Agencia española de protección de datos

Substantive aspects of codes type

Initiative and scope (article 72 RLOPD)

Codes may be: type

  • Sectoral in nature and may relate to all or part of the processing undertaken by industry, but shall be made by representative organizations, at least in its territorial scope of application.
  • Of enterprise, in which case they should cover the entirety of the treatment carried out.
  • Of public administrations and public law corporations, which may be addressed in accordance with the rules applicable to them.

Prescriptive content (art. 73 and 75.1 RLOPD and 2)

Type codes shall be in a clear and accessible, respect the current rules and include at least and with a sufficient degree of accuracy:

  • The clear and precise delimitation of its scope, the activities to which the code refers and treatments subjected to the same.
  • Specific forecasts for the implementation of the principles of data protection.
  • The establishment of homogeneous standards for the fulfilment by the attached to the code of obligations under the LOPD.
  • The establishment of procedures to facilitate the exercise by those concerned of their rights of access, rectification, deletion and opposition.
  • The determination of the divestments and international transfers of data which, where appropriate, require, with an indication of the guarantees to be taken.
  • Training activities in the field of data protection targeting those who treat children, especially as regards its relationship with those affected.
  • Monitoring mechanisms through which ensure compliance by the attached as provided in the code for which shall include a procedure that ensures:
    • Independence and impartiality of the supervisory body
    • Simplicity, accessibility, speed and free to submit claims
    • The principle of adversarial
    • Appropriate penalties, effective and dissuasive
    • Notification of the concerned of any decision by the authority
  • Model clauses for obtaining consent of those affected to treatment or disposal of their data.
  • Model clauses to inform those concerned, where data are not obtained therefrom.
  • Models for the exercise by the affected their rights of access, rectification, deletion and opposition.
  • Model clauses for the fulfilment of the formal requirements applicable to the recruitment of a processor, if applicable.
  • A relationship of attached to be kept updated.

Discretionary content (art. 74 RLOPD)

Type codes may include any other additional commitment to respond to the attached or undertake promotion entities, for a better implementation of existing legislation in the area of data protection and, in particular regarding:

  • The adoption of additional security measures with the requirements of the LOPD.
  • The identification of categories of transferees or importers of data.
  • Specific measures taken for the protection of the children or certain groups of affected.
  • The establishment of a seal of quality identifying the attached to the code.
  • Procedures to determine remedial measures in case of an injury to those affected as a result of infringement of the code.