Full text
Text in force since 7 October 2022.
The text below is the official Spanish wording of this provision; the summary and guidance above are in English.
TÍTULO X — Delitos contra la intimidad, el derecho a la propia imagen y la inviolabilidad del domicilio
Text in force since 7 October 2022.
The text below is the official Spanish wording of this provision; the summary and guidance above are in English.
In-depth analysis
Article 197 of the Criminal Code: disclosure of secrets — penalties, case law and defence strategyOur firm’s monographic guide to this provision, with typical scenarios and lines of defence.
History of reforms to this article, from oldest to most recent, as recorded in the BOE’s consolidated legislation.
Ley Orgánica 10/1995, de 23 de noviembre, del Código Penal.
In force from 24/05/1996 to 22/12/2010
In force from 23/12/2010 to 29/01/2011
In force from 30/01/2011 to 30/06/2015
In force from 01/07/2015 to 06/10/2022
Article 197 opens the chapter on discovery and disclosure of secrets and protects a twofold interest: the personal and family privacy recognised in Article 18 of the Spanish Constitution, and each person's control over their own data. What is punished is not financial loss or the later use of the information, but the intrusion into a private sphere itself.
Paragraph 1 sets out the core conduct: anyone who, in order to discover another person's secrets or breach their privacy, and without their consent, takes their papers, letters, emails or any other documents or personal effects, intercepts their telecommunications, or uses technical devices for listening to, transmitting, recording or reproducing sound or images. It is an offence of tendency: it is complete once the taking or the interception occurs, even if the offender never reads or learns the content. Paragraph 2 carries that protection into the digital environment and imposes the same penalties on anyone who, without authorisation, takes, uses or alters, to the detriment of a third party, restricted personal or family data held in computer, electronic or telematic files or media, or in any other public or private record; and equally on anyone who merely accesses such data by any means.
The conduct in paragraphs 1 and 2 carries one to four years' imprisonment and a fine of twelve to twenty-four months (day-fine system). If the data, facts or images discovered are disseminated, disclosed or transferred to third parties, the penalty rises to two to five years' imprisonment (paragraph 3); and whoever disseminates them knowing their unlawful origin, without having taken part in the discovery, faces one to three years' imprisonment and a fine of twelve to twenty-four months.
Paragraph 4 raises the penalty to three to five years' imprisonment in two situations: where the acts are committed by those in charge of or responsible for the files, media, archives or records, or where they are carried out through the unauthorised use of the victim's personal data; if the restricted data were also disseminated, the penalties are imposed in their upper half. Paragraph 5 likewise requires the upper half where the data reveal ideology, religion, beliefs, health, racial origin or sexual life, or where the victim is a minor or a person with a disability in need of special protection. Paragraph 6 does the same for a profit motive and contains the most serious bracket in the chapter: four to seven years' imprisonment where a profit motive concurs with those sensitive data. That bracket has a procedural consequence worth noting: because it exceeds five years' imprisonment, the offence becomes time-barred after ten years under Article 131 CP, whereas the remaining forms of the article are time-barred after five.
Paragraph 7 covers the non-consensual sharing of intimate images. It punishes with three months to one year's imprisonment, or a fine of six to twelve months, anyone who, without the authorisation of the person concerned, disseminates, discloses or transfers to third parties images or audiovisual recordings of that person obtained with their consent in a home or in any other place beyond the sight of third parties, where the disclosure seriously undermines their personal privacy. Anyone who, having received such images, forwards them without consent faces a fine of one to three months. The penalty is imposed in its upper half where the offender is the spouse or a person who is or has been in a comparable emotional relationship with the victim, even without cohabitation; where the victim is a minor or a person with a disability in need of special protection; or where there is a profit motive. One limit of the offence deserves emphasis: it requires the image to have been obtained with the consent of the person concerned, so artificially generated or altered material falls outside its wording.
The provision sits alongside four articles that close the chapter. Article 197 bis punishes with six months to two years' imprisonment unlawful access to an information system in breach of the security measures put in place to prevent it, and also the interception of non-public transmissions of computer data. Article 197 ter covers producing, acquiring for one's own use, importing or supplying to third parties computer programs, passwords or access codes designed to commit those offences. Article 197 quater imposes penalties one degree higher where the acts are committed within a criminal organisation or group. And Article 197 quinquies governs corporate liability, with a fine of six months to two years. Outside the chapter, attacks that damage or disable data and systems move to the computer damage offence in Article 264, and disclosure by a public authority or official has its own offence in Articles 198 and 417 CP.
As a general rule these offences require a report (denuncia) by the injured party or their legal representative (Article 201 CP). No report is needed for the acts described in Article 198, where the offence affects the general interest or a plurality of persons, or where the victim is a minor or a person with a disability in need of special protection; and pardon by the injured party extinguishes the criminal action. The defence is usually built on four lines: consent, whether express or inferred from the context and the relationship between the parties; the absence of the subjective element, since the offence requires acting in order to discover secrets or breach privacy, and incidental access is not enough; the fact that the data were not restricted, or were legitimately accessible by reason of the person's post or employment relationship, which may move the matter into the disciplinary sphere; and the attribution of authorship where access came from shared devices, accounts or networks, an area where the chain of custody of the digital material and the expert report are decisive. The privacy offences defence service and the extended analysis of Article 197 CP develop these criteria in more detail.
Case law discussed
This analysis discusses a ruling of the Criminal Chamber of the Spanish Supreme Court. You can see its summary and full citation on our case-law page.
View the ruling· Appeal 3274/2023Legislative reform discussed
See the summary of this reform, the Criminal Code articles affected and the BOE link on our criminal-law reforms page.
View the reform· BOE-A-2010-9953Orientative data computed from the highest prison term mentioned in this article. Aggravated or mitigated subtypes, non-custodial penalties and concurrence rules may alter the outcome in each specific case.
Highest prison term mentioned
7 years
Classification (arts. 13 & 33 CP)
Serious offense
Limitation period (art. 131 CP)
10 years
Our team regularly defends those accused under disclosure of secrets. Technical strategy aimed at dismissal or acquittal when legally viable.
This page is for information purposes only and does not constitute legal advice: every case requires individual assessment. How this content is produced and verified: editorial policy.