2 Defining regulatory principles

2.6 Law 34/2002 on E-Commerce and Information Society Services

Law 34/2002 on E-Commerce and Information Society Services (ECISSA) defines as “information society services” any service provided for a valuable consideration, long-distance, through electronic channels and upon individual request by the recipient, also including those not paid for by the recipient, to the extent that they constitute an economic activity for the provider. Specifically, the following are deemed to be information society services:

• Contracting for goods and services through electronic means.
• Organization and management of auctions using electronic means or of virtual shopping centers or markets.
• Management of purchases on the network by groups of persons.
• Sending of commercial communications.
• Supply of information through telematic channels.
• Video upon demand, as a service that the user may select through the network and, in general, the distribution of contents upon individual request.

The ECISSA applies to information society service providers established in Spain. In this respect, the provider is considered to be established in Spain when its place of residence or registered office is located in Spanish territory, provided that it coincides with the place where its administrative management and business administration are actually centralized. Otherwise, the place where such management or direction is performed will be considered.

Likewise, the ECISSA will apply to services rendered by providers who are resident or have a registered office in any other State when the services are offered through a permanent establishment located in Spain. Therefore, the mere use of technological means located in Spain to provide or access the service will not of itself determine that the provider has an establishment in Spain.

The above notwithstanding, the requirements of the ECISSA will apply to service providers established in another State of the European Union or the European Economic Area when the recipient of the services is located in Spain and the services affect:

• Intellectual or industrial property rights.
• Advertising issued by collective investment institutions.
• Direct insurance activities.
• Obligations arising from contracts with consumers.
• The lawfulness of unsolicited commercial communications by e-mail.

The ECISSA establishes the basic legal regime for information society service providers and e-mail activities, including:

• The principle of freedom to provide services not subject to prior authorization applies to information society services, except in certain cases. In the case of service providers established in States that do not belong to the European Economic Area, this principle will apply in accordance with the applicable international agreement.
• The following obligations are imposed on information society service providers:
  • To put in place the means to permit the recipients of the services and the responsible bodies to access easily, directly and free of charge, the information on the provider (corporate name, registered office, registration particulars, tax identification number, etc.), on the price of the product (stating if it includes applicable expenses and shipping costs) and on the codes of conduct to which it has adhered.
  • For providers of intermediation services, to cooperate with the responsible authorities in interrupting the provision of information society services or in withdrawing contents.

    Please note that depending on the specific services that these intermediation service providers carry out (access to the internet, e-mail services), they are obliged to furnish certain information such as, for example, the security measures in place, the filters for certain persons to access the site or the responsibility of the users.

• A specific system of liabilities is established for information society service providers, without prejudice to the provisions of civil, criminal and administrative legislation.
• A specific system is established for commercial communications through electronic channels, without prejudice to the legislation in force on commercial, publicity and personal data protection matters. In this regard, commercial communications through electronic channels must be clearly identifiable, stating the individual or corporation for whom they are made, and spelling out the conditions for access and participation, in the case of discounts, prizes, gifts, competitions or promotional games.

  Additionally, advertising or promotional communications sent by e-mail or similar form of communication that have not been previously requested or expressly authorized by the recipients are prohibited. Express consent will not be necessary when there is a pre-existing contractual relationship, provided that the supplier had lawfully obtained the recipient’s contact data and that the commercial communications refer to goods or services of the provider’s own company which are similar to those for which the recipient initially made a contract. In any case, the provider must offer the recipient the possibility to object to the processing of his data for promotional purposes, through a procedure that is simple and free of charge, both at the time the data is collected and in each of the commercial communications sent to him. Where the communications have been sent by e-mail, that medium shall necessarily include a valid e-mail address where the recipient can exercise this right, it being prohibited to send communications that do not include such address.

• Service providers may use devices for storage and recovery of data on computer terminals of the recipients (commonly known as “cookies”), on the condition that the recipients have given their consent after having received clear and complete information on their use.

  Where technically possible and efficient, the recipient may give his consent to the processing of his data through the use of the appropriate parameters of the browser or of other applications, provided that the recipient must configure it during installation or updating through express action for that purpose.

  The foregoing will not prevent the possible technical storage or access for the sole purpose of transmitting a communication through an electronic communications network or, to the extent that it is strictly necessary, providing an information society service expressly requested by the recipient.

  The Spanish Data Protection Agency is the body with the authority to impose monetary penalties to the information society providers for the use of cookies without the proper informed consent from users of an information society service. The fines can reach the amount of €30.000.

• Contracts through electronic channels are regulated, recognizing the effectiveness of the agreements made through electronic channels when consent has been granted and other requirements necessary for their validity are met. Additionally, the following provisions are established for contracts made through electronic channels:
  • The requirement that a document should be placed on record in writing is considered to be met when it is contained on electronic medium.
  • The admission of documents on electronic medium as documentary evidence in lawsuits.
  • Determination of the legislation applicable to the contract made through electronic channels will be governed by the provisions of international private law.
  • Establishment of a series of obligations to be met prior to commencement of the contracting procedures, relating to the information that must be furnished on the formalities for the making of the contract, the validity of offers or proposals of contracts and the availability, if any, of general contracting conditions.
  • Obligation on the offeror to confirm receipt of the acceptance within 24 hours after its receipt, by an acknowledgement sent by e-mail or equivalent means to that used in the contracting procedure which enables the recipient to give such confirmation.
  • Assumption that agreements made through electronic channels in which the consumer participates have been made in the place where the consumer has his customary place of residence. When these contracts are made between entrepreneurs or professionals, they will be assumed to have been made, in the absence of a provision on the matter, in the place where the service provider is established.

    When dealing with agreements entered into with customers, the Revised General Consumer and User Protection Law should be taken into account, in particular in connection with distance sales.

• Recognition of a ground to claim cessation against conduct that contravenes the ECISSA which is detrimental to collective or general consumers’ interests, and promotion of out-of-court settlement of disputes.
• Establishment of minor, serious and gross infringements due to failure to comply with the obligations imposed by the ECISSA, with penalties of up to €600,000.