Law note · Spain
AEPD Enforcement, GDPR Article 82 and LOPDGDD Titulo IX
The AEPD is Spain's supervisory authority; LOPDGDD Titulo IX (Arts. 70-78) sorts infractions into muy graves, graves, and leves, each defined by direct cross-reference to a General Data Protection Regulation (GDPR) Article 83 tier rather than an independent Spanish fine scale, confirmed by reading the text directly. GDPR Article 82 arms an individual with a direct private right of action.
This session could not confirm the specific Spanish instrument transposing the EU Representative Actions Directive for collective data-protection claims; LOPDGDD's own Disposicion final septima, read directly, only modifies a narrow amicus provision, not a class-action mechanism.
What it asks of an app
- Expect the AEPD to sort a violation into a muy grave, grave, or leve infraction tied to a General Data Protection Regulation (GDPR) Article 83 fine tier when assessing exposure for processing personal data of a person in Spain.
- Expect any person in Spain who suffered material or non-material damage from an infringement to have a direct GDPR Article 82 right to compensation from you as controller or processor.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, processes_biometrics, processes_voice, automated_outreach, high_risk_decisions
Primary source: GDPR Arts. 82-83
LOPDGDD Art. 47, Arts. 70-78 (direct read)