Royal Decree 5/2018, includes urgent measures to adapt Spanish law to European Union data protection regulations was passed on July 27h.

The reason for passing the regulation using a Royal Decree was the urgent need to incorporate certain provisions from the European Union's General Data Protection Regulations (GDPR), as discussed in Progreso 7, into Spanish law. The GDPR, which came into force on May 25, 2018, displaced certain domestic legal provisions with which it was incompatible. However, the European regulation refers back to domestic law in some of its provisions and the legislative adaptation completed to date is limited to a draft organic law which is currently going through parliament. In view of the delay in the Organic law, this Royal Decree was passed as an interim measures until the new organic law comes into effect.

The most important areas the Royal Decree regulates are as follows:

• It describes the professional profile of those suited to holding the investigative powers granted by the GDPR and regulates how they exercise these powers
• It refers to the penalty system in place, determining which persons can incur liability and the time limits on the infractions and the penalties imposed by the GDPR
• The procedure to follow in the event of the GDPR being infringed is set out, including the stages during which claims are processed and the possibility of temporarily shelving the file in those cases where the Spanish Data Protection Agency, the AEPD, does not process the claim but can resolve it on its own.  There are provisions for a time extension when the opinion of Authorities in other Member States needs to be sought, in cases where the AEPD is the coordinating authority.
• The AEPD is designated as Spain's representative to the European Committee.

The contracts of data processing controllers signed before May 25th, 2018 under the previous regulations will remain in force until their maturity date and, if they are open-ended, until May 25th, 2022.