| Agencia Española de Protección de Datos | |
 | |
| Department overview | |
|---|---|
| Formed | 26 March 1993; 32 years ago (1993-03-26) |
| Type | Independent Administrative Authority |
| Jurisdiction | Government of Spain |
| Headquarters | Madrid,Spain |
TheSpanish Data Protection Agency (AEPD,Spanish:Agencia Española de Protección de Datos) is an independentagency of thegovernment of Spain which oversees the compliance with the legal provisions on the protection of personal data. The agency is headquartered in the city ofMadrid and it extends its authority to the whole country.
Apart from the AEPD, there are regional data protection agencies. These agencies have limited access to the files of public administrations because all that information remains the responsibility of the national agency. Currently there are only two regional agencies: theCatalan Data Protection Authority (APDCAT) and theBasque Data Protection Agency (DBEA). From 1995 to 2013, there was also the Data Protection Agency of the Community of Madrid.
The AEPD was established by Royal Decree 428/1993 of 26 March, as amended by Organic Act 15/1999 on the Protection of Personal Data. This amendment implementedDirective 95/46/EC.[1] The agency was created in the context of theSpanish Constitution of 1978, Article 18.4, stating that "the law shall restrict the use of informatics in order to protect the honour and the personal and family privacy of Spanish citizens, as well as the full exercise of their rights" as elaborated by Organic Law 5/1992.[2]
The AEPD is a public law authority enjoying "absolute independence from the Public Administration". It is responsible for:[3]
In response to the latter point, the AEPD advocated:[3]
The AEPD has been conductinganti-spam investigations since 2004, collaborating with foreign agencies such as theUnited StatesFederal Trade Commission.[4][5]
The AEPD has come into conflict withGoogle over information gathered fromWi-Fi networks asGoogle Street View images were taken, asserting that "it has been verified that data on the location of wifi networks, with the identification of their owners, and personal data of a diverse nature in communications, such as names and surnames, messages associated with such accounts and message services, or user codes orpasswords" had been collected.[6][7] It has also demanded the removal of approximately 90 names from search results, claiming a "right to be forgotten".[8] Google is contesting both actions.
| International | |
|---|---|
| National | |
