Law 25/2007 of 18 October on the retention of data relating to electronic communications and public communications networks is intended to regulate the obligation of operators to keep data on the data. generated or processed in the framework of the provision of electronic communications services or of public communication networks, as well as the duty to transfer such data to the authorised agents, provided that they are required through the corresponding judicial authorisation for the purposes of detection, investigation and prosecution of offences (b) serious cases referred to in the Criminal Code or in special criminal law.

This Act applies to traffic and location data on natural and legal persons and related data necessary to identify the registered subscriber or user. The content of electronic communications, including information consulted using an electronic communications network, is excluded from the scope of that Act.

Law 25/2007, of 18 October, lists in Article 3, in a precise and detailed manner, the list of data that is subject to the obligation of conservation in the framework of communications by fixed telephony, mobile or Internet. This data is necessary to identify the origin and destination of the communication, its time, date and duration, the type of service used and the communication equipment of the users used and, in the case of the use of a mobile equipment, data necessary for its location. In application of the provisions of Directive 2006 /24/EC of the European Parliament and of the Council of 15 March on the retention of data generated or processed in connection with the provision of electronic communications services, Public access or public communications networks and amending Directive 2002/58/EC also include in the field of application of the Law so-called unsuccessful telephone calls. It also includes the obligation to preserve the elements that are sufficient to identify the moment of activation of the telephones that operate under the prepaid mode.

The single additional provision of Law 25/2007 of 18 October for the purpose of establishing instruments for controlling employment for criminal purposes of mobile telephony equipment acquired through the use of prepaid, establishes, as an obligation for operators who place such a service on the market, the keeping of a register with the identity of the buyers.

Furthermore, the abovementioned Law 25/2007 of 18 October provides in its fourth final provision on the format for the delivery of the data that the transfer to the authorised agents of the data for which it is compulsory is carry out in electronic format, in the form to be determined by the Joint Order of the Ministers of the Interior, the Defence and the Economy and the Treasury. The aforementioned legislative enablement in favor of the Ministry of Defense must be understood as currently residing in the Ministry of the Presidency, since the National Intelligence Center, from which its condition is derived, has become dependent on this Department, pursuant to the provisions of the second provision of Royal Decree 1823/2011 of 21 December 2011, which restructured the Departments of Ministeriales. And for the same reasons of organic restructuring, the reference to the Ministry of Economy and Finance should be understood as being within the competence of the Ministry of Finance and Public Administrations.

This Order aims to establish the technical specifications of the delivery format to the authorised agents of the data retained by the operators which are generated and processed in the framework of the provision of electronic communications services or public communication networks.

The model promoted by ETSI (European Telecommunications Standards Institute) for the establishment of these specifications is adopted. This model consists of a set of standards developed within this standardisation body, involving experts from all sectors involved in data retention, which ensures a high level of consensus and quality. of the standards developed, as well as the maintenance and adaptation to the different telecommunications technologies that are emerging in the market.

The adoption of the ETSI model implies the incorporation into the Spanish legislation of an ETSI technical specification that specifies the flow of information as well as the procedures, formats and protocols specific to the (HI) delivery interfaces between the required subjects and the authorised agents: ETSI TS 102 657.

Finally, this Order has been submitted to the previous report of the Spanish Agency for the Protection of Data, in accordance with the provisions of Articles 37.h) of the Law 15/1999 of 13 December, of Protection of Personal Data, and 5.b) of the Staff Regulations of the Agency, approved by Royal Decree 428/1993 of 26 March.

In its virtue, on the proposal of this Ministry and the Ministers of the Interior, Finance and Public Administrations, I have:

Article 1. Object and scope of application.

The purpose of this order is to establish the technical specifications of the delivery format to the authorised agents of the data subject to storage referred to in Article 3 and the additional provision The only one of Law 25/2007, of 18 October, for the preservation of data relating to electronic communications and public communications networks, in accordance with the provisions of the fourth final provision of that Law.

The provisions in this order are without prejudice to the regulatory developments provided for in the final provision of the Law.

They shall be required to follow the procedures and adopt the measures referred to in this Ministerial Order by operators who provide or are in a position to provide available electronic communications services to the public or to establish or operate public communications networks in Spain, regardless of the nature, territorial scope and time that its rating took effect, in the terms established in Law 32/2003 of 3 November, General de Telecommunications.

Article 2. Format of data delivery to the empowered agents.

1. Number of individual requests for transfer of data between all the authorised agents exceeding 2,000. -Under Law 25/2007 of 18 October the transfer to the authorised agents of the data for which the retention is compulsory by the operators shall be carried out, where the number of individual requests for the transfer of data between all the authorised agents exceeds 2,000 applications during the calendar year preceding the entry into force of this ministerial order, according to the format set out in the technical specification of the European Institute for Standardisation Telecommunications (ETSI) TS 102 657, Lawful Interception (LI); Retained data handling; Handover interface for the request and delivery of retained data, with the amendments and clarifications set out in Annex I to this ministerial order.

2. Number of individual requests for the transfer of data between all the authorised agents equal to or less than 2,000. -Where a subject has received a number of individual requests for the transfer of data between all the authorised agents less than 2,000 applications during the calendar year prior to the entry into force of this ministerial order, or in subsequent calendar years the number of applications below the already mentioned 2,000 applications, instead of use the delivery format based on the ETSI TS 102 657 standard you may choose to use another solution technology previously agreed with the authorised agents from among the different formats specified for this case in Annex III, in electronic form and whose name shall be in accordance with point 7.1 of Annex I to this Order ministerial.

In order to be eligible for this solution, the subject must inform each authorized agent that the 2,000 individual applications and their request for the technological solution have not been exceeded in the previous calendar year. Previously agreed alternative. In any event, the agreed technological solution shall ensure compliance with the security measures required in accordance with the provisions of the personal data protection regulations.

If in the first case the mandatory agreement between the obliged subject and the authorised agents is not reached or if the exception referred to in the second case is established, the number of 2,000 applications will be exceeded, shall apply the provisions of paragraph 1 of this Article.

3. Deadline for the adoption of the delivery format. -Where a subject has received a number exceeding 2,000 individual requests for the transfer of data during the calendar year preceding the entry into force of this Ministerial or agreed to the The derogation in paragraph 2 of this Article shall be subsequently exceeded by the number of 2,000 applications within a calendar year, shall have the time limit laid down by Law 25/2007 of 18 October, in its fourth final provision, to implement the procedure (a) a transfer based on the ETSI TS 102 657 standard adopted in this order. This period shall be counted from the entry into force of this ministerial order in the first case and from the moment the number of 2,000 applications is exceeded within one calendar year in the second case.

Article 3. Location information.

Forced subjects providing mobile services shall provide the location information of the requested mobile terminal, as set out in Annex I of this order.

Article 4. Communication channels between obliged subjects and authorised agents.

There will be two types of communication channels between each subject and each authorized agent for the delivery of the requested data: a channel for exchange of administrative information on requests/responses (Interface HI-A), and another channel for transmitting the data retained by the bound subject (HI-B Interface). These two "logical" channels can be performed on the same "physical" channel of liaison, and in any case they will be found, obligatorily, within the national territory.

Annex II to this order sets out the characteristics and requirements to be met by both communications channels as well as the details of the payment of the cost of communications by the authorised agents.

Article 5. Communication of information related to the conservation of data relating to electronic communications and to public communications networks between obliged subjects.

1. Information relating to the data retention command, relating to electronic communications and to public communications networks, which is exchanged between obliged subjects, shall be limited to the strictly necessary for the purposes of to meet the needs arising from the obligation to collaborate between operators for the implementation of the same. The required subjects shall ensure at all times the confidentiality of the information transmitted or stored, and cannot be used for any other purpose. In any event, in accordance with the requirements of Law 25/2007 of 18 October, this exchange of information may in no way refer to personal data in respect of which there is a conservation obligation and, where appropriate, communication to the authorised agents.

2. The orders to transfer the preserved data and any other important information for the safety of the storage system must be transmitted by a secure channel as defined in Annex II to this order.

Single transient arrangement. Deadline for compliance.

Required subjects who are serving the entry into force of this Ministerial Order shall comply with the obligations set out therein within the time limit set by Law 25/2007 of 18 October. fourth final provision, as provided for in Article 2 of this ministerial order.

Those obliged to initiate their activity after the entry into force of this ministerial order, must meet the obligations established in this ministerial order since the beginning of their activity, being able to to accept the provisions of the second paragraph of Article 2 where these conditions are verified at the end of the first full calendar year since the beginning of their activity.

Final disposition first. Regulatory enablement.

The holders of the Secretariat of State for Security, the Secretariat of State Director of the National Intelligence Center (CNI) and the Secretariat of State of Finance are empowered to jointly update the content of the the Annexes to this Order.

Final disposition second. Budgetary impact on public administration.

The forecasts contained in this order will not result in any increase in personnel costs by any concept and will be carried out with the personal means available in the ministerial departments and interested bodies.

Final disposition third. Entry into force.

This ministerial order shall enter into force on the day following that of its publication in the "Official State Gazette".

Madrid, January 29, 2013. -Government Vice President and Minister of the Presidency Soraya Saenz de Santamaria Anton.

Here are several images in the original. See the official and authentic PDF document.