
Breach of Professional Secrecy Lawyer (Art. 199 CP)
Criminal defence for disclosing another person's secrets known through one's office, employment relationship or a profession bound by a duty of confidentiality.
Article 199.1 of the Spanish Criminal Code (CP) punishes anyone who discloses another person's secrets lawfully known by reason of their trade or employment relationship with imprisonment of 1 to 3 years and a fine of 6 to 12 months; when the duty of confidentiality is breached by a professional bound by a specific duty of secrecy —a doctor, lawyer, psychologist, notary— the aggravated offence under Art. 199.2 CP raises the penalty to imprisonment of 1 to 4 years, a fine of 12 to 24 months, and special disqualification from that profession for 2 to 6 years. The offence requires a genuine secret belonging to another person that was lawfully known and a deliberate act of disclosure to unauthorised persons, and it is only prosecutable upon a complaint filed by the aggrieved party under Art. 201 CP. Not every breach of professional ethics reaches criminal relevance: many such cases remain within the professional body's disciplinary sphere when intent is lacking, the information was not strictly secret, or a justification applies, such as a state of necessity or compliance with a legal duty to report. At Alonso Sala we defend professionals, employees, and companies by examining this boundary between professional ethics and criminal law.
Breach of professional secrecy is defined in Article 199 of the Spanish Criminal Code, among the offences of discovery and disclosure of secrets that protect the personal and family privacy recognised in Article 18 of the Constitution. Unlike the unlawful access to communications or data (discovery and disclosure of secrets under Art. 197 CP), here the secret is not obtained unlawfully: it is known lawfully through one's office, employment relationship or professional practice, and the criminal conduct is to improperly divulge or disclose it. As criminal lawyers specialising in privacy offences in Madrid, we build the technical defence of professionals, employees and companies facing these charges.
Legal Framework: Article 199 CP
The provision contains two clearly distinct forms:
- Art. 199.1 CP (basic offence): punishes anyone who discloses another person's secrets known by reason of their office or employment relations. The penalty is imprisonment of one to three years and a fine of six to twelve months. It covers employees, workers and service providers who, without being registered professionals subject to confidentiality, access another's confidential information through their position.
- Art. 199.2 CP (aggravated offence): punishes the professional who, in breach of their duty of confidentiality or reserve, divulges another person's secrets. The penalty is imprisonment of one to four years, a fine of twelve to twenty-four months and special disqualification from that profession for two to six years. This is the case of the doctor, lawyer, psychologist, notary, journalist, adviser or any professional bound by a specific duty of reserve.
The greater severity of 199.2 is justified by the qualified trust the victim places in the professional and by the duty of confidentiality imposed by the relevant professional and ethical rules (medical confidentiality, the lawyer's professional secrecy under Art. 542.3 of the Judiciary Act, etc.). Special disqualification is a particularly damaging consequence, as it prevents the practice of the profession for years.
Criminal Conduct and Protected Interest
The offence requires three elements: (1) the existence of a genuine secret belonging to another —reserved information, neither public nor common knowledge, affecting a third party's private sphere—; (2) that the person knows it lawfully through their office, employment relationship or profession; and (3) an act of disclosure or divulgation to unauthorised persons, carried out with intent. Mere negligence in safekeeping is not punished, but the conscious disclosure is. Nor does any data suffice: it must be reserved information whose dissemination harms or may harm its holder.
Distinction from the Ethical Duty
A central key to the defence is distinguishing the ethical (deontological) breach from the criminal offence. Professional secrecy has a professional-body and disciplinary dimension (sanctions by the relevant professional association) and a criminal dimension (Art. 199 CP). Not every breach of the duty of reserve reaches criminal relevance: many forms of conduct remain in the disciplinary sphere without amounting to the offence, particularly where intent is lacking, where the information was not strictly secret, or where a ground of justification applies. Identifying this boundary is decisive to avoid a criminal conviction and, with it, disqualification.
Defence Strategies
The defence may rest, depending on the case, on: consent of the holder of the secret, express or implied, which excludes the offence; absence of a secret nature of the information (data already public, common knowledge or known to third parties); lack of intent to disclose (inadvertent divulgation, error as to the reserved nature); necessity or performance of a duty (for instance, the legal obligation to report certain crimes, the communication to health or judicial authorities, or the prevention of a serious and imminent harm); and the existence of a prevailing legitimate interest justifying the communication. The procedural requirement is also essential: under Article 201 CP, the offence is only prosecutable upon a complaint by the aggrieved party or their legal representative, so the absence of a valid complaint bars the proceedings.
Criminal Consequences
The basic offence under 199.1 carries imprisonment of 1 to 3 years and a fine of 6 to 12 months. The aggravated offence under 199.2 raises the penalty to imprisonment of 1 to 4 years, a fine of 12 to 24 months and special disqualification from the profession for 2 to 6 years. Alongside the penalty, civil liability for the harm caused to the victim may be declared. The defence focuses on avoiding conviction or, alternatively, on the most favourable sentencing and on the suspension of imprisonment where the legal requirements are met.
We act before the Investigating Courts, the Criminal Courts and the Provincial Courts throughout Spain. For a confidential assessment of your case, you may contact our firm at Velázquez 27, Madrid, or by phone at 91 078 65 74.
Penalties & Consequences
| Type / Scenario | Criminal Penalty |
|---|---|
| Imprisonment | 1-3 years (Art. 199.1) or 1-4 years in the aggravated offence of the professional bound by confidentiality (Art. 199.2). |
| Fine | 6-12 months (199.1) or 12-24 months (199.2), set by daily quotas according to financial capacity. |
| Disqualification | Special disqualification from the profession for 2 to 6 years in the aggravated offence under Art. 199.2 CP. |
* Penalties shown are indicative. The actual penalty depends on case circumstances, applicable mitigating and aggravating factors.
Our Defense Strategy
Criminal/Ethical Distinction
We assess whether the conduct reaches criminal relevance or remains within the professional body's disciplinary sphere, avoiding conviction under Art. 199 CP.
Lack of Offence
We establish the holder's consent, the absence of a secret nature of the information, or the lack of intent to disclose.
Procedural Requirement
We verify the existence and validity of the prior complaint by the aggrieved party required under Art. 201 CP.
Privacy Crimes in Spain: Discovery & Disclosure of Secrets — Defence Guide
Privacy crimes — discovery and disclosure of secrets (Art. 197 CP), illegal access to computer systems (Art. 197 bis), and non-consensual image sharing (Art. 197.7) — are among the fastest-growing offences in Spain. The digital environment has made private communications, intimate images and personal data especially vulnerable. These offences carry prison sentences of up to 5 years and require specialised technical defence combining legal expertise with digital forensics.
Penalty Table: Privacy Crimes
| Offence | Article | Description | Penalty |
|---|---|---|---|
| Discovery of secrets (basic) | Art. 197.1 | Seizing letters, emails, or intercepting telecommunications | 1 – 4 years prison |
| Disclosure to third parties | Art. 197.3 | Revealing or transferring discovered secrets | 2 – 5 years prison |
| Sensitive data (health, sexuality, ideology) | Art. 197.5 | Discovery/disclosure involving specially protected data | 3 – 5 years prison |
| Illegal access to computer systems | Art. 197 bis | Unauthorised access breaching security measures | 6 months – 2 years |
| Non-consensual image sharing (sexting) | Art. 197.7 | Sharing intimate images obtained with consent | 3 months – 1 year |
| Professional perpetrator | Art. 197.4 | Crime committed by person in charge of data files | Upper half + disqualification |
Key Defence Strategies
Consent Defence
If the victim gave express consent to access their communications or devices, the crime is excluded. The defence must prove that consent was freely given, specific and not obtained through deception.
Fruit of the Poisonous Tree
If the prosecution's evidence was obtained through illegal means (hacked WhatsApp, unauthorised wiretap), it is inadmissible under Art. 11.1 LOPJ. Challenging the chain of custody is critical.
Lack of Criminal Intent (Dolo)
If the access was accidental or by mistake (opening someone else's email by confusion, finding an unlocked phone), there is no criminal intent. The prosecution must prove the accused acted knowingly.
Whistleblowing Protection
EU Whistleblowing Directive (2019/1937) protects employees who report illegal activity through proper channels. Revealing secrets to expose crime may be justified, though procedure matters.
IP Attribution Challenge
An IP address alone may not identify the perpetrator. Shared connections (Wi-Fi, VPN, corporate networks) create reasonable doubt about who actually accessed the data.
Statute of Limitations
Basic privacy crimes prescribe in 5 years. Digital evidence is volatile — logs, IPs and server records may be deleted. Early action by both prosecution and defence is essential.
Key Case Law
The Supreme Court confirmed that accessing a partner's unlocked phone constitutes the crime of Art. 197.1 CP. The absence of a password does not imply consent. Privacy is presumed regardless of security measures.
Following the European Court of Human Rights case law on employer monitoring of employee communications, the Court ruled that such monitoring requires prior, clear policy notification. Without it, evidence is inadmissible and the employer may face criminal liability.
Clarified that Art. 197.7 requires images obtained WITH victim's consent (within a relationship) and shared WITHOUT consent. Images obtained covertly constitute a different offence (Art. 197.1).
Why Choose Us?
Need a criminal defense lawyer for this type of offense? Here's how we work:
Need urgent criminal defence?
Contact our specialist criminal defence lawyers. We evaluate your case confidentially.
Tools for your case
We also serve
View all locations →This page is for information purposes only and does not constitute legal advice: every case requires individual assessment. How this content is produced and verified: editorial policy.
Do you need specialised legal assistance?
The judicial system is complex. We have the criminal-law specialisation and technical resources required to take on the defence.