The first is to adapt the Spanish law from what is contained in the General Data Protection Regulation and "guarantee that the digital rights of the citizen conform with the mandate established in article 18.4 of the Constitution."

This title includes the regulation related to the inclusion and processing of data by credit reporting agencies, known popularly as "defaulter lists."

Through this same process, the creditor is required to inform the other party of what personal data might be given to the appropriate entities if they break their contract.

In reality, such data protection authorities only exist in the autonomous communities of Catalonia, Basque Country, and Andalusia.

The law refers to the General Data Protection Regulation with respect to the amount and level of responsibility for the punishments.

As an exception, the second paragraph of article 77 of the law provides that when the responsible violators are organizations with constitutional relevance or public administrations, they can only be penalized with a warning.

This rules out the possibility of economic punishments for these entities, as was the case with the previous Organic Law 15/1999 of December 13.

This could occur whenever such activities were carried out with “appropriate guarantees.” This was considered “protected by the public interest.” Similarly, it allowed political parties to “utilize personal data obtained on web pages and other publicly accessible sources to realize political activities during the electoral period” such as sending electoral propaganda electronically or through social media.

This article appeared to have protection in the Whereas Clause 56 of the General Data Protection Regulation which provides that “if, in the context of electoral activities, the functioning of the democratic system demands that in a member state that the political parties collect personal data about people's political opinion, the processing of this data can be authorized for reasons of public interest, as long as appropriate guarantees are offered.”[1] This provision caused deep concern in the legal sector because the aforementioned activities didn't require prior consent and apparently would allow the creation of databases of citizens on the basis of their political opinions.

[9][10][11] On May 22, 2019, the plenary session of the Constitutional Court upheld said appeal and declared the precept unconstitutional and null by a consensus of twelve members.