Yes, two-party consent recording is legal in Spain, but only under strict conditions outlined by national and EU data protection laws. Unauthorized interception of private communications violates Article 18.3 of the Spanish Constitution and the General Data Protection Regulation (GDPR), with penalties reaching up to €20 million or 4% of global turnover. The 2026 Spanish Data Protection Act (Ley Orgánica 3/2018, modified by Real Decreto-ley 5/2023) further clarifies that recordings require explicit consent from all parties unless justified by legitimate interests under Article 6.1(f) GDPR, such as law enforcement or employment-related disputes. The Agencia Española de Protección de Datos (AEPD) enforces compliance, emphasizing proportionality and necessity.
Key Regulations for Two-Party Consent Recording in Spain
- Explicit Consent Requirement: Recordings of private conversations are unlawful without prior, informed consent from all parties, per Article 18.3 of the Spanish Constitution and GDPR Article 6.1(a). Consent must be freely given, specific, and documented.
- Legitimate Interest Exception: Recording may be permissible without consent if justified by a legitimate interest (e.g., workplace monitoring for fraud prevention), but this must pass a three-step balancing test (necessity, proportionality, and minimal intrusion) as per AEPD guidance.
- Employment Context: Employers must notify employees in writing of monitoring policies, including the purpose, duration, and legal basis, per Real Decreto-ley 5/2023 and AEPD’s Circular 3/2019. Secret recordings by employees may still violate labor laws unless related to whistleblowing under Ley 2/2023.
Practical Implications:
- Civil Liability: Unauthorized recordings may result in damages claims under Ley Orgánica 1/1982 on civil liability for violations of privacy.
- Criminal Liability: Under Article 197.1 of the Spanish Penal Code, intercepting communications without consent can lead to imprisonment (3 months to 1 year) and fines.
- Cross-Border Data Transfers: Recordings containing personal data must comply with GDPR Chapter V if shared outside the EU, requiring adequacy decisions or standard contractual clauses.