On 22 May 2019 it was disclosed that the Spanish Constitutional Court had decided to nullify indent 2 of the final provision 3 of the new Spanish Data Protection Act, less than six months after becoming effective. At the same time, article 58 bis of the General Electoral Act, created by the former, is also nullified. Sometimes dubbed “Spanish Cambridge Analytica”, they basically authorized political parties to screen websites and open sections of social networks to collect personal data on potential voters and then to customize deliveries of messages during the electoral campaigns. Furthermore, messages from political parties were not to be considered Spam for the purposes of e-marketing laws.

These provisions were included by the Spanish Parliament at the very last minute. Although they initially received the support of all Spanish political parties, without any single vote against, some criticism appeared later during the discussions at the Senate. They were maintained essentially because should the draft have been changed at that point, the law could have been delayed for two more years, which was clearly unacceptable. A strong movement of individuals and associations led then the Spanish Ombudsman to file a complaint with the Spanish Constitutional, that has been reviewed and decided within an exceptionally short timeframe, given the heavy workload of the Court. The rationale for the decision will be disclosed within the next weeks. Amazingly, Spain may complete the second and final round of elections of this year by this Sunday, the next ones being expected in 2023, so the impact of the nullification may be for the benefit of future voters, rather than for current ones. Nevertheless, the social debate has shown the great concern of Spanish people about privacy matters, overriding the consensus of political forces.