THE BOTTOM LINE
- The 72-Hour Rule is Non-Negotiable: Spain’s new judicial protocol reinforces the strict GDPR deadline for reporting significant breaches to the authorities. Businesses must ensure their incident response plans can meet this tight turnaround.
- Heightened Scrutiny on Data Security: By formalizing its data protection procedures, the judiciary signals a deeper focus on data security. Courts will likely have higher expectations for businesses facing similar incidents.
- Direct Notification is the Standard: The rules mandate prompt, clear, and direct communication with affected individuals when a breach poses a high risk, setting a clear benchmark for corporate transparency.
THE DETAILS
The Spanish General Council of the Judiciary (CGPJ), the governing body of the country’s judiciary, has established a formal procedure for managing and reporting personal data breaches within its own courts and tribunals. This new protocol, developed by the CGPJ’s Data Protection Supervision and Control Directorate, standardizes the response to any security incident affecting personal data processed for judicial purposes. While the procedure applies internally to the judicial system, it serves as a powerful indicator of the compliance standards expected from all organizations operating in Spain.
The core of the procedure mirrors the stringent requirements of the GDPR. It defines a data breach broadly, covering any incident that compromises confidentiality (unauthorized disclosure), integrity (unauthorized alteration), or availability (accidental loss or destruction) of personal data. The protocol mandates that any breach posing a risk to the rights and freedoms of individuals must be officially reported to the judiciary’s data protection authority within a maximum of 72 hours of its discovery, using a dedicated online form.
For business leaders and legal counsel, this development is a clear signal. The protocol further mandates that if a breach is likely to result in a “high risk” to individuals, those affected must be notified directly and “without undue delay” in clear and simple language. By implementing these rigorous standards for itself, the Spanish judiciary is “practicing what it preaches.” Companies can expect that this internal discipline will translate into a judiciary that holds businesses to the same high standards, showing little tolerance for poorly managed or delayed breach notifications.
SOURCE
Consejo General del Poder Judicial (CGPJ)
