New Regulations on online access to and consultation of personal data held by the Civil Registry
The regulations put an end to the model of anonymous and unrestricted access which, for years, allowed anyone to obtain third parties’ personal data online.
There are four key changes for businesses:
- Mandatory registration and traceability: every enquiry requires a personal, non-transferable account held by a natural person of legal age with a verified identity, and is recorded in logs.
- Less visible data: the general search no longer displays children, parents’ names, or the identities of spouses or former spouses.
- Traceability: all enquiries made will be stored in a log which may be accessed by the data subject, upon request to the TSE.
- Exceptional differentiated access: access to extended information requires express authorisation from the Directorate-General for the Civil Register, with a specific purpose, timeframe and limits; for the private sector, this is assessed on a case-by-case basis and a public interest must be demonstrated.
Key recommendation: organisations that use the TSE’s enquiry service for identity verification, due diligence, debt collection, human resources or database enrichment must review these processes immediately.
What are the most significant changes? What are the main implications of these regulations for businesses? What adjustments need to be made soon?
>> Download the report at the bottom of this page.
How we can help you
ECIJA’s Data Protection team can assist you in assessing the processes that rely on TSE data queries, preparing requests for differentiated access, reviewing contracts with data providers, and updating policies and protocols in accordance with Law 8968.
Contact: Mauricio París – Partner | mparis@ecija.com
