información por capas alt

This post is also available in: esEspañol

How does the system of information by layers work?

One of the main new developments of the new Spanish Act on Data Protection and Guarantee of Digital Rights is that it regulates the procedure for notifying data subjects of the processing of their data using the system of information by layers.

Article 11 of the act governs the basic information required in a first layer, i.e., the most relevant information regarding the data processing, so that it can be easily and clearly understood by the data subjects.

This article identifies two cases: (i) when personal data is obtained directly from the party concerned, and (ii) when personal data is obtained from a third party.

In the first case, the minimum content that the first layer must contain is as follows:

  • The identity of the controller and of its representative, if any.
  • The purpose of the processing.
  • The possibility of exercising the rights established in articles 15 to 22 of the General Data Protection Regulation (“GDPR”).
  • An email address or other means that allow simple and immediate access to the other information, i.e., to the second layer.

In the second case, i.e., if the data is obtained from third parties, the basic information that the first layer must contain, in addition to that already indicated in the paragraph above, relates to the following:

  • The categories of data subject to processing.
  • The sources of the data.

To meet the duty of transparency and information established in the GDPR, the processing of personal data can be reported through the system of two layers, the first of which must allow the basic content indicated, where applicable in each case, to be easily and clearly understood.

Cristina Clos

This post is also available in: esEspañol



25 artículos