DIGITAL EVIDENCEDigital evidence in Spanish criminal courts

What is at stake

• Convictions built almost entirely on data extracted from your devices
• Wiretaps lasting up to 18 months and covert location tracking
• Full forensic images of phones and computers, including deleted material
• Cross-border evidence obtained through the EU e-evidence Regulation
• Nullity of the evidence where the statutory safeguards are breached

What we do

• Legal and technical audit of every measure: warrant, extensions, cessation, imaging
• Chain of custody: hashes, imaging tools, sealing and access to the full dataset
• Challenge to fishing expeditions and to warrants that merely copy the police request
• Independent forensic reports on authenticity, metadata and attribution
• Preservation requests for exculpatory data before retention periods expire

Article 588 bis a LECrim · Governing principles

Every technological investigation measure requires a reasoned judicial warrant complying with the principles of speciality, suitability, exceptionality, necessity and proportionality. General surveillance to see what turns up is prohibited, and warrants that fail this test are void together with everything derived from them.

Article 588 ter LECrim · Interception of communications

Available for intentional offences punishable by at least three years, organised crime, terrorism and offences committed through technology. The initial period is three months, extendable up to eighteen. Extensions must assess the results obtained: automatic renewals are routinely annulled.

Article 588 sexies LECrim · Search of devices

Access to the content of phones, computers and mass storage requires a specific, individually reasoned warrant, even if the device was lawfully seized during a house search. The Supreme Court treats a smartphone as more privacy-sensitive than the home itself: a general search warrant does not authorise the download of your phone.

Article 588 septies LECrim · Remote searches

The use of software to access a device remotely and covertly (police malware) is confined to a closed list of serious offences, with a warrant specifying the devices, scope and officers, and a maximum duration of one month, extendable to three. It is the most intrusive measure in Spanish law and the most vulnerable to challenge.

Article 588 octies LECrim · Data preservation

Allows an order for the rapid preservation of data for 90 days while a production order is obtained. It works both ways: the defence can and should ask for CCTV footage, access logs and account data to be frozen before automatic deletion destroys the evidence that helps you.

Messaging screenshots and authenticity

Spanish case law (following Supreme Court judgment 300/2015) treats screenshots of messaging apps with caution because of how easily they can be manipulated. Where authenticity is disputed, the original device or a forensic report is required. This cuts both ways: it protects defendants against fabricated chats and requires victims to preserve evidence properly.