The Spanish High Court has declared the nullity of Section 10.b) entitled “Cases which confirms the processing or assignment of data” of the Royal Decree 1720/2007, of December 21st, which approves the regulation implementing Organic Law 15/1999, of December 13th, on the protection of personal data, which states the following:  

“The aforesaid notwithstanding, processing or assignment of personal data shall be possible without the data subject’s consent when: (…)

b) The data object of processing or assignment are in sources available to the public and the data controller, or in those cases when the third party to whom data has been communicated, has a legitimate interest in their processing or knowledge, providing always that the fundamental rights and liberties of the data subject are not breached.

Notwithstanding the foregoing, the Public Administrations may only communicate the data collected from sources available to the public to the data controllers of privately owned files, when they are so authorised by a regulation having the force of Law.”

This decision has been adopted in view of the Judgment issued by the European Court of Justice dated November 24th, 2011 which rules about the interpretation of Article 7(f) of Directive 95/46/EC dated October 24th 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Article 7(f) states as it follows:  

“Member States shall provide that personal data may be processed only if processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection pursuant to Article 1 (1).”

Specifically the ECJ considered that Article 7(f) of Directive 95/46 “must be interpreted as precluding national rules which, in the absence of the data subject’s consent, and in order to allow such processing of that data subject’s personal data as is necessary to pursue a legitimate interest of the data controller or of the third party or parties to whom those data are disclosed, it is required not only that the fundamental rights and freedoms of the data subject are respected, but also that the data should appear in public sources, thereby excluding, in a categorical and generalised way, any processing of data not appearing in such sources.”

Therefore Spanish High Court has considered that Section 10.b) of the Royal Decree 1720/2007 should be precluded as it includes the requirement that “the data object of processing or assignment shall be achieve from sources available to the public” to allow the processing of data without the data subject’s consent.

There are two controversial aspects about this decision:  

1º It was only necessary to eliminate the sentence underlined herein below, and not the Article 10.b) as a whole, so it shall state as it follows:  

“The aforesaid notwithstanding, processing or assignment of personal data shall be possible without the data subject’s consent when: (…)

b) The data object of processing or assignment are in sources accessible to the public and the data controller, or the third party to whom data has been communicated, has a legitimate interest in their processing or knowledge, providing always that the fundamental rights and liberties of the data subject are not breached.

2º Accordingly, the High Court should have erased also Article 6.2 of the Organic Law 15/1999 dated December 13th, on the protection of personal data, which states the following:  

“2. Consent shall not be required in those cases in which the personal data is collected in the execution of the respective functions in the Public Administration within the scope of their responsibilities; In those cases in which they relate to the parties to a contract or preliminary contract for a business, employment or administrative relationship, and are necessary for its maintenance or fulfilment; those cases in which the purpose of data processing is to protect a vital interest of the data subject pursuant to the terms of Article 7(6) of this Act, or in such cases in which the data is contained in sources available to the public and their processing is necessary to satisfy the legitimate interest pursued by the controller or that of the third party to whom the data is communicated, unless the fundamental rights and freedoms of the data subject are jeopardised.”

In conclusion, the requirement that the data object of processing or assignment shall be achieved from sources available to the public and the data controller, is not any longer a requirement for the processing or assignment of personal data without the data subject’s consent.