You have probably learned how to create a blog and want to earn income online through information technology. But have you asked yourself whether you comply with the laws that govern a blog? In this respect, it is worth remembering that in Spain there are rules setting out legal requirements to protect users. Likewise, there are penalties for those who fail to comply with these regulations.
At BBMabogados we are experts in regulations in the online world, which is why we have prepared an analysis so that you can comply with the LOPD and LSSI rules and avoid being penalised.
What is the LOPD?
The Spanish Organic Law on the Protection of Personal Data (15/1999 of 13 December) guarantees the protection of users’ personal data in order to prevent harm to their intimacy, honour, and personal and family privacy. This requires individuals and public or private institutions holding such data to take security measures and comply with certain requirements.
This law also applies to those who manage personal data and files in digital format, establishing rights for users and duties for those who create or manage them.
At the same time, even if you are not aware of it, you most likely have to comply with these regulations, because you will be collecting your clients’ data whenever you have access to their email address when they leave a comment, subscribe, or use a contact form, among other cases.
How to comply with the data protection law?
The first thing to bear in mind is that the degree of protection depends on the type of data you manage. This determines the security measures required by law. For example, if you handle data relating to ideological leaning, religion, sexual preferences, or data for policing purposes, the level of protection will be high.
By contrast, if it is only sets of data about personality, financial services, or administrative or criminal offences, a medium level applies.
For the rest of the data, the basic level is sufficient.
Once you have checked this, you must go to the Spanish Data Protection Agency (AEPD) website to register the files according to the groups of data you manage (subscribers, clients, suppliers, etc.).
Privacy policy
Once you know the level of protection (usually the basic one) and have registered the files, you need to include a text informing about your privacy policy, that is, how you store and handle the data, for example, if you use Facebook Ads as a lead-generation service or the email platform you use for marketing.
European regulations also require the express consent of users, which you can obtain through a check box when data is collected, linked to the information about the privacy policy.
“At BBM Abogados we defend the interests of individuals and businesses in Santander and Cantabria with a close, rigorous and fully transparent approach. If you have doubts about your case, we help you see it clearly.”
Other essential documents
As the party responsible for your clients’ data, you must sign a confidentiality agreement with any third parties who access this information, for example, your webmaster or hosting provider.
Finally, you must have the Security Document required by the AEPD, as it will be requested from you in the event of a complaint. You can draw it up using the template created by the institution itself. It is like an internal procedures manual on how to protect the data on your blog.
And what does the LSSI require?
The Law on Information Society Services and Electronic Commerce (Law 34/2002) regulates economic activities carried out online. Consequently, it must be complied with by all natural or legal persons who carry out these activities. In other words, if you have a blog or website through which you sell products and services or earn advertising income, operating from Spain, you are subject to this law.
If we want to stay up to date with this legislation, we will need to include on our blog a Legal Notice and a Cookie Policy.
Legal notice
In this text you must fully identify yourself (company registration details, ID number) and provide contact information (email address, address). In addition, if you carry out a regulated professional activity or one subject to administrative authorisation, you must state this and provide the details of your respective certification.
You must also set out the rules on intellectual property of your content and the general terms and conditions of contract. It is vitally important to detail the latter as thoroughly as possible, since it will govern your contractual relationship with the client.
At the same time, it is worth remembering that the legal notice must be in a visible place and it is advisable to link it to the general terms and conditions of contract with a check box that ensures express consent before the transaction is completed.
Cookie policy
Cookies are files that collect information about the consumer, which is why the law requires you to tell them which ones are used, and they must accept their installation.
You can display this information through a pop-up window when the activity on your blog begins and link it to the legal text in which you tell the user what cookies are, which ones you download, and how to disable them.
Still not convinced about legalising your blog?
In that case, consider that, in addition to it being very easy to make the changes that allow you to comply with the law, you will avoid penalties that can reach hundreds of thousands of euros. In any case, do not hesitate to contact us if you want more information about the regulations and penalties in place.