Spanish Supreme Court provides limited relief for data controllers

Earlier this year the Spanish Supreme Court gave judgment on an application to annul the data protection regulations set out in Royal Decree 1720/2007 and to refer the Spanish implementation of the Data Protection Directive to the European Court of Justice. The application was partially successful. Some sections of the Royal Decree have been annulled but much of it was upheld. The Supreme Court also referred the Spanish implementation of the legitimate interests processing condition (art. 7(f) of the Data Protection Directive) to the European Court of Justice. The European Court of Justice’s decision could have a material impact on data controllers in Spain. If the legitimate interest condition is finally recognised it should make data protection compliance significantly easier.