designation of a Data Protection Officer

Draft Bill requires a DPO to be appointed at Professional Associations; schools and universities; public network operators; information society service providers; ordenation, supervision and solvency of credit entities; credit insitution; insurance and reisurance companies; entities managing common debtors databases; advertising or marketing entities (where profiling is undertaken); healthcare centres; companies creating commercial reports on persons or organisations; gambling operators; and private security companies.

National identification numbers/any other identifier of general application



Any other areas under discussion