Spanish DPA Clarifies Legal Basis and Consent Rules for Legal Aid Data Processing

Key Takeaways

• The Spanish Data Protection Agency (AEPD) issued a legal opinion clarifying that bar associations and legal aid commissions may process family unit members' personal data based on legal obligation or public interest grounds under GDPR Article 6.1(c)/(e), rather than requiring individual consent from each family member.
• The opinion also invalidates opt-out consent mechanisms (unchecked boxes) used in Valencia's legal aid application forms, finding them non-compliant with GDPR's active consent requirements, which has direct implications for public bodies and professional associations administering benefits requiring family-based means testing.

Deep Dive

This AEPD legal opinion addresses data protection compliance within Spain's free legal aid administration process, specifically under Valencia's Decree 17/2017. The core issue is the legal basis for processing personal data belonging to family unit members (spouses, relatives) who have not personally signed consent forms, in the context of eligibility verification for legal aid benefits. The Agency concluded that such processing can be lawfully grounded in GDPR Article 6.1(c) (compliance with legal obligation) or 6.1(e) (public interest task/official authority), since the law itself mandates income assessment at the family unit level—removing the need to rely solely on consent, which is difficult to obtain from non-applicant family members.

A significant compliance finding is the Agency's rejection of "legitimate interest" (Article 6.1(f)) as a valid basis for public authorities, reaffirming GDPR Recital 47. This reinforces a broader supervisory stance that public sector bodies should default to legal obligation/public interest bases rather than legitimate interest when processing data in an official capacity—a distinction compliance teams in public-facing or publicly-regulated sectors must observe carefully.

The opinion also tackles practical evidentiary issues around the duty to inform data subjects (GDPR Articles 13/14, and Spain's former LOPD Article 5), confirming that information must be provided before data collection, but the method is flexible (no mandatory form), per precedent from the Spanish Supreme Court (2010). This gives organizations flexibility in demonstrating compliance through various means (written, verbal, telematic) provided they can evidence that notice was effectively given.

Most notably for consent management practices, the AEPD explicitly disapproved of the Valencia application forms' design, where leaving a checkbox unmarked was interpreted as granting consent for bar associations to access the applicant's data in administrative registries. The Agency firmly stated this violates GDPR Article 4(11) and Recital 32, which prohibit inferring consent from silence, pre-ticked boxes, or inactivity. Compliance teams responsible for consent-based data collection forms—particularly in public administration, healthcare, or benefits programs—should review form designs to ensure consent mechanisms require clear, affirmative action rather than defaulting to an opt-out structure.

Finally, the opinion confirms that bar associations and legal aid commissions operate as joint data controllers (GDPR Article 26), each bearing independent accountability obligations. Compliance and legal teams supporting similar joint-controller arrangements should ensure that controller responsibilities, consent record-keeping, and legal basis determinations are clearly documented and apportioned, particularly where multiple entities handle overlapping data processing activities in regulated or publicly funded programs.

Source: Spanish Data Protection Agency (Agencia Española de Protección de Datos)