Data protection regulations

In 2016, Regulation (EU) 2016/679 of the European Parliament and the Council was approved, on 27 April 2016, relating to the protection of natural persons with regard to the processing of their personal data and the free movement of such data (GDPR), which repeals Directive 95/46/EC. The GDPR has been in full force since 25 May 2018. Although the GDPR is of direct application, it was considered appropriate to draw up certain regulations to complement the general regulation in this matter, given its complexity. In this sense, Law 3/2018 of 5 December, on the protection of personal data and guarantee of digital rights (LOPDGDD), was approved.

With regard to the processing of personal data in the field of police work and criminal justice, Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016, relating to the protection of natural persons with regard to the processing of personal data by the competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal sanctions, and the free movement of such data and for which repeals Framework Decision 2008/977/JAI of the Council. This Directive was transposed into the Spanish legal system by Organic Law 7/2021 of 26 May, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offences and the execution of criminal penalties. Regarding AI, the Artificial Intelligence  Act must be taken into account.