The telecommunications sector in Spain is taking an important step toward self-regulation with the implementation of the new Code of Conduct. The AEPD and Autocontrol have launched a new mediation system, which took effect on December 17, to resolve data protection disputes within the sector through out-of-court settlement.
Greater representation of the sector, greater coverage for users
One of the main changes in the Code of Conduct is the expansion of its scope. The original operators that were part of the Protocol—Movistar, Orange, Vodafone, and MásMóvil, among others—are now joined by Euskaltel, Virgin Telco, R, and Telecable. This ensures greater representation of the sector, which directly benefits users by providing a common framework for resolving complaints related to data protection.
The Code also expands the types of cases covered under its scope of application. This means that more types of complaints can now be addressed through this mechanism, although those seeking financial compensation are expressly excluded. This approach reinforces the Code’s primary objective: to facilitate a swift, free, and effective resolution of issues related to privacy and data protection.
SELF-REGULATION: The Key Element in the Process of Promoting Swift and Flexible Agreements
To ensure impartiality, the Code designates the AUTOCONTROL Advertising Jury as the supervisory body. This independent third party is responsible for managing mediations between interested parties and participating operators.
Mediation typically lasts 30 days, but this period may be extended to up to three months if there are valid reasons. Although AUTOCONTROL’s proposed solutions are not binding, the agreement reached by both parties will be binding. In the event of a disagreement, the complainant may request that the complaint be referred to the AUTOCONTROL Panel, provided that the operator agrees.
A notable feature of the Code is its commitment to the confidentiality of proceedings, a crucial requirement given that many complaints may involve sensitive information. However, the Panel’s decisions are public, which brings transparency to the process and reinforces its credibility.
“Mediation, managed by an independent third party such as AUTOCONTROL, promotes swift and flexible agreements, although the non-binding nature of the proposed solutions may limit its effectiveness in certain cases. This is because, as is customary in any type of mediation, the proposed solutions offered by the mediator—in this case, the AUTOCONTROL Mediation Unit—are not binding. Only the agreement reached by the parties and the decision of the AUTOCONTROL Panel would be binding, should the parties voluntarily decide to submit the matter to the Panel,” Agustín Alguacil.
A system of penalties designed to act as a deterrent through referral to the Spanish Data Protection Agency (AEPD)
The Code reinforces its effectiveness through a system of penalties for noncompliant operators. Violations are classified as minor, serious, or very serious, and can result in penalties ranging from warnings to the temporary suspension of rights under the Code or even expulsion.
Although the sanctions do not include financial penalties, their deterrent effect lies in the reputational impact and in the referral of the decisions to the Spanish Data Protection Agency (AEPD). This mechanism complements the AEPD’s powers, ensuring that the self-regulatory system aligns with national and European regulations.
Overall, the Code of Conduct serves as an example of how the private sector can establish effective self-regulatory mechanisms, striking a balance between sectoral autonomy and the rights of stakeholders.
Agustín Alguacil, Associate, Legal Department. Business and Contracts