Legal framework

Sending commercial email without the recipient's consent is regulated in Spain. These are the applicable rules.

Legal framework

Article 21 LSSI-CE — unsolicited communications

Law 34/2002 prohibits sending advertising or promotional communications by email that were not previously requested or expressly authorised by their recipients, save for a prior contractual relationship on the terms the law itself defines.

Article 6 GDPR — lawfulness of processing

Processing personal data for commercial purposes requires a lawful basis, usually the prior, express and unambiguous consent of the data subject. Without it, the processing is unlawful.

Articles 38 LSSI-CE and 83 GDPR — penalties

Breaching article 21 of the LSSI-CE may be penalised with a fine of up to €30,000. GDPR infringements may reach far higher penalties. Enforcement powers rest solely with the Spanish Data Protection Agency (AEPD), not with RedData Legal.

Disclaimer

RedData Legal does not replace the AEPD. We act on behalf of the claiming company to document the infringement, attempt an out-of-court settlement and, where appropriate, file the complaint with the competent authority.

AEPD electronic office