Spanish DPA Backs Navarre Electronic Judicial Office Bill, Suggests Adding Regulator Links

Key Takeaways

• The Spanish Data Protection Agency (AEPD) issued a favorable opinion on a bill creating the Electronic Judicial Office of Navarre, which implements Law 18/2011 on information technology use in the administration of justice.
• The AEPD recommends considering links to its own Electronic Office and to that of the General Council of the Judiciary, reflecting the division of supervisory competences over data protection.
• Compliance teams should note the emphasis on applying personal data security measures to information processed through judicial electronic portals.

Deep Dive

The report (N/REF 311919/2016) responds to a request for the AEPD's opinion on a draft regulation establishing the Electronic Judicial Office of Navarre. The office would serve Judicial Offices, Tax Offices, and other justice administration services in Navarre. Ownership would rest with the Government of Navarre department responsible for Justice, and technological management with the Directorate General of Justice. The bill follows the structure of Law 18/2011 (Articles 9.2 and 11), which sets the creation requirements and minimum content of electronic judicial offices. Note that the document is dated 2026 in the feed metadata, but its reference number (2016) suggests it is a 2016 opinion, so its currency should be verified before reliance.

The AEPD's key observations are twofold. First, Article 5(1)(g) of the bill requires the office to include "information on the protection of personal data." The AEPD suggests considering adding links to its own Electronic Office and to the General Council of the Judiciary's headquarters, given the split in supervisory authority over data protection compliance in the judicial sphere. Second, Article 7 sets governing principles (publicity, responsibility, quality, security, availability, accessibility, neutrality, interoperability) and requires confidentiality, availability, and integrity of information. Article 7(2) expressly requires application of the security measures in current data protection regulations to personal data collected or processed through the office.

The AEPD notes that personal data will be processed through the office, for example when citizens submit complaints or suggestions, or when edicts must be published under Article 11 of Law 18/2011. This confirms that data protection obligations apply to e-justice platforms, including purpose limitation, security, and transparency. No implementation deadlines are stated. The opinion is favorable and does not impose binding changes, although the link suggestion is a non-binding recommendation.

For compliance professionals, direct impact on financial institutions is limited. The report is relevant to those interacting with Spanish judicial electronic services, such as filing, receiving notices, or submitting data in proceedings, and as a reference for how the AEPD approaches public sector portals. Recommended actions include: confirming the document's date and status; mapping personal data flows involving Spanish e-justice channels; verifying that internal security controls meet applicable data protection standards (now GDPR and Spanish implementing law, rather than the earlier regime referenced); and monitoring the final Navarre regulation. Overall risk is low, with modest operational and privacy implications.

Source: Spanish Data Protection Agency (Agencia Española de Protección de Datos)