Consent for more than one purpose of data processing
The Spanish legislator, in Art. 7 (2) Organic Law 3/2018, stipulates that if a controller wants to process personal data for various purposes, each of those purposes must be covered by the consent declaration of the data subject.
Freely given consent
Moreover, Art. 6 (3) Organic Law 3/2018 narrows the validity of consent. A controller cannot base the validity of a contract on the data subject’s consent to purposes of processing not related to the continuation, development or control of the contractual relationship between controller and data subject.
Consent of minors
According to Art. 7 Organic Law 3/2018, consent of minors is only valid when they are over 14 years old. If a minor is younger than 14, consent must be obtained by the legal guardian.
Compliance with a legal obligation
Art. 8 (1) Organic Law 3/2018 determines that a legal obligation serves as a legal basis if that obligation is derived from European legislation or has the level/rank of ‘ley’ (law) in the Spanish juridical order. The legal obligation regulates the general conditions of the processing, the categories of personal data and transfers of data.
Art. 8 (2) Organic Law 3/2018 states that a public interest legal basis can only be derived from a provision on the level/rank of ‘ley’ (law).
Legal basis for narrowly defined processing activities
Organic Law 3/2018 creates rules for several narrowly defined situations that allow controllers to process personal data. For example, chapter IV of Organic Law 3/2018 creates special rules and requirements for the following situations:
- Processing of contact details of natural persons and individual entrepreneurs who provide their services for a legal person
- Processing of personal data in the public interest for archiving purposes by public authorities
- Processing due to corporate structural change transactions
- Processing for whistle blowing systems
- Video surveillance to establish safety and protect property