CLFR - Spain

Monday, January 8, 2018 - 12:35

PROVISION OF REAL-TIME LAWFUL INTERCEPTION ASSISTANCE

Service providers and operators of public electronic communication networks may be required to intercept communications in the following scenarios:

CRIMINAL PROCEDURE ACT

Following the judicial police’s initiative, a judge may issue an interception order following the legal requirements established in Article 579 of the Criminal Procedure Act, approved by Royal Decree of 14 September 1882 (the “Criminal Procedure Act”), in cases where evidence suggests that by making use of these means a relevant issue or circumstance of the case may be discovered or ascertained.

ORGANIC LAW 2/2002

In addition, pursuant to the Organic Law 2/2002, dated May 6, 2002, on the Prior Judicial Control applicable to the National Intelligence Centre, the National Intelligence Centre (“CNI”) may ask the operator to intercept communications in cases where the Secretary of State or Director of the CNI has obtained an authorisation from the relevant judge of the Spanish Supreme Court, in accordance with the aforementioned requirements of such Organic law.

In cases of urgency, when investigations are carried out to find out felonies which are related with the acts of armed gangs, terrorist elements or rebels, the interception of communications may be ordered by the Minister of Home Affairs, or otherwise, the Director of State Security, communicating it immediately by a reasoned opinion in writing to the relevant judge, who will also by a reasoned opinion, revoke or confirm such resolution in a maximum term of 72 hours within 72 hours of being ordered.

THE UNIVERSAL SERVICE REGULATION

Articles 83 to 101 of the Regulation on the conditions for the provision of electronic communication services, the universal service and the protection of users, approved by Royal Decree 424/2005, of 15 April 2005 (the “Universal Service Regulation”), determines the procedure and the measures to be adopted by service providers and operators of public electronic communication networks for intercepting communications in cases where they are obliged to do so by law. The Universal Service Regulation establishes, among other things, the general requirements of the procedure, access requirements, the information to be delivered to the authorised agent (judicial police or CNI agent), and other operational requirements (previous information, locations, authorised personnel, confidentiality, real time access, interfaces, etc.).

In addition, Order ITC/110/2009, of 28 January 2009 on the general framework applicable to the specifications to be followed for the legal interception of communications (“General Framework Order”), establishes the relevant technical requirements and interfaces to be implemented by service providers and operators of public electronic communication networks in order to be communicated by the relevant agent about the need to carry out the interception of a communication.

A court order or an authorisation must be issued by the relevant judge before the interception takes place, except as outlined in case (c) above.

ORDER ITC/110/2009

Additionally, the relevant technical requirements and interfaces which service providers and operators of public electronic communication networks are required to have implemented to carry out the interception of a communication are regulated under Order ITC/110/2009, of 28 January 2009, on the general framework applicable to the specifications to be followed for the legal interception of communications.

GENERAL TELECOMMUNICATIONS ACT 32/2003

Article 33 of the General Telecommunications Act 32/2003, of 3 November 2003, sets out the operator’s duty to intercept communications when required to do so by the relevant authorities through the appropriate interfaces, duly ready for this purpose. Together with such Act, the Universal Service Regulation and the General Framework Order, all provide for a detailed description of the obligations to which operators are subject in terms of measures, procedures, interfaces and technical requirements to be put in place in order to comply with their interception duties.

In addition, there are further Orders which aim to regulate particular technologies, such as: (1) the Order ITC/313/2010, 12 February 2010, implementing and adapting the technical specification ETSI TS 101 671 on Lawful Interception (LI); Handover interface for the lawful interception of telecommunications traffic; (2) Order ITC/682/2010, dated March 9th, 2010, implementing and adapting the technical specification ETSI TS 133 108 (3GPP TS 33.108) on Universal Mobile Telecommunications System (UMTS); 3G security; and Handover interface for Lawful Interception (LI). 

Spanish law does not appear to grant government agencies the legal powers to mandate direct access into a communication service provider’s networks without the operational or control or oversight of the communication service provider. 

DISCLOSURE OF COMMUNICATIONS DATA

DATA RETENTION ACT 2007

The Act 25/2007, of 18 October 2007, of retention of data related with electronic communications and public communication networks (“Data Retention Act”), regulates: (1) the operator’s obligation to retain traffic and localisation data, and other necessary data to identify the user (“traffic data”) generated or processed in connection with the provision of electronic communication services or public communication networks; and (2) the duty to transfer such traffic data to the relevant agents whenever they are required to do so, through the relevant court order or judicial authorisation. In addition to the judicial police and CNI agents, the Data Retention Act explicitly includes the staff members of the Office of Customs Surveillance as authorised agents in this regard. 

The Data Retention Act, among other things, regulates the particular traffic data to be retained, the particular obligation to store traffic data, the period of time such traffic data must be stored or retained by the operator, the procedure and security measures involved in the transfer of such traffic data to the relevant agents, and the sanctions to be imposed on operators which do not comply with such obligations.

The content of communications is explicitly excluded from the scope of the aforementioned Act.

In accordance with Article 4 of the Data Retention Act, operators have the obligation to disclose the retained data to the authorised agents (see above), following the instructions contained in a court order issued by the relevant judge, and pursuant to the provisions of to the Criminal Procedure Act.

Article 8.2 of Law 34/2002 on Information Society Services and Electronic Commerce (“LSSI”) states that in order for the competent authorities to identify an alleged infringer, they may request information society service providers (which may include telecoms operators) to disclose data which would permit such identification. This request has to be based on a previous judicial authorisation, in accordance with Article 122 of the Law 29/1998 of 13 July governing Administrative Jurisdiction (“LJCA”).

NATIONAL SECURITY AND EMERGENCY POWERS

According to Article 4.5 of the General Communications Act, the Spanish Government may, exceptionally and temporarily, determine the assumption by the General Administration of the direct management of certain services or the exploitation of certain electronic communications networks, in order to ensure public safety and national defense. 

According to the exceptional regime provided by Organic Law 4/1981 of 1 June, on the State of Alarm, Emergency and Siege (“LSAES”):

 

  • during the State of Alarm (on the basis of essential goods stock-outs in the whole national territory or in a certain region – Article 4.d), the government may issue necessary orders (Article 11.e) or decide to intervene in such services or mobilize its personnel (Article 12.2) in order to insure the functioning of affected services;
  • during the State of Emergency (which may be requested on the basis of serious alteration of essential public services, among other), the government may intercept any kind of communications provided that it is necessary to clarify alleged criminal offenses or to maintain public order (Article 18); and
  • during the State of Siege, the government directing military and defense policies, shall assume all exceptional prerogatives.

 

The declaration of a State of Alarm will be conducted by Decree agreed by the Cabinet.

Once the government has obtained an authorisation from the Congress, it shall declare a State of Emergency, by Decree agreed by the Cabinet. The authorisation must include the suspension of article 18.3 of the Spanish Constitution, related to the secrecy of communication, in order for Article 18 LSAES to be applicable.

The government proposes the declaration of State of Siege before the Congress.

Article 122 LJCA refers to the necessary requirements that have to be met in order to obtain judicial authorisation: an initial request by the competent authorities, which has to include the pertinent reasons for the request and also the relevant documents to such purpose. The court, within 24 hours of the request and, after hearing the Public Prosecutor, may issue the requested authorisation, provided that it would not affect Article 18 paragraphs 1 and 3 of the Spanish Constitution. 

In accordance with Article 4.5 of the General Communications Act, on the basis of a breach of public service obligations (under Title III General Communications Act), the government, following a mandatory report from the Telecoms Authorities (“CNMC”), may exceptionally and temporarily establish the assumption by the General Administration of the direct management of the services or the exploitation of the corresponding networks. Regarding the latter, it may also, under the same conditions, intervene the provisioning of electronic communications services.

OVERSIGHT OF THE USE OF THESE POWERS

Pursuant to the Criminal Procedure Act, the relevant court order will determine the extension and scope of the disclosure to be carried out. In this regard, the relevant judge has a duty of supervision to ensure compliance with such court order.

The intervention determined pursuant to Article 18 LSAES shall be notified immediately by reasoned writing to the competent judge.

CENSORSHIP RELATED POWERS

SHUT-DOWN OF NETWORK AND SERVICES

ORGANIC LAW 4/1981 ON THE STATE OF ALARM, EMERGENCY AND SIEGE

Under Organic Law 4/1981 on the State of Alarm, Emergency and Siege certain constitutional rights are suspended and an exceptional legal regime is provided for when Spain experiences a ‘State of Alarm’, ‘State of Emergency’ or ‘State of Siege’. The most relevant to the shut-down of Vodafone’s network and/or services are the powers which the government obtains when a State of Alarm or State of Siege is declared.

A State of Alarm occurs when there is shortage of essential goods or services in either the whole of Spain or a certain region of it (for example as a result of a general strike); it can only be declared by decree of Spain’s cabinet who must report this state to the Congress (Parliament). Without this authorization, the government cannot extend the initial period of 15 days. Under Article 11, during a State of Alarm, the government may intervene to remedy the shortage. It is feasible therefore that were a major issue to arise in respect of Spain’s communications, the government might intervene with Vodafone’s network. It is more likely that such intervention would be used to improve or restore the affected network or communication service however it is possible that such intervention could extend to closing the network or service down. 

A State of Siege occurs when the government of Spain is concerned with military and defensive policies related to protecting the security of Spain. The government must put its proposal before the Parliament in order to declare a State of Siege. During a State of Siege, the government may assume all exceptional prerogatives which come with a State of Siege – this includes ordering the shut-down of Vodafone’s network or services. 

LAW 9/2014, OF 9 MAY 2014 (“GENERAL COMMUNICATIONS ACT”)

Articles 79 and 82 of the General Communications Act (“LGTel”) provides that the government or the telecoms authority, CNMC, may suspend (as an interim measure) or withdraw a network provider’s right to provide electronic communications networks, services and/or utilities. They may only do so in the case of serious and repeated breaches by the network provider relating to service provisioning, network exploitation, usage rights granting, or specific conditions that the Regulator has imposed to that Operator. The government and CNMC therefore have the power to shut-down Vodafone’s network or certain of Vodafone’s services but only if it should deem Vodafone to have seriously or repeatedly breached its obligations as a network provider.

In addition, Article 28 (1) of the LGTel together with regulations (Articles 17 and 53 of the Royal Decree 424/2005) provide that the government may, for reasons of national defence, public security or civil protection, impose other public service obligations different from Universal Service.

BLOCKING OF URLS & IP ADDRESSES

LAW 34/2002 ON INFORMATION SOCIETY SERVICES AND ELECTRONIC COMMERCE

Under Article11.1, where a competent authority has found certain content to infringe the principles set out in Article 8.1, a court may order a network provider (such as Vodafone) to suspend access on its network to such content. In practice Vodafone would do this by blocking the URL or IP addresses at which the content is hosted. The principles set out in Article 8.1 include (a) safeguarding public order, security and national defence; (b) protecting public health and consumers; (c) respecting fundamental rights (dignity, non-discrimination), (d) child protection, and (e) safeguarding intellectual property rights.

POWER TO TAKE CONTROL OF VODAFONE’S NETWORK

ORGANIC LAW 4/1981 ON THE STATE OF ALARM, EMERGENCY AND SIEGE

Please see ‘Shut-down of network and services’. 

GENERAL COMMUNICATIONS ACT

In principle LGTel allows the government, in a state of emergency or siege, to manage the telecommunication service as a “temporal” public service. In particular, Article 4.5 (Telecommunication services for national defence and civil protection) of LGTel provides that the Spanish government may, exceptionally and temporarily, order the General Administration to assume direct management of certain electronic communications networks or services, in the interests of public safety or national defence.

OVERSIGHT OF THE USE OF POWERS

ORGANIC LAW 4/1981 ON THE STATE OF ALARM, EMERGENCY AND SIEGE

There is no judicial oversight of the specific emergency powers provided for when a ‘State of Alarm’ or ‘State of Siege’ is declared. 

GENERAL COMMUNICATIONS ACT

There is no judicial oversight of the government or CNMC’s use of the powers provided for by the General Communications Act. 

LAW 34/2002 ON INFORMATION SOCIETY SERVICES AND ELECTRONIC COMMERCE

For a court order to be made requiring a network provider to suspend access to certain content, a request must first be submitted by the competent authority to the court. The request must set out the reasons for the request and relevant documentation in support of the request. Within two days of receiving the request, the court must convene a hearing with a legal representative of Spain’s General Administration, the Public Prosecutor and the affected intellectual property rights holders. At the hearing, the court must hear all parties and then decide whether to authorise or reject the request to order the suspension of access to certain content. This decision must be made within 2 days of the hearing and must also be published.

This information was originally published in the Legal Annexe to the Vodafone Group Law Enforcement Disclosure Report in June of 2014, which was updated in February of 2015.