It’s moving day at the Spanish Data Protection Agency (AEPD in its Spanish abbreviation), as Mar España’s mandate as director, having been appointed in July 2015, is about to end. For this reason, Ana Caballero, Vice President of the European Association for Digital Transition, interviewed España, a top public official who has also worked in the Ombudsman’s Office and the Women’s Institute.
In a period stretching over seven years – almost three years longer than planned – Mar España and the team at the Agency have had to face all types of challenges, but the main one has certainly been application of the General Data Protection Regulation (GDPR), approved in 2016. As the still director of the AEPD explained – her replacement is expected in a matter of days – the regulation posed a fundamental difference from previous legislation: it established privacy by default and from design, as opposed to the reactive approaches previously in force.
It turned out to be a small revolution. The director of the AEPD recalled how, in May 2018, when the regulation was applied in Spain, “citizens thought they would go crazy with all the companies that asked them for consent. But in spite of all those difficulties, Europeans should feel proud we live on the continent that most respects privacy”. This respect for privacy is perfectly compatible with the Agency’s support for the Spanish digital economy being competitive, as España emphasized.
The importance of privacy
In the conversation between Caballero and España, the importance of privacy became clear, stressing the need to act in cases of cyberbullying and digital violence. In this regard, one of the most important initiatives the AEPD has developed in recent years is the creation of the Priority Channel, a way to request from the Agency the urgent removal of sexual or violent content published on the Internet without consent.
With this as the instigator, the AEPD got commitments from social media and Google. Now, when complaints of violent or sexual content being disseminated reach this Priority Channel, in less than 24 hours the case is analysed and the content that attacks individual rights and freedoms is removed. “We are achieving in 90% of these cases that removal of this content is a matter of hours”, España explained.
Beyond its work with sanctions, the AEPD is also involved in advocacy, accompaniment and training, so that the entire socio-economic network is made aware of and acts responsibly in matters of data protection. “We are known more for our sanctions, unfortunately, but this work to raise awareness is just as important, if not more. We have more than 80 guides and tools available to the society”, stressed España.
When it comes to taking stock, España makes it clear that the Agency needs more economic and human resources, like what equivalent organisations in other EU countries have; that will be “the big challenge” for those who come next. Of all the initiatives during these years, she chooses the Priority Channel, “because it can save lives”. And she stresses the importance of privacy, a citizens’ right that, like security, is only valued when it is lost.
