THE BOTTOM LINE
- Stricter Court Protocols: Expect Spanish courts to apply more rigorous data protection standards to evidence and case files, impacting how your company submits and manages information during litigation.
- Proactive Enforcement Ahead: The plan includes preventive audits of judicial bodies, signaling a new era of active supervision. This increases the likelihood that improper data handling within the court system will be identified and addressed.
- New Guidance on the Horizon: The upcoming release of official guides and templates will create clearer compliance benchmarks for how personal data is treated in judicial proceedings, benefiting prepared companies but creating risks for those who are not.
THE DETAILS
Spain’s General Council of the Judiciary (CGPJ) has announced a new strategic plan that will significantly ramp up data protection oversight within the country’s judicial system from 2026 to 2028. The plan comes from the CGPJ’s specialized Data Protection Supervision and Control Directorate (DSYCPD), the authority responsible for ensuring judicial bodies comply with data privacy laws when processing personal data for court purposes. This initiative is not just an internal administrative update; it’s a clear signal that data protection is becoming a core priority in Spanish legal proceedings, aiming to enhance legal certainty and embed privacy principles directly into judicial operations.
A central focus of the three-year plan is education and standardization. The DSYCPD intends to roll out extensive training programs for judges, court clerks, and other justice administration personnel. For businesses, this means facing a judiciary that is more aware of and sensitive to data protection issues, potentially leading to greater scrutiny of the personal data submitted in filings and evidence. To support this, the authority will publish a comprehensive guide on data protection in the judicial context and create standardized templates for handling data subject rights requests (like access or erasure) and managing data breaches within the court system.
Beyond guidance, the strategy marks a shift towards more robust enforcement. The DSYCPD will not only investigate complaints but will also conduct “preventive inspections and audits” of courts and tribunals to proactively assess their compliance. This move from a reactive to a proactive stance is crucial for CEOs and legal counsel to understand, as it underscores a commitment to actively enforcing the rules. Furthermore, the plan emphasizes collaboration with other key authorities, including the Spanish Data Protection Agency (AEPD) and the European Data Protection Supervisor (EDPS), ensuring its approach is aligned with broader national and EU privacy standards.
SOURCE: Consejo General del Poder Judicial (CGPJ)
