Digital Evidence in Spanish Criminal Proceedings

The evidential value of a device image depends on the integrity of the process. In practice the defence examines whether the seizure was documented with the device state recorded, whether a forensic image was taken with write-blocking, whether hash values were calculated at acquisition and verified before analysis, whether those values match in the expert report, whether the analysis was carried out on the copy rather than the original, and whether the defence was given access to the copy so that its own expert could replicate the work.

For messaging applications the questions are different. A screenshot is manipulable, an export can be edited, and a message can be attributed to an account rather than to a person. Spanish case law requires particular caution where a conversation is produced by one party in extract, and the Supreme Court has repeatedly said that when authenticity is contested the party relying on the message must prove it, typically through a forensic report on the device or through the metadata.

Where an irregularity is established, article 11.1 of the Judiciary Act excludes unlawfully obtained evidence and, subject to the connection of unlawfulness doctrine, the evidence derived from it.

Digital evidence in Spain is governed both by the substantive provisions that protect data and communications, in article 197 and following of the Criminal Code, and by the procedural rules on the search of electronic devices introduced into the Criminal Procedure Act. As a rule, access to the content of a phone, computer or account requires a reasoned judicial authorisation and must respect the principle of proportionality.

These safeguards exist because a modern device holds a comprehensive picture of a person’s private life. When they are not observed, the resulting evidence is exposed to challenge, and in serious cases to exclusion from the proceedings.

We examine whether the search of a device or of remotely stored data was covered by a specific and reasoned judicial authorisation, whether its scope was respected, and whether the measure was proportionate to the offence under investigation. Remote searches in particular are subject to strict conditions.

Where the authorisation is generic, retrospective or exceeded in practice, the material obtained may be unusable, which can be decisive in cases that rest largely on electronic evidence.

Messages and screenshots are among the most common forms of digital evidence, and also among the easiest to manipulate. Their evidential weight depends on being able to demonstrate their authenticity, ideally from the original device or account rather than from an isolated image.

We test whether the material presented is complete and unaltered, since a selective or edited exchange can convey a very different meaning from the full conversation.

Not all evidence is admissible simply because it exists. Material obtained in breach of fundamental rights, whether by the authorities or by a private party, may be excluded, and evidence derived from it can be tainted as well.

Where a recording or a message has been obtained unlawfully, we raise its inadmissibility, since the exclusion of key evidence can be decisive for the outcome of the case.