The renewal of the Spanish Data Protection Agency opens a new front with Brussels

The renewal process of the Spanish Data Protection Agency (AEDP) threatens to open a new front with Brussels. The EC has already called Spain's attention to the legal reform proposed by the Government to renew the Judiciary without the votes of the PP and, once that reform was discarded, it has urged to unblock the body as soon as possible. The General Council of the Judiciary (CGPJ) was left out of the agreement that the PSOE and PP announced on October 21 to renew several bodies that had expired for some time, such as the Constitutional Court and the Accounts Court.

The Spanish Data Protection Agency (AEPD) did enter that package, which would go on to have a president, Belén Cardona -at the Labor Law and current undersecretary of Justice, Interior and Public Administration of the Valencian Generalitat- proposed by the Socialists , and a deputy president, Borja Adsuara -a lawyer and consultant in digital law- at popular initiative. But the dissemination of those names occurred before the official renewal procedure began, which includes a public call for candidates. That call was not published until November 18. Brussels was suspicious of the procedure and the European Data Protection Supervisor, Wojciech Wiewiórowski,assures EL PAÍS that the EU does not rule out intervening in the event that the candidates agreed by the PSOE and PP are finally elected.

"I cannot comment on national issues, but I will tell you that I was surprised to learn that it had been decided who would replace the current leadership, because as I understand a rigorous selection procedure must be followed," says Wiewiórowski. “I am happy to know that this process has already started and is continuing. Political influence on data protection authorities has increased in some countries in recent years. And that is usually extremely dangerous ”, adds the Eurobureaucrat.

What will Brussels do if the agreement of the two major parties is imposed on the leadership of the AEPD?

“The EU institutions may take action if the transparent merit-based process provided by the General Data Protection Regulation (GDPR) is not respected.

The data protection authorities should be totally independent from any type of political interference ”, respond from Wiewiórowski's cabinet.

Wojciech Wiewiórowski, European Data Protection Supervisor (EDPS), during an official visit to Madrid Santi Burgos

The current director of the Spanish agency, Mar España Martí, who has been in office since 2015, was appointed by the Government of Mariano Rajoy. He exhausted his four-year term in 2019, but the AEPD has been one of many institutions whose renewal has been paralyzed due to the lack of agreement between the main parties. Until now, the election of the presidency of the Spanish agency was totally discretionary. But the organic law on Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) established in 2018 a new procedure adapted to European guidelines that divides the position of director into that of president and deputy president. And, although his appointment remains the responsibility of the Council of Ministers at the proposal of the Minister of Justice, it must now be ratified in the Justice Commission of Congress,after hearing the candidates, by a three-fifths majority in the first vote or by an absolute majority in the second.

But the aspect that has generated the most stir has been the introduction of a public call for applicants for the position. The Executive retains the power to propose to Congress the names of the president and his deputy, but the proposal must be made "after evaluation of the merit, capacity, competence and suitability of the candidates" by a selection committee chaired by the Secretary of State. of Justice.

The Statute of the Spanish Data Protection Agency, approved last June, gives a feeling of meritocracy to the process, although in practice it is still controlled by the Government, which is the one who proposes the candidates, and is subject to the agreement of the major political forces: “Once the applications for participation in the selection procedure have been assessed, the selection committee will propose a candidacy to the Presidency of the Spanish Data Protection Agency and to the Deputy Office of the Presidency from among those that meet the established requirements ( ...) and having taken care of the merits and evaluation criteria established in the call ”. The proposal leaves the Ministry of Justice, goes to the Council of Ministers and from there, to Congress.

The admission process was closed last week and this Tuesday the list of admitted candidates was published. Now it is the turn of the selection committee to certify or not that the candidates meet the requirements to apply for the position. Justice sources assure for their part that this department has been on the sidelines of the negotiation of the names between PSOE and PP and they defend that the procedure has been opened in accordance with legality and that it will be resolved with transparency.

The matter has reached the highest European institutions. The Spanish MEP Maite Pagazaurtundúa, an independent member of the European Citizens delegation, asked the Commissioner for Justice, Didier Reynders, if he would intervene in the face of what he considered a “violation of European and Spanish data protection regulations”. The answer was that “the“ Member States are obliged to provide that each member of their supervisory authorities be appointed ”, although it recognizes that the Community regulations do not specify“ the modalities of preselection of candidates ”. In any case, it will be the Spanish courts that must decide if there is any irregularity. However, the fact that the commissioner responded in just six weeks suggests that this is a matter of interest in Brussels.

Wiewiórowski's statements to EL PAÍS are more direct.

The office of this Polish jurist enjoys independence within the complex European institutional framework, but lacks executive powers.

However, his opinion is widely listened to both by the Commission and by the Council and Parliament itself.

Citizens enters the scene

The European Data Protection Supervisor (EDPS) follows the election of the new leadership of the AEPD with special interest because the director of the EDPS, Wiewiórowski's number two, is the Spanish Leonardo Cervera-Navas, an official with a long history in Brussels, where he has worked for two decades on data protection matters. His was one of the 15 candidates presented for the presidency or deputy presidency of the AEPD. According to sources familiar with the process, the concurrence of Cervera-Navas in the process has been supported and promoted by Edmundo Bal, deputy secretary general for Citizens and state attorney.

Last week, the Hay Derecho Foundation presented an appeal to the Ministry of Justice requesting the annulment of the ministerial order by which the selective process for the appointment of the two management positions of the AEPD is convened, considering that "the bases of the process selective commit various irregularities ".

According to legal sources, the appeal is short-lived as the aforementioned foundation does not attend the process.

You can follow EL PAÍS TECNOLOGÍA on