Is it legal to sell data in Spain?

EU Regulation

The transfer or sale of personal data is regulated in Recital 34 and Article 10 of DIRECTIVE (EU) 2019/770 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 20 May 2019.

Recital 34 states the following:

“It is appropriate to ensure that consumers are fully aware of the conditions of use of their personal data, including the transfer or sale of their personal data to third parties, and that they are able to exercise their rights in relation to those data”.

Article 10 of that Directive provides as follows:

1. 1. “The provider of digital content or services may not transfer or sell the consumer’s personal data to third parties without the consumer’s express consent, unless the transfer or sale is necessary for the performance of the contract or for the application of pre-contractual measures at the consumer’s request.
   2. The consumer’s consent shall be deemed to have been given if it has been sought by electronic means, provided that the consumer is given a simple and free possibility to revoke it at the time of collection of the data or at any time thereafter.
   3. The digital content or service provider shall inform the consumer of the transfer or sale of his personal data to third parties, indicating the identity or types of recipients of the data, the purpose of the transfer or sale and the legal basis for the transfer or sale.
   4. The consumer shall have the right to withdraw his consent at any time without giving any reason. The digital content or service provider shall inform the consumer of this right of withdrawal and how to exercise it”.

Therefore, in order to transfer or sell personal data to third parties in the context of a contract for the provision of digital content or services, the express consent of the consumer is required. The consent must be freely given, specific, informed and unambiguous. The consumer must be informed of the purpose for which his data will be used, as well as the recipients of the data. The consumer also has the right to withdraw his consent at any time.

Regulation in Spain

The transfer or sale of personal data is regulated in paragraph 11 of the Explanatory Memorandum of the Organic Law on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). This paragraph states the following:

“The transfer or sale of personal data to third parties is a common market practice, which can be beneficial for data subjects, as it allows them to obtain personalised services and offers tailored to their needs. However, it may also pose a risk to their privacy, as it may result in their data being used for purposes that they are not aware of or have not authorised. For this reason, the LOPDGDD establishes that the transfer or sale of personal data may only be carried out with the express consent of the data subject, unless it is necessary for the performance of a contract or for the application at the request of the data subject of pre-contractual measures”.

The transfer or sale of personal data is also regulated in Article 13 of the LOPDGDD. This article states the following:

1. “The processing of personal data for the purpose of transfer to third parties requires the express consent of the data subject, unless the transfer is necessary for the performance of a contract to which the data subject is a party or for the implementation at the request of the data subject of pre-contractual measures.
2. Where the purpose of the processing of personal data is the transfer of such data to third parties for direct marketing purposes, the data subject’s consent shall be deemed to have been given if it has been requested by electronic means, provided that the data subject is given a simple and free possibility to revoke it at the time of data collection or at any time thereafter.
3. Where the purpose of the processing of personal data is the transfer of such data to third parties for profiling purposes, the data subject’s consent shall be deemed to have been given if it has been requested by electronic means, provided that the data subject is given a simple and free possibility to revoke it at the time of data collection or at any time thereafter”.

What is meant by free, specific, informed and unambiguous consent when selling data?

The GDPR requires consent to be “unambiguous”, which means that it must be given by a manifestation of the data subject or by a clear affirmative action. This excludes the use of so-called tacit consent, which was allowed under Spanish data protection law. Thus, the use of pre-ticked boxes or inaction are not considered valid ways of obtaining consent. On the other hand, the use of a written declaration or ticking boxes on an internet website are in accordance with the GDPR. Consent under the GDPR is characterised by the following:

• It can be for one or more purposes.
• It must be freely lent.
• Revocable.
• The responsible person must at all times be able to prove that consent has been obtained.
• Use clear and simple language.

On the other hand, the following should also be taken into account:

• If a written declaration is used to obtain it, the data protection part must be clearly differentiated from the other declarations.
• If consent is collected for several purposes:
  • It would be possible to group them according to their linkage (e.g. consent to receive own or third party advertising).
  • But they should be unbundled when the processing operations involve different conduct (e.g. processing by the data collector and transfer to third parties).

There are also cases in which, in addition to being unequivocal, consent must be explicit:

• Processing of sensitive data
• Automated decision-making
• International transfers

Si te ha interesado este artículo no dudes en leer:

What is an appropriate level in international data transfer?

Without data transfers there is no communication. However, these transfers cannot undermine the level of protection of individuals guaranteed by the GDPR

Milestones necessary for the sale of personal data in Spain

In Spain, the sale of personal data is regulated by the Organic Law on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). This law establishes that, in order for the sale of personal data to be legal, it is necessary to have the express consent of the data subjects.

To sell personal data in Spain, the following steps are necessary:

1. Obtain the express consent of the data subjects. This consent must be given in a free, specific, informed and unequivocal manner. Data subjects must be informed of the purpose for which their data will be used, as well as the recipients of the data.
2. Draw up a contract for the sale of data. This contract should set out the terms and conditions of the sale, including a description of the data to be sold, the sale price and the method of payment.
3. Register with the Spanish Data Protection Agency (AEPD). Companies that sell personal data are obliged to register with the AEPD.

Once these steps have been followed, the company will be able to sell the personal data to other companies that are interested in them.

Ways to sell data

There are two main ways of selling personal data:

• Sell data directly to other companies. This is the easiest way to sell data, but also the least profitable. Companies that buy data directly from other companies tend to pay a lower price than those that buy data through an intermediary.
• Sell the data to an intermediary. Intermediaries, also known as data brokers, are companies that buy and sell personal data. Data brokers usually pay a higher price for data than companies that buy data directly from other companies.

What data can be sold?

Any type of personal data can be sold, as long as the requirements established by the LOPDGDD are met. The most common personal data sold are the following:

• Contact details: first name, surname, address, telephone number, e-mail address, etc.
• Demographic data: age, gender, location, etc.
• Behavioural data: interests, buying habits, etc.
• Browsing data: web browsing history, cookies, etc.

Advantages and disadvantages of selling data

The sale of personal data can have advantages and disadvantages.

Advantages:

• It can be a source of revenue for companies.
• It can help companies to improve their knowledge of their customers.
• It can help companies to customise their products and services.

Disadvantages:

• It may lead to a breach of data subjects’ privacy.
• It can damage the reputation of companies selling data.

Recommendations

• Before selling personal data, it is important to consider the advantages and disadvantages of this practice. It is also important to ensure that the requirements of the LOPDGDD are met.
• The analysis of the scope of personal data protection and the regulations governing it is complex. Find an experienced data protection lawyer

If you liked this article, you may also be interested in reading the following one:

Diccionario (Jargon) de Protección de Datos (GPDR)