The new Organic Law 7/2021 on the protection of personal data processed for the purposes of preventing, detecting, investigating, and prosecuting criminal offenses and enforcing criminal penalties, approved on May 27, 2021, regulates the processing of personal data of citizens involved in criminal cases by the State Security Forces, judicial bodies, and the Public Prosecutor’s Office.
A Law imposed by Europe and urgently approved in Spain
This new Law seeks to harmonize the Personal Data Protection Law with the European Directive, 2016/680 of April 27, 2016.
This had not yet been incorporated into the Spanish legal system, which has cost Spain a historic fine.
Balancing police effectiveness and the protection of fundamental rights
The objective of the New Organic Law 7/2021 is to establish a balance between the effectiveness of the powers of the judicial police, the Public Prosecutor’s Office, and the exercise of judicial functions, and the requirement that data be processed by these competent authorities in a way that fulfills the intended purposes, as well as to establish higher standards for the protection of fundamental rights and freedoms of citizens.
International cooperation between the police and judicial services of the countries involved becomes an unavoidable objective with this new Law. Since the 2001 Twin Towers attack, the aim has been to respond “to the growing threats to security in national and international contexts that, in numerous cases, have a cross-border component.”
The investigation of suspicious persons is not “preventive justice”
One of its most relevant aspects, and one that has generated the most controversy in public opinion, is that this new Law obliges the data controller, “as far as possible,” to establish a series of distinctions between various “categories of data subjects,” and among these categories, it highlights “Persons for whom there are well-founded reasons to presume that they have committed, may commit, or collaborate in the commission of a criminal offense.”
Some might consider this point a measure of “preventive justice” and a complete assault on individual rights. But legal experts like Samuel Parra, a jurist specializing in privacy and data protection, warn: “No one is going to condemn you because they suspect you are going to commit a crime. The police investigate you because they have realized that you have bought seven butane cylinders, that you have a manual on how to make a bomb, and that you have been associating with terrorists for months; then, it is most likely that they will investigate you, arrest you, and question you.”
According to some experts, it is legitimate to consider that: “the personal data of the victim or a witness processed in criminal proceedings are not the same as those processed concerning the alleged perpetrator of the crime.”
The collection of biometric data, much more regulated and protected by the new Law
On the other hand, the new Organic Law 7/2021 on personal data protection requires that the processing of personal data revealing ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data (fingerprints, facial features, DNA…), and data concerning health or a natural person’s sex life or sexual orientation, “shall only be permitted when strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject.”
According to the Ministry of Interior, the norm is the result of combining:
1. the “guarantee of personal data protection”
2. the “need for security forces to prevent, detect, and investigate phenomena affecting national security.”
A good example of this would be terrorism or organized crime.
It is at this point that some see an attack on individual rights, granting the State the power to collect information on sexuality or ideology. But nothing could be further from the truth: the Law’s primary purpose is to protect data in police investigations and create a framework that guarantees the correct processing of personal information that police and judicial bodies already handle in their investigations and actions.
Conclusion on the New Organic Law 7/2021
In short, this Law incorporates a European directive that Spain was obliged to include in its own Law, in order to regulate the use of data collected in police investigations and criminal proceedings. Its purpose is by no means to empower the Government to “collect information on political, religious, and philosophical opinions, as well as on the activity and sexual orientation” of any citizen, but rather to regulate the processing of this data for those who have been investigated or are part of a police action.
You can consult the full Law here
