Law Library Stacks

Back to Index of of Legal Reports
Back to Comparative Summary

Full Report (PDF, 2.78MB)
Map: COVID-19 Contact Tracing Apps (PDF, 550KB)

Jurisdictions Surveyed:
The Americas: Argentina | Brazil | Mexico
East Asia, South Asia and Pacific: Australia | China | India | Japan | South Korea | Taiwan
Europe and Central Asia: European Union | England | France | Iceland | Italy | Norway | Portugal | Russia | Spain | Turkey
Middle East and Africa: Iran | Israel | South Africa | United Arab Emirates


Spain declared a state of alarm due to COVID-19 on March 14, 2020, and adopted a mandatory lockdown that was extended to May 24, 2020. The application of data protection regulations in health emergencies allows the data controller to adopt decisions necessary to protect the vital interests of individuals while safeguarding essential interests in the field of public health. Under the state of alarm, the government is empowered to take all measures necessary to protect the health and safety of citizens and strengthen the public health system, in addition to preventing and containing the virus and mitigating the health, social, and economic impacts. The Ley General de Sanidad also empowers health authorities, in epidemic situations, to establish extreme measures to protect public and individual health. Among these measures, the National Institute of Statistics has developed an app called ”DataCovid,” which is based on data provided by the main telecommunications operators. It uses positioning data from mobile devices, anonymized and aggregated, guaranteeing strict compliance with data protection standards.

I. Introduction

Spain declared a state of alarm due to COVID-19 on March 14, 2020.[1] A mandatory lockdown was imposed, and it has been extended several times since then, the latest being an extension through May 24, 2020 (although gradual easing of restrictions began in early May).[2] 

Spain has 47 million residents. Under the lockdown, people were allowed out only to go to work, shop for groceries, seek medical care, and briefly walk their dog.

As of May 21, 2020, there were 233,037 COVID-19 cases in the country, and 27,940 persons had died.[3]

Ninety-seven percent of households in Spain have a mobile phone.[4] Among six countries affected by the pandemic—the United States, United Kingdom, Germany, Spain, Australia, and Singapore—Spain has the largest number of people willing to share their health data to help fight the epidemic, according to a survey on “Data Preferences in Times of Corona” by the consulting firm Oliver Wyman, which found that only 15% of Spanish respondents would be unwilling to share such information.[5]

II. Legal Framework

A. Privacy and Data Protection

On March 12, 2020, the Agencia Espanola de Protección de Datos (AEPD) released a legal advisory report on measures affecting data privacy because of the COVID-19 emergency.[6]

The report states that EU General Data Protection Regulation (GDPR)[7] and Organic Law 3/2018 of December 5 (LPDP) on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD)[8] constitute the legal framework applicable in the current COVID-19 emergency situation.

The GDPR allows data controllers to process personal data during health emergencies in a manner that protects the vital interests of individuals while safeguarding essential interests in the field of public health.[9]

In this regard, recital 54 of the GDPR provides that the processing of special categories of personal data, without the consent of the data subject, may be necessary for reasons of public interest in the field of public health. Such processing must be subject to appropriate and specific measures in order to protect persons’ rights and freedoms. This processing of health-related data for reasons of public interest should not result in third parties, such as employers, insurance companies, or banks, using personal data for other purposes.[10]

In addition, all the data protection principles under the GDPR and the LOPDGDD are applicable in the current situation, including the principles of legality, trustworthiness and transparency, restrictive purpose (in this case, the safeguarding of vital and essential interests of natural persons), accuracy, and data minimization.[11]

The processing of personal data must be limited to that which is necessary for its intended purpose, because the fundamental right to data privacy protection remains effective, despite the fact that under the emergency situation,  the necessary health data may be processed to prevent the spread of the disease that has caused the health emergency.[12]

In the current health emergency situation, initiatives are being developed that involve the processing of personal data including sensitive data such as health data.[13]

While the emergency is not necessarily a ground for the suspension of the fundamental right to the protection of personal data, data protection standards cannot be applied in such a way as to restrict the effectiveness of the measures adopted by the competent authorities, such as health authorities, in dealing with the health emergency.[14] Therefore, the authorities have to guarantee the lawful use of personal data compatible with the necessary measures to effectively guarantee the common good. To do this, the AEPDP is assisting health authorities, providing them with criteria that make these aims compatible.[15]

The AEPDP has established the criteria that must be applied for the processing of personal data under the current circumstances.[16] The data processed under this emergency may only be used for control of an epidemic, such as public agencies using information on the use of self-assessment applications, or geolocation data being used to create maps of areas of greater or lesser risk.[17]

The data so accessed and used must be limited to what the competent public authorities consider necessary to fulfill the goal of epidemic management and control.[18] Data may only be collected from those who are over 16 years of age, unless authorization of parents or legal representatives is received.[19]

Under Orden SND/297/2020, the National Institute of Statistics (INE) is responsible for the processing of data and reporting on the movement of people during confinement, guaranteeing statistical secrecy and compliance with data privacy requirements. [20]

B. Location Tracking

Organic Law 4/1981 on the State of Alarm, Exception, and Siege allows exceptional measures restricting the full enjoyment of certain rights and freedoms in cases of epidemics and health emergencies.[21] Among others, these measures include restricting the movement of people or vehicles at specific times and places, or requiring them to fulfill certain conditions.[22]

Applying the state of alarm provisions of LO 4/1981, Real Decreto 463/2020 empowers the Ministries of Health, Defense, Interior and Transportation, Mobility and Urban Agenda to take all necessary measures to protect the health and safety of citizens, contain the progression of the disease and strengthen the public health system, in addition to preventing and containing the virus and mitigating the health, social, and economic impacts.[23] These measures include the issuance of orders, resolutions, provisions and instructions necessary to guarantee the provision of all services, ordinary or extraordinary, to protect people, property and places, under the authority granted within the state of alarm declaration in compliance with article 11 of LO 4/1981.[24]

In addition, Organic Law 3/1986 of April 14, on Special Measures in the Field of Public Health, provides that health authorities may adopt measures specified in this Law when necessary to protect public health.[25] These measures are directed at illness detection, treatment, hospitalization, and control when confronting a risk to public health.[26]

In order to control communicable diseases, health authorities, in addition to carrying out general preventive actions, may adopt appropriate measures for the control of patients and people who are or have been in contact with them and their environment, as well as those deemed necessary in the event of a transmissible risk.[27]

The General Health Law also empowers health authorities, in epidemic situations, to establish extreme measures to protect public and individual health.[28] It provides for the adoption of preventive measures deemed appropriate in the event of an imminent and extraordinary risk to health, including seizures of property, restrictions of activity, and closure of businesses and facilities.[29]

In this regard, Orden SND/234/2020 establishes the obligation to send information to the Ministry of Health by the Autonomous Communities, public hospital centers and certain private hospital centers.[30] In furtherance of these orders, Orden SND 297/2020 provides for the development of technological solutions and mobile applications for data collection in order to improve the operational efficiency of health services, as well as better care and accessibility by citizens.[31] It creates the legal basis for the tracing of persons’ movements within the restrictions imposed by data protection laws.[32]

III. Electronic Measures to Fight COVID-19 Spread

The Ministerio de Asuntos Económicos y Transformación Digital has been working on new mobility analysis tools to support the fight against COVID-19. All data collected in an aggregated and anonymous manner by the INE has been made available to the governments of the Autonomous Communities.[33] In addition, some information prepared by the INE, and by the Ministerio de Transporte, Mobilidad y Agenda Urbana, is now available on their websites.[34]

Mobile phone location data is used to track people’s movements and verify how closely a nationwide lockdown is being respected.[35] Information will enable verification that users’ area of residence match their actual location, thus enabling measurement of compliance with containment measures.[36]

The app, called ”DataCovid“ and managed by INE, is based on data provided by the main telecommunications operators.[37] Data received from these operators does not include personal information allowing individual identification.[38] The use of positioning data from mobile devices, anonymized and aggregated, guarantees strict compliance with data protection standards under the LPDP.[39]

INE has concluded that, in general, since the state of alarm was adopted, 85% of people have not moved from their area of residence.[40] The Data COVID mobility study, which is updated daily, allows an estimate of the mobility of the Spanish population during the period of application of the containment measures in relation to a normal situation.[41]  The information so collected lets the government know whether, after the entry into force of the containment measures, the movements of the population between territories increase or decrease, if there are areas with greater crowds, or if there are areas with a high density of people relative to their health care capacity.[42]

In addition, the app allows a coronavirus self-assessment that will only use geo-localization.[43] The app will be used for self-evaluation of coronavirus symptoms, providing practical advice and recommendations for health care resources.[44]

The official self-diagnosis mobile application is already being used in Asturias, the Canary Islands, Cantabria, Castilla-La Mancha and Extremadura, in addition to Madrid.[45]

Spain has also joined the Pan-European Proximity Tracking Project (PEPP-PT) through the Secretary of State for Digitization and Artificial Intelligence, to track mobile phones with an app after quarantine.[46] The PEPP-PT is a consortium that will develop a protocol to trace contacts without violating privacy, in order to prevent COVID-19 infections.[47]

The PEPP-PT is a nonprofit organization in Switzerland with more than 130 members from 8 countries, including scientists, psychologists, communicators, epidemiologists, telecommunications operators, universities and information technology experts in encryption, cybersecurity, and data protection.[48]

Back to Top

Prepared by Graciela Rodriguez-Ferrand
Senior Foreign Law Specialist
June 2020

[1] Real Decreto 463/2020, de 14 de marzo, por el que Se Declara el Estado de Alarma para la Gestión de la Situación de Crisis Sanitaria Ocasionada por el COVID-19, Boletin Oficial del Estado [B.O.E.] Mar. 14, 2020,

[2] Real Decreto 514/2020, de 8 de mayo, por el que se Prorroga el Estado de Alarma Declarado por el Real Decreto 463/2020, de 14 de marzo, por el que se Declara el Estado de Alarma para la Gestión de la Situación de Crisis Sanitaria Ocasionada por el COVID-19, B.O.E. May 8, 2020,; Spain Begins 4-Phase Easing of COVID Restrictions, VOA News, May 2, 2020,

[3]  Centro Nacional de Epidemiología, Ministerio de Sanidad, updated daily as of May 21, 2020,     

[4] Adrian Raya, Todos los Moviles de Espana Seran Rastreados Durante Ocho Dias, Espanol, Oct. 29, 2019,

[5]  Santiago Millán Alonzo, Oliver Wyman: “Los Espanoles Son los más Dispuestos a Dar sus Datos para las Apps Frente al Covid-19,” Cinco Días, Apr. 15, 2020,

[6] AEPD, Informe 017/2020 on the Treatment of Data Derived from the Present COVID-19 Virus Situation (Mar. 12, 2020),

[7] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) [GDPR], 2016 O.J. (L119),

[8] Ley Orgánica 3/2018 de Protección de Datos Personales y Garantía de los Derechos Digitales [LOPDGDD], B.O.E. Dec. 6, 2018,

[9] AEPD, supra note 6, at 4; GDPR art. 9.2 (g) and (i).

[10] GDPR, recital 54.

[11] AEPD, supra note 6, at 7; GDPR art. 5.

[12] AEPD, supra note 6, at 7.

[13] Comunicado de la AEPD Sobre Apps y Webs de Autoevaluación del Coronavirus, AEPD (Mar. 26, 2020),

[14] Id.

[15] Id.

[16] Id.

[17] Id.

[18] Id.

[19] Id.

[20] INE, Análisis de la Movilidad de la Población Durante el Estado de Alarma por COVID-19 a Partir de la Posición de los Teléfonos Móviles (Mar. 2020),, and Orden SND/297/2020, por la que se Encomienda a la Secretaría de Estado de Digitalización e Inteligencia Artificial, del Ministerio de Asuntos Económicos y Transformación Digital, el Desarrollo de Diversas Actuaciones para la Gestión de la Crisis Sanitaria Ocasionada por el COVID-19 art. 2, para. 3, B.O.E. Mar. 27, 2020,

[21] Ley Orgánica 4/1981, de los Estados de Alarma, Excepción y Sitio art. 4.b, B.O.E. June 5, 1981,

[22] Id. art. 11.b.

[23] Real Decreto 463/2020 art. 4.

[24] Id. art. 4.3.

[25] Ley Orgánica 3/1986, de Medidas Especiales en Materia de Salud Pública, B.O.E. Apr. 29, 1986,

[26] Id. art. 2.

[27] Id. art. 3.

[28] Ley General de Sanidad art. 26, B.O.E. Apr. 29, 1986,

[29] Id.

[30] Orden SND/234/2020, Sobre Adopción de Disposiciones y Medidas de Contención y Remisión de Información al Ministerio de Sanidad ante la Situación de Crisis Sanitaria Ocasionada por el COVID-19, B.O.E. Mar. 15, 2020,

[31] Id. art. 1.

[32] Orden SND/297/2020.

[33] El Gobierno Avanza en Nuevas Herramientas de Análisis de la Movilidad para Apoyar la Lucha Contra el COVID-19, Ministerio de Asuntos Económicos y Transformación Digital (Apr. 16, 2020),

[34] Id.

[35] Id.

[36] Id.

[37] Id.

[38] Id.

[39] Id.

[40] Id.

[41] Id.

[42] Id.

[43] Orden SND/297/2020 art. 1.

[44] Id.

[45] La ‘App’Oficial del Covid-19 Está Ya en Seis Comunidades Autónomas, Economía Digital, Apr. 6, 2020,

[46] Jorde Pérez Colomé, España Se Suma a un Proyecto Europeo de Rastreo de Móviles para Después de la Cuarentena, País, Apr. 14, 2020,

[47] Alberto R. Aguiar, España Tendrá una App para que Puedas Vigilar Contagios de Coronavirus Entre tus Vecinos, pero no Será Efectiva Hasta que se la Descarguen 23 Millones de Personas, Business Insider, Apr. 14, 2020,

[48] Id.

Last Updated: 12/30/2020