Adela Gomez
Marco Latora

On Friday 31^st of March, with the Royal Decree 13/2012, the Spanish Government transposed the Directives 2009/136/EC, 2009/140/EC and 2002/20/EC on a common regulatory framework for networks and electronic communications services, access to electronic communications networks and associated facilities, its interconnection on the authorisation of networks and electronic communications services (the transposition period expired on May 25, 2011).

The transposition of these Directives completes the incorporation into Spanish law of the new European regulatory framework on electronic communications. According to the words of the Spanish Government, “the amendments seek to create a framework for making investments in the deployment of next generation networks, enabling to offer innovative and more technologically services appropriate for the needs of citizens. It introduces important innovations with regard to the rights of operators and in the field of data protection is a decisive bid to achieve higher levels of security.”

This decree is a significant modification of the current General Telecommunications Law 32/2003, dated November 3, and Law 34/2002 of 11 July on the services of information society and electronic commerce, as regard to electronic business communications.

Regarding changes in the Law 32/2003, the most important issues, among several new theoretical objectives and principles, include:

• The obligation for operators to properly manage the security risks that could affect their networks, attributing to the Ministry of Industry, Energy and Tourism supervisory powers on the information obligations, incident reporting and auditing.
   
• With regards to the users’ rights, it has introduced the right to change the operator with the number portability within one working day also with the improved obligation to provide them complete information.
   
• Regarding data protection, modifications have been directed to grant greater levels of security to guarantee fair processing of personal data by the operators.
   
• Operators with significant market power will be also obliged to maintain a functional separation of network assets and wholesale provision of access products.

As regards the amendments to the third title of the Law 34/2002, we highlight changes occurring in the legislation on e-mail marketing and in particular:

• The inability to hide the identity of the sender of commercial communication. Campaigns concealing the identity of the real sender are prohibited.
   
• The prohibition of email marketing campaigns that encourage consumers to visit web sites, and are made without complying with the requirements of consent or identification, being classed as "advertising."
   
• The obligation to include a valid email address in the campaigns. Email marketing campaigns from email accounts that do not allow a direct response are prohibited, such as those that contain the "no-reply" formula (unless they provide a valid e-mail address within the campaign).
   
• The power granted to providers of electronic communications services to bring actions for injunctions to protect its legitimate business interests, or the interests of their clients, each time they detect behaviour which does not comply with the prohibition of commercial communications or infringes the rights of the addresses of those services.

Moreover, the new wording of Article 22.2 now contains the obligation to require user consent before the start of files or programs (“cookies”) that store information. Introducing conformity in the use of devices that facilitate navigation through the network but whose use might breach the privacy of users, ensuring users are properly informed and have mechanisms that allow them to preserve their privacy.

Having said this, we should mention that, as stated in the last paragraph of the Article 22, the above will not hinder the possible technical storage or access with the sole purpose of carrying out the transmission of a communication through an electronic communications network, or if it is strictly necessary to provide an information society service that was expressly requested by the recipient.

Unfortunately still no mention is made about any obligation regarding advertising on social networks, an area in which the expansion of this type of communication is growing and which would require further regularisation, especially due to the fact that the potential audience is getting younger.