Criminal Lawyers in Privacy Support

The crime of discovery and disclosure of secrets (Arts. 197 to 201 of the Spanish Criminal Code) is the main criminal-law tool for the protection of personal and family privacy and the fundamental right to data protection recognized in Art. 18.4 of the Constitution. The protected legal interest is plural: inviolability of communications, informational self-determination, professional secrecy and, in its business dimension, trade secrets. Consolidated Supreme Court case-law and constitutional doctrine have significantly expanded the scope of the type, incorporating unauthorized access to computer systems, the dissemination of intimate content through instant messaging and the illicit capture of data through spyware or similar programs.

The Criminal Code articulates several clearly differentiated modalities. Art. 197.1 sanctions the basic discovery: seizing papers, letters, emails or any other personal documents, or intercepting telecommunications, without the holder's consent. Art. 197.2 punishes unauthorized access, modification or use of personal data registered in files or computer media. Art. 197.3 aggravates the penalty when the author disseminates, reveals or transfers to third parties the discovered data. Art. 197.5 introduces the aggravated subtype of sensitive data (health, ideology, religion, sexual life, racial origin). Art. 197.7 typifies the dissemination without consent of intimate images or videos obtained with initial consent (the so-called "law against non-consensual sexting" or revenge porn). And Art. 197 bis, transposing Directive 2013/40/EU, sanctions unlawful access to computer systems and interception of electronic transmissions.

Penalties are notably severe. The basic discovery of Art. 197.1 carries 1 to 4 years' prison and 12 to 24 months' fine. Dissemination to third parties under Art. 197.3 raises the penalty to 2 to 5 years' prison. When the data affect sensitive information (Art. 197.5), penalties are imposed in their upper half, reaching 3 to 5 years' prison. Non-consensual dissemination of intimate images under Art. 197.7 sanctions with 3 months to 1 year' prison or 6 to 12 months' fine, aggravated when the victim is the author's spouse or partner, minor or person with disability. Unlawful access to computer systems under Art. 197 bis carries 6 months to 2 years' prison. Additionally, offences committed by public officials (Art. 198 CP) impose penalties in their upper half with absolute disqualification of 6 to 12 years, and those committed by the file or system manager with professional advantage (Art. 197.4) also escalate.

Technical defense is built on several consolidated axes. The first is the holder's consent: if access or capture occurred with express or tacit authorization, it falls outside the type; trust relationships, especially family and partner ones, require particularly careful analysis. The second is evidence nullity: when evidence has been obtained violating fundamental rights (access without judicial order to devices, capture without consent), Art. 11.1 LOPJ applies and derived evidence becomes void (fruit of the poisonous tree doctrine). The third axis is the absence of intent: accidental discovery of information or inadvertent access to an unlocked device does not integrate the type. The fourth is the conflict with the right to freedom of information under Art. 20 CE: when dissemination pursues general interest and respects proportionality (journalistic complaints or whistleblowing), the justification cause operates. And the fifth is the Barbulescu doctrine of the ECtHR and its national reception on workplace control of communications: it requires a prior, known and proportional policy.

In current forensic practice, privacy crimes have experienced exponential growth linked to digitalization and the massification of instant messaging. Proceedings concentrate on four major axes: couple crises with access to WhatsApp, emails or social networks and subsequent dissemination; labor conflicts with installation of keyloggers, GPS in company vehicles, reading of corporate emails without prior policy; trade-secret leaks by former employees who carry sensitive information to competition; and revenge porn and sextortion, which have generated a sustained rise in complaints. Organic Law 3/2018 on Data Protection, the European General Data Protection Regulation (GDPR) and ECtHR case-law on Art. 8 of the Convention have raised standards of evidentiary demand and criminal response. At Alonso Sala we intervene with forensic IT experts to prove access, trace IPs and validate digital chains of custody; with notaries for urgent certification of online content; and with the Spanish Data Protection Agency to coordinate immediate removal of harmful content. We treat each file with the conviction that in privacy crimes time is a decisive factor: digital evidence is volatile, and the difference between acquittal and conviction — or between effective reparation and consummated damage — is played out in the first 48 hours.