Spain

Summary

Spain presents medium risk for commercial web scraping. Código Penal art. 197 bis criminalises unauthorised access to or remaining in a computer information system by bypassing security measures, regardless of intent (unlike some EU peers, no specific "fraudulent intent" element beyond acting without authorisation). Art. 197 bis has not been authoritatively applied to public-page scraping in published case law, but ToS violations combined with bypassing technical barriers create clear exposure. Spain transposed DSM Directive 2019/790 via Real Decreto-ley 24/2021, amending the Texto Refundido de la Ley de Propiedad Intelectual (TRLPI) to add arts. 67-bis (research TDM) and 67-ter (commercial TDM with machine-readable opt-out). Commercial TDM is lawful where no machine-readable reservation has been made. The AEPD actively enforces GDPR against large-scale personal-data collection, including from public sources; enforcement has grown substantially since 2022 (367 fines totalling €29.8 million in 2023). Spain retains the full EU sui generis database right (TRLPI arts. 133-137). The Ley de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI, Law 34/2002, last updated by RDL 9/2024) regulates electronic services generally but does not specifically address scraping. No scraping-specific statute; law_specificity reflects the general-law framework typical of EU member states.