Spain sanctioned for the delay in transposing the data protection directive in criminal investigations

In a recent blog post, we reported on the approval of the draft Organic Act by the Council of Ministers to transpose Directive 2016/680 on the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offenses or the execution of criminal penalties. Just a few days later, we learned that Spain has been sanctioned for not transposing or communicating the transposition measures of that Directive.

It has been fined a lump sum of 15.5 million euros plus a daily penalty of 89,548.20 euros for each day the transposition is delayed. It is worth pointing out that this is the first time the Court of Justice of the European Union (CJEU) has imposed these two types of fines simultaneously, under Article 260.3 of the Treaty on the Functioning of the European Union (TFEU).

After issuing a request and a reasoned opinion for adopting measures that were breached by Spain, the European Commission decided to escalate the issue to the CJEU. The CJEU noted both the failure to adopt the measures required to guarantee the transposition of Directive 2016/680 in the stipulated period of two months and the failure to communicate those measures to the Commission.

In its response to the Commission’s reasoned opinion of March 27, 2019, Spain stated that the delay in transposing the Directive was due to the unusual political situation in the country and the fact that, under the Spanish legislative system, that Directive must be transposed in an organic act. However, Spain also recognized that its submissions on the exceptional institutional circumstances that delayed the adoption of the transposition measures were not sufficient to justify the breach. That being said, Spain considered that those circumstances should have been taken into account when weighing the proportionality of the sanctions proposed by the Commission.

The CJEU decided that the daily fine for delay is an appropriate measure to end the breach declared by the Member State in question swiftly. It also stated that the lump sum acts as a deterrent in view of the aim of preventing similar infringements in the future.

After the Commission’s notified its assessment of the alignment of the national transposition legislation with that Directive, in 2019, it initiated infringement proceedings against Germany and brought Spain and Greece before the CJEU. However, Greece (unlike Spain) subsequently notified the full transposition of the Directive. We would point out that Spain is one of the Member States with most open infringement proceedings, based on the 2019 report on the application of EU law.

The aim of Directive 2016/680 is to guarantee a high level of personal data protection while at the same time enabling national law enforcement authorities to exchange personal data. The European authorities are focusing on this area to safeguard citizens’ fundamental right to data protection. We will continue to report on developments in the parliamentary processing of the Organic Act in this blog.

Authors: Josu Andoni Eguiluz and Jorge Monclús