Spain did not make use of the opening clause according to Art. 32 GDPR. In fact, specific measures contained in the former data protection legislation cease to apply since the GDPR and Organic Law 3/2018 have been in force.
Art. 22 Organic Law 3/2018 stipulates additional requirements for the deployment of CCTV in Spain. According to para. 1 and 2, CCTV can be utilised in public spaces where it is necessary to safeguard the security of persons and property. Art. 22 (3) Organic Law 3/2018 further states that the maximum video footage storage limit is one month. If infractions take place, the footage shall be handed over within 72 hours after the infraction became known. Para. 4 establishes what information must be provided by the controller. The corresponding guidelines are available here.
