DISCOVERY AND DISCLOSURE OF SECRETS

The crimes of discovery and disclosure of secrets are regulated in articles 197 to 201 of the Penal Code, precepts that typify several criminal modalities, which we will see below.

Seizure of documents or effects and intrusion into confidential areas and manipulation of confidential data recorded in computer files or support.

On the one hand, art. 197.1 of the Penal Code criminalizes the seizure of documents or effects and intrusion in reserved areas, the following behaviors, with a prison sentence of 1 to 4 years and a fine of 12 to 24 months:

1. A person who, for the purpose of discovering secrets or violating the privacy of another, seizes any document or personal effects of a third party.
2. A person who intercepts telecommunications of another person or uses listening, transmission, recording or reproduction devices of sound or image or any other communication signal, without his consent. By way of example, the action consisting of wiretapping through recording devices would constitute this type of crime.

The legal right protected by this crime is individual privacy, as a private sphere reserved from the action and knowledge of others (STS No. 332/2019 of June 27).

One of the most common cases is the recording of a telephone conversation by one of the persons involved. Can this behavior constitute a crime? Both the Constitutional Court and the Supreme Court agree that this conduct does not violate either the right to secrecy of communications or the right to privacy, although the subsequent dissemination of the recorded conversation could constitute a crime.

On the other hand, art. 197.2 of the Criminal Code punishes with the same penalty the subject who, without being authorized, seizes, uses or modifies, to the detriment of a third party, reserved data of a personal or family nature of another person that is registered in any telematic support or public or private file or registry. Likewise, the mere access to such data without authorization, as well as its alteration or use to the detriment of the owner or a third party, is also punishable (art. 197.2 of the Criminal Code). According to the Supreme Court, computer freedom is protected, as the citizen’s right to control personal and family information collected in data files, an element that is part of the positive dimension of privacy (STS no. 532/2015, of September 23).

Apart from the basic criminal modalities, Art. 197.3 of the Penal Code punishes with a lesser penalty the person who, with knowledge of its illicit origin and without having taken part in its discovery, carries out the conducts previously described, in which case the penalty is imprisonment of 1 to 3 years and a fine of 12 to 24 months.

Aggravated modalities

In the first place, an aggravated modality is foreseen that entails the imposition of a prison sentence of 2 to 5 years, which is applicable if the data or facts discovered or the images captured are disseminated, disclosed or transferred to third parties.

Secondly, the prison sentence amounts to a penal framework of 3 to 5 years when the acts are committed by the persons in charge or responsible for the files, computer, electronic or telematic supports, files or records, or are carried out through the unauthorized use of personal data of the victim.

Thirdly, if the facts affect personal data revealing ideology, religion, beliefs, health, racial origin or sexual life, or if the victim is a minor or a person with disabilities, the penalties are also imposed in the upper half of the sentence.

Finally, if the acts are carried out with lucrative purposes, the above mentioned penalties are imposed in their upper half. If, in this case, the facts affect personal data revealing ideology, religion, beliefs, health, racial origin or sexual life, or the victim is a minor or a person with disabilities, the penalty to be imposed is imprisonment for 4 to 7 years.

Non-consensual dissemination of intimate image capturing

A prison sentence of 3 months to 1 year or a fine of 6 to 12 months is imposed on a person who, without the authorization of the person concerned, disseminates, discloses or transfers to third parties images or audiovisual recordings of that person obtained with his consent in a home or any other place out of the reach of the gaze of third parties, seriously undermining his personal privacy (art. 197.7 of the Penal Code).

This type of crime is usually applied in cases in which, after the voluntary sending of images of sexual content through social networks, the recipient of such content forwards it to third parties. Until the entry into force of the reform introduced by Organic Law 10/2022, only the behavior of the person who initially received the images or content sent by the victim and subsequently shared them with other subjects was punishable by criminal law. However, since October 7, 2022, it is also punishable the subject who, having received the images or audiovisual recordings, disseminates, discloses or transfers them to third parties without the consent of the person concerned, in which case the applicable penalty is a fine of 1 to 3 months. Thus, it is now possible to punish also those persons who, having received the images or recordings sent by the author, forward them to third parties.

The penalty shall be imposed in its upper half when any of the following circumstances concur:

1. The facts are committed by the spouse or person who is or has been united to him/her by an analogous relationship of affectivity.
2. The victim is a minor or a person with a disability.
3. The acts are carried out with a lucrative purpose.

Computer intrusion

The offenses of computer intrusion are regulated in articles 197 bis and ter of the Penal Code.

On the one hand, art. 197 bis of the Criminal Code punishes the person who, in violation of the established security measures and without being duly authorized, accesses or facilitates access to an information system to another person or remains in it against the will of its owner. The penalty to be imposed is imprisonment from 6 months to 2 years.

Likewise, this precept punishes the subject who, using technical instruments and without being duly authorized, intercepts non-public transmissions of computer data from, to or within an information system. This type of crime is punishable by a prison sentence of 3 months to 2 years or a fine of 3 to 12 months.

On the other hand, through article 197 ter of the Criminal Code, certain preparatory acts of the crimes of discovery and disclosure of secrets are punishable with imprisonment from 6 months to 2 years or a fine from 3 to 18 months. Specifically, this precept punishes the person who, without being authorized, produces, acquires for his use, imports or provides to third parties, with the intention of facilitating the commission of any of the crimes previously exposed:

1. A computer program designed primarily for the purpose of committing such crimes.
2. A computer password, access code or similar data that allows access to an information system.

Disclosure of labor or professional secrets

On the one hand, Article 199 of the Penal Code punishes a person who discloses the secrets of others that he has learned in the course of his work or labor relations, a conduct that carries a prison sentence of 1 to 3 years and a fine of 6 to 12 months.

On the other hand, this precept punishes the disclosure of secrets of a third party by a professional, when this involves a breach of the obligation of silence or reserve, in which case the penalty to be imposed is imprisonment of 1 to 4 years, a fine of 12 to 24 months and special disqualification for that profession for a period of 2 to 6 years. This crime can only be committed by those who exercise a profession by virtue of which they have a duty of professional secrecy, such as doctors or lawyers.

Criminal liability of legal persons

Article 197 quinquies of the Criminal Code provides for the criminal liability of legal entities for the crimes described above, in which case the penalty is a fine of 6 months to 2 years, and the judge may also impose penalties of dissolution, suspension of activities, closure of premises, prohibition of future activities, special disqualification from obtaining public subsidies and aid, and judicial intervention.

Furthermore, it is relevant to take into account that Article 200 of the Criminal Code also protects the privacy of legal persons, establishing that the above is applicable to the person who discovers, discloses or transfers confidential data of legal persons, without the consent of their representatives.