Article 588 octies Spanish Criminal Procedure Act: Data Preservation Orders

Article 588 octies of the Criminal Procedure Act allows the Public Prosecution Service or the judicial police to require any natural or legal person to preserve and protect specific data held in a computer storage system, until judicial authorisation for its transfer is obtained. The measure is not an access to the data: it freezes them. It lasts a maximum of ninety days, extendable once up to one hundred and eighty, and the person required must cooperate and keep the matter secret.

Wording of Article 588 octies of the Spanish Criminal Procedure Act

Requirements and procedure

1. Specific data or information, identified as such. A general instruction to preserve everything relating to a person does not satisfy the article.
2. A holder of the data, whether a natural or legal person, having them at his disposal.
3. A maximum period of ninety days, extendable once, and only until the transfer is authorised or one hundred and eighty days elapse.
4. A subsequent judicial authorisation before the data may be transferred and examined.

Defence strategy

Preservation is not transfer. The order permits the data to be frozen, not read. Where the prosecution relies on material that reached the file without a judicial decision authorising its transfer, the defence traces the chain: the preservation request, the date of the judicial authorisation and the date of delivery. Material delivered on the strength of the preservation order alone is obtained without a legal basis.

Expiry of the period. The maximum is one hundred and eighty days including the single extension. Data preserved beyond that period, or delivered after it without a fresh order, fall outside the article. The dates are established from the correspondence with the provider, which the defence requests as part of the file.

Specificity of what was preserved. The article speaks of specific data. Requests covering entire accounts, all traffic over long periods or all content held by a provider exceed it and engage the proportionality requirement of article 588 bis a. Where the request was general, the defence contests the whole of the material derived from it rather than individual items.

Acting for the party required to preserve. Where the firm advises the provider, the employer or the platform required to preserve, the obligations are cooperation and secrecy, with the liability of article 588 ter e(3) attached. The correct course is to preserve exactly what is identified, to document what was preserved and when, and to refuse any delivery until a judicial authorisation is produced, since delivering without it exposes the party to liability towards the data subject.

• Article 588 ter a: interception of communications
• Article 588 sexies a: seizure of computers
• Cybercrime and online fraud
• Spanish-language entry

This entry is provided for information only and does not constitute legal advice. The application of any provision depends on the circumstances of the individual case and requires examination of the case file by a qualified lawyer.