SPAIN Law and Practice Contributed by: Rubén Canales and Ignacio Temiño, Abril Abogados
a legitimate interest of the advertiser as a basis for legitimising the processing of personal data. Whether the consumer has consented to receive commercial telephone calls, at the beginning of the telephone call, the identity of the advertiser or, if appli - cable, the identity of the person on whose behalf the call is being made, as well as the commercial pur - pose of the call, must be explicitly and clearly stated. Under no circumstances may telephone calls be made before 09:00 or after 21:00, or on public holidays or weekends. Furthermore, concealing or disguising the sender’s identity is strictly prohibited. The use by the advertiser of an automated calling sys - tem without human intervention or telefax requires the prior express consent of the consumer. The consumer has the right to object to receiving unwanted commercial offers, by telephone, fax or other equivalent means of communication, and should be offered such a choice on every call. 6.3 Text Messaging The same restrictions that apply to email marketing apply to text messages. 6.4 Targeted/Interest-Based Advertising This type of advertising usually involves data process - ing based on user preferences and/or user profiling. It therefore requires the express authorisation of the data subject. Any entity that carries out these actions must appoint a DPO who must be registered on the AEPD list. In addition, the AEPD has included this type of data processing among those included in its “Black List” that require a risk impact assessment if the data pro - cessing allows the identification of users. 6.5 Marketing to Children The processing of personal data of a minor may only be based on his or her consent if he or she is over 14 years of age. For minors under 14 years of age, con - sent must be given by their parents or legal guardians.
The General Audio-Visual Communication Act restricts the use of minors’ personal data when it has been collected or otherwise generated by providers of the video-sharing service through a digital platform. Such data shall not be processed for commercial purposes, including but not limited to direct marketing, profiling, or personalised behavioural advertising. 6.6 Other Rules Autocontrol and the Spanish Data Protection Authority have developed the Code of Conduct on Data Pro - cessing in Advertising. This Code applies to the pro - cessing of data for advertising purposes or relating to advertising carried out by adhered entities, such as: • sending of commercial communications, including those cases in which the data subject is registered in an advertising exclusion list; • promotions performed with the aim of collecting personal data, to be used for advertising purposes; • the use of cookies and similar technologies to manage advertising spaces or carry out behav - ioural advertising; • profiling for advertising purposes; and • any other processing of personal data in connec - tion with advertising activities (eg, the exercise of rights). The Code also regulates the procedure for the extra - judicial resolution of data protection disputes between adhered entities and data subjects. 7. Sweepstakes and Other Consumer Promotions 7.1 Sweepstakes and Contests In Spain, prize promotions, such as sweepstakes and contests, are considered “random combination”. Random combinations are defined as a “draw aimed exclusively at advertising or promoting a product or service, whose sole compensation is the consump - tion of said product or service, without surcharge or tariff, which offer cash, in-kind or service prizes and, in certain cases, require registering as a client of the entity being advertised or promoted”.
263 CHAMBERS.COM
Powered by FlippingBook