
Illegal Recordings and Hidden Cameras (Art. 197.1 CP)
Criminal defence against the non-consensual capture or recording of another person's private images or sound (hidden cameras in homes, changing rooms, bathrooms or bedrooms), punishable under art. 197.1 CP with 1 to 4 years' imprisonment and a fine.
Last updated:
Article 197.1 of the Spanish Criminal Code punishes anyone who, in order to discover the secrets or breach the privacy of another, without their consent, seizes their papers, letters, e-mail messages or any other personal documents or effects, intercepts their telecommunications or uses technical devices for listening to, transmitting, recording or reproducing sound or images, or any other communication signal. The penalty is imprisonment of one to four years and a fine of twelve to twenty-four months. This is the reference offence for cases of hidden cameras and clandestine recordings that invade a person's private sphere.
What conduct art. 197.1 CP punishes
The form of capture relevant here is the installation or use of technical devices (cameras, microphones, hidden recorders, spy devices) to obtain images or sound of another person's privacy without consent. The most frequent scenarios are hidden cameras inside homes, in changing rooms, bathrooms, fitting rooms or bedrooms, as well as recorders aimed at capturing other people's private conversations. The protected legal interest is personal privacy recognised in art. 18 of the Constitution, so the offence is committed by the mere act of capture, without the image or sound needing to be disseminated or made known to third parties.
Not every recording is criminal. Case law requires the conduct to affect the core of privacy and to be carried out in a surreptitious or clandestine manner. Recording in a public or semi-public space, where there is no reasonable expectation of privacy, falls in principle outside the offence. The boundary, however, is case-specific: what matters is the location, the private nature of what was captured and the absence of the affected person's consent.
The key distinction: recording your own conversation is not punishable
One of the issues that causes the most confusion is the recording of a conversation in which one personally takes part. Under the doctrine of the Constitutional Court and the Supreme Court, anyone who records their own conversation does not commit the offence under art. 197.1 CP, because they do not seize another's secret nor intercept a third party's communication: they merely document what is communicated to them. Such a recording is, as a general rule, not punishable and may even be used as evidence. It is a different matter to intercept or record conversations between third parties in which the author does not take part, or to covertly capture the intimate image of another person: that does fall squarely within the offence.
This distinction is decisive in practice. In many matters —family, workplace or relationship conflicts— a person records their own conversation to prove threats, coercion or abuse, and that conduct is not punishable. The defence or the prosecution must precisely analyse who took part in the communication, what was captured and in what space.
Penalties and aggravating factors
The basic offence under art. 197.1 CP carries 1 to 4 years' imprisonment and a fine of 12 to 24 months. Where the captured data or images are disseminated, revealed or transferred to third parties, art. 197.3 CP imposes imprisonment of 2 to 5 years; and the third party who, aware of its unlawful origin and without having taken part in its discovery, disseminates it faces 1 to 3 years' imprisonment and a fine of 12 to 24 months. Additional aggravating factors apply where the facts affect sensitive personal data (health, ideology, sexual orientation), where the victim is a minor or a person with a disability in need of special protection, or where the facts are carried out for profit. In those cases under art. 197.4 CP the penalty is imposed in its upper half.
This offence should be distinguished from the non-consensual dissemination of intimate images obtained with consent (so-called sexting or revenge porn under art. 197.7 CP), from deepfakes and AI image manipulation, and from cases of harassment or stalking, which respond to their own criminal provisions. The privacy offences page offers an overview of these figures.
How we approach the defence
The defence against a charge under art. 197.1 CP is built on two pillars. The first is the specific intrusion into privacy: not every capture invades the protected core, and the non-punishable nature of recording one's own conversation, the absence of an expectation of privacy or the consent of the affected person may exclude the offence. The second is the lawfulness and validity of the evidence: how the recordings were obtained, their chain of custody and any breach of fundamental rights determine whether they can be considered at trial. At the firm we analyse each element of the offence, the expert evidence on the devices and the context, and design the most appropriate strategy, whether you are under investigation or you are a victim wishing to act as a private prosecutor. You can consult us on 91 078 65 74 or at our office at Velázquez 27, Madrid.
Penalties & Consequences: Illegal Recordings and Hidden Cameras (Art. 197.1 CP)
| Type / Scenario | Criminal Penalty |
|---|---|
| Basic offence | 1 to 4 years' imprisonment and a fine of 12 to 24 months for capturing or recording another person's private images or sound without consent (art. 197.1 CP). |
| Dissemination of what was captured | Disseminating, revealing or transferring it to third parties raises the penalty to 2 to 5 years' imprisonment (art. 197.3 CP); a third party who disseminates it aware of its unlawful origin faces 1 to 3 years' imprisonment and a fine of 12 to 24 months. |
| Aggravating factors | Penalty in its upper half where it affects sensitive data, minors or persons with a disability in need of special protection, or where it is carried out for profit (art. 197.4 CP). |
* Penalties shown are indicative. The actual penalty depends on case circumstances, applicable mitigating and aggravating factors.
Defense Strategy: Illegal Recordings and Hidden Cameras (Art. 197.1 CP)
Analysis of the real intrusion into privacy
We examine whether the capture reaches the core protected by art. 18 of the Constitution (home, changing room, bathroom, bedroom) or occurred in a space without a reasonable expectation of privacy, which may exclude the offence.
Scrutiny of the lawfulness of the evidence
We study how the recordings were obtained, the chain of custody and any breach of fundamental rights, to argue the nullity or inadmissibility of the material at trial.
Own recording vs. capturing another's privacy
We establish who took part in the communication and what was captured, to invoke the non-punishable nature of recording one's own conversation as opposed to intercepting third parties' communications.
Cybercrime in Spain: Hacking, Phishing & Digital Fraud — Defence Guide
Cybercrime encompasses illegal access to computer systems (Art. 197 bis CP), computer damage and ransomware (Art. 264 CP), phishing and digital fraud (Art. 249.1.a CP), and the production or distribution of hacking tools (Art. 197 ter). Spain's prosecution of cybercrime has intensified dramatically, with specialised units in the National Police (BIT) and Guardia Civil (GDT) leading investigations. Defence requires a unique combination of criminal law expertise and advanced technical knowledge.
Penalty Table: Cybercrime
| Offence | Article | Description | Penalty |
|---|---|---|---|
| Illegal access to systems | Art. 197 bis | Unauthorised access breaching security measures | 6 months – 2 years |
| Interception of data | Art. 197 bis.2 | Intercepting non-public data transmissions | 3 months – 2 years |
| Production/supply of hacking tools | Art. 197 ter | Creating or distributing tools designed for cybercrime | 6 months – 2 years |
| Computer damage (basic) | Art. 264.1 | Deleting, damaging or making data inaccessible | 6 months – 3 years |
| Aggravated damage (critical infrastructure) | Art. 264.2 | Affecting essential services or critical infrastructure | 2 – 5 years prison |
| Cyber fraud (phishing) | Art. 249.1.a | IT manipulation to obtain unlawful transfer of assets | 6 months – 3 years |
Key Defence Strategies
IP Attribution Challenge
An IP address does not identify a person. Shared Wi-Fi networks, VPNs, Tor exit nodes and NAT configurations mean multiple users may share one IP. The prosecution must prove the accused was the actual user at the relevant time.
Chain of Digital Custody
Digital evidence is extremely fragile. If the police failed to image the hard drive with a write-blocker, if hash values don't match, or if evidence was handled improperly, the defence can seek exclusion of the entire digital evidence chain.
Authorised Security Testing
Ethical hacking and penetration testing carried out with the system owner's authorisation is legal. If the defendant had a written engagement contract, bug bounty agreement or responsible disclosure policy, there is no criminal offence.
Lack of 'Breaching Security Measures'
Art. 197 bis requires that security measures were breached. If the system had no password, no firewall, or the access point was public, the element of 'breaching security' may be absent, negating the offence.
Key Case Law
The Supreme Court confirmed that 'access' requires effectively entering the system, not merely attempting it. The prosecution must prove: (1) access occurred, (2) it was unauthorised, and (3) security measures were breached. Port scanning alone does not constitute the offence.
The Court ruled that ransomware attacks may constitute a concurrent offence of computer damage (Art. 264) and extortion (Art. 243 CP). The encryption of data satisfies the 'damage' element even if data is technically recoverable upon payment.
In phishing operations, the Court distinguished between the organiser and the 'money mule' (account holder). The mule's liability depends on proof of knowledge that the funds were illicit. Wilful blindness may suffice, but mere negligence does not.
Why Choose Us?
Need a criminal defense lawyer for this type of offense? Here's how we work:
Do you need specialised legal assistance?
The judicial system is complex. We have the criminal-law specialisation and technical resources required to take on the defence.