Author: Mallika Kumari  |  Edited by: LLM Advocates Team

“ DATA PROCESSING REGULATION IS NOT JUST A MERE OBLIGATION BUT THE FOCAL CORE NEED OF THE CONTEMPORARY’S ERA!”

Objective

THE GDPR ( THE GENERAL DATA PROTECTION REGULATION) under the due regime of the EU (EUROPEAN UNION) has been reflected as one of the strongest frameworks since 2018.

In 2026, a landmark event was decided by the Spanish Supreme Court, driven by the enforcement notion of the APED- THE SPANISH DATA PROTECTION AGENCY has resulted eventually in expanding the scope of the “processing” under the GDPR.

This principle was evolved on a transformative notion as reflecting that even having a mere request for accessing personal data itself constitutes the notion of “processing” even when the requested data requested has not been actually collected or stored. This reflects the primitive stage of compliance with the obligations of the GDPR and helps in the due regulation of the overall data lifecycle.

Interplay-

These focal points are interpreted with the principle of privacy, governance, data minimisation, consent-aligned notions, on the due proceeds of interlinked facets for due regulation of digital commerce under the EU.

Background-

The case has its own due roots from a dispute involving a public administration body in Spain that asked an employee to disclose the medical diagnosis and associated treatment details in order to regulate the justification of the person concerned’s absences from the work.

The employee here refused to provide the due information on the notion that it results in a violation of the GDPR notions on facets of data minimisation and proportionality aligned regards.

The lower court has primarily said that the position of GDPR obligations arise when due personal data is actually collected but here since the concerned person has never actually submitted the medical information the concerned associated reasoning of the processing does not come into the picture.

Later, in appeal facet, the Supreme Court of the Spain rejected the narrow approach taken by the lower court and held that GDPR concept of processing is too broad and includes even the ‘act of soliciting personal data’ itself.

As held by the concerned court, the respective process of determining the purpose or means for processing the data also falls under the due ambit of regulation of the data processing activity.

Legal Foundation-

-ARTICLE 4 (2) OF GDPR defines processing as any operation or set of it which is to be performed on the concerned personal data of the respective person.

-Further ARTICLE 5 reflects the concrete principles to be followed up in the processing notion of the concerned respective personal data.

-ARTICLE 25 further talks about the facet of data protection by design and by default horizons as associated respectively.

Derivations-

Thus, it could be said that this highlight of the case does play a due vital role in strengthening the regulation over the data processing notion on comprehensive and stricter regards so that no compromise with terms of hampering to the processing process will impact bad over the person whose data is to be processed.

Conclusion-

It could be said that this acts as the revolutionary notion for the due betterment on foundational notions for the upcoming evolutionary pathway in the regulation of data processing notions.

References:

  • https://blog.hubspot.com/marketing/what-is-the-gdpr
  • https://www.lexology.com/library/detail.aspx?g=eafb0222-6bc2-4d52-af3b-a17408e07402
  • https://medium.com/@ageitgey/understand-the-gdpr-in-10-minutes-407f4b54111f
  • https://babl.ai/cjeu-rules-in-favor-of-schrems-in-landmark-case-against-meta/

(THANK YOU FOR BEING A PATIENT READER!).