The benefits of making decisions on the basis of mathematical calculations can be enormous in many sectors of life, but relying too much on AI, which inherently involves determining patterns beyond these calculations, may also cause injustice and restrict people’s fundamental rights. 

In fact, the use of AI systems comprises a wide range of fundamental rights, regardless of the field of application. These include, among others, the right to privacy, data protection, non-discrimination and access to justice.

Paraphrasing Hans Kelsen, the Spanish Constitution (1978) lies at the peak of the pyramid of the legal system in Spain. Therefore, when using AI tools, at least the following articles of the Spanish Constitution should be considered: 

• Article 14: recognizes the equality of Spaniards before the law and how they may not be discriminated against on account of birth, race, sex, religion, opinion or any other personal or social circumstances. 
• Article 18: point 1 guarantees “the right of honour, to personal and family privacy and to one‘s own image”. Additionally, point 4 explicitly restricts “the use of data processing in order to guarantee the honour and personal and family privacy of citizens and the full exercise of their rights”. In this regard, the Constitutional Court concluded in its Judgment 94/1988 that article 18.4 enshrines “an autonomous fundamental right to control the flow of information concerning each person”. This fundamental right is especially relevant as the right to privacy is particularly threatened by the use of AI.
• Article 24: recognises the right of all persons to obtain the effective protection of Judges and Courts in the exercise of their rights and legitimate interests. On this matter, although the processing of judicial data through so-called AI systems is likely to improve the transparency of justice by improving the predictability of the application of the law and the consistency of jurisprudence, it should also be noted that such processes cannot be limited to algorithms and must take into account particular circumstances, thus ensuring the equality of data subjects before the law.

In terms of fundamental rights, Spain, has been a world pioneer by presenting a “Charter of Digital Citizenship Rights”, a reference framework for navigating the digital environment in which we already live. This Charter was approved in July 2021 and seeks to update existing rights recognized in texts, such as the Declaration of Human Rights or the Spanish Constitution, and adapt them to the new digital reality. Its section XXV recognises a set of rights in the context of AI that makes reference to non-discrimination, the obligation of transparency and the accessibility, usability and reliability. However, it is not (yet) a legislative text; therefore, it can only be understood within Spain's existing legal framework.

In addition, Spain is a member of the Organisation for Economic Co-Operation and Development (OECD), and, therefore, has adopted the OECD Council Recommendation on AI. These principles promote AI that is trustworthy and that respects human rights.

Finally, it is worth mentioning the judgment of the Spanish Constitutional Court 76/2019 that repealed article 58bis of the Organic Law on the General Electoral Regime, which allowed political parties to track the political opinions of citizens on the internet by means of AI systems. The High Court stated in its ruling its concern about the use of AI to manipulate the will to vote without the public being aware of it (including for example, by sending out propaganda, automatically tailored to their weaknesses and strengths). 

There are numerous examples of how AI acts autonomously at a creative and innovative level, both in the scientific and in the artistic environment, and within the latter, with respect to all disciplines, including literature and music. AI poses important legal challenges which, in intellectual property (IP) matters involve determining whether creations generated solely by AI are protected by IP rights, and, if so, who should be considered the holder of such rights. 

In order to address these IP issues that arise with respect to AI-generated creations in Spain, it is necessary to analyse whether those creations meet the requirements established by Spanish IP legislation.

Spanish Law 24/2015 on Patents considers computer programs, or ways of presenting information, to be unpatentable (art. 4.4 (a), (b), (c) and (d)), due, depending on the case, either to their abstract nature or their lack of technical character. In this sense, AI, as such, is not patentable, as it is a set of algorithms implemented in a computer system and therefore there is no technical function. However, as with software, AI would meet the requirements for patentability under Spanish law if it can be demonstrated that, by means of this technology, an invention allows a new technical aspect and implies an inventive step that can be attributed to this AI technology. 

The second question is whether the AI can be considered an inventor of a patentable creation. In this regard, article 10 of the aforementioned regulation states that “the right to the patent belongs to the inventor […]”. Given that the law links the status of inventor to the natural person (based on the conception that an invention is the result of human creativity), the AI, as such, cannot assume the capacity of inventor under the law as it currently stands.

Article 5 of Royal Decree-Law 1/1996, approving the Spanish Law on Intellectual Property, provides that “the natural person who creates a literary, artistic or scientific work shall be considered the author”. Additionally, article 10 establishes that “all original literary, artistic or scientific creations […] are subject to intellectual property”.

From the foregoing, it is clear that, under Spanish law and in accordance with the applicable doctrine and case law, the fundamental requirements that any creation must meet in order to be considered eligible for copyright protection are the following: 

• it must be the result of a creative act of its author who, in any case and ultimately, must be a natural person who imprints on such creation his artistic expression; and 
• such result must be original, in the sense that it must incorporate a minimum of “creative height” or novelty with respect to everything previously created.

Therefore, in Spanish law, copyright protection of creations made by AI is not possible, mainly due to the fact that creations that do not originate from a human being are not protected. The protection by copyright of these creations would require, at least, a substantial legislative change by way of extending the concept of “author” to entities other than natural persons.

AI cannot be protected either by copyright or by patent protection under Spanish legislation. However, the Spanish system provides for an equally effective form of protection: trade secrets. Trade secrets are regulated in Law 1/2019, article 1 of which establishes that any element or information that has the following characteristics can be considered a trade secret:

• it must be secret information, in the sense that it must not be generally known by the persons who may normally have access to that type of information;
• it must have a business value; and
• it must have been subject to measures to keep it secret.

In this sense, compilations of data, such as AI training datasets, the expression of a programmer’s source code or other proprietary information used in AI technology may be considered information that is intended to be kept secret due to an economic or competitive advantage and, if it meets the above conditions, it could constitute a trade secret under Spanish law. In this regard, any disclosure of trade secrets could give rise to different legal actions, including a claim for damages.

The AI revolution may not only bring along risks of potential failure, misuse or discrimination, but can also directly affect privacy and effective personal data protection. Spanish companies developing and implementing AI systems must address the risks associated with the uses of this technology as well as take into account data protection regulatory restrictions or prohibitions enshrined in Spanish legislation. 

In Spain, the right to data protection is developed in a regulatory framework that currently comprises the General Data Protection Regulation (EU) 619/2016 (GDPR), supplemented by Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), which fundamentally adapts Spanish legislation to the GDPR.

The LOPDGDD establishes a series of obligations and rights, which cover all processing of personal data, whether manual or computerised, and which must be especially taken into account in the implementation of AI technology. In this regard, it is worth noting Title X of that act which addresses the recognition of data subjects’ digital rights as enshrined in the above mentioned article 18.4 of the Spanish Constitution.

Additionally, in 1992, the Spanish Data Protection Agency (AEPD) was created in order to promote and ensure compliance with Spanish data protection legislation. In relation to AI systems and data protection, the AEPD has issued the following guidelines:

• Guide to adapt products and services using AI to the GDPR (2020). 
• Guide on requirements for audits of data processing involving AI (2021). 
• Note 1/2019 on the processing of data relating to political opinions by political parties under article 58bis of the Organic Law 5/1985. 

Given that Spain is a Member State of the EU, it is subject to the application of GDPR, and we refer to the European chapter of this guide for a more detailed commentary. 

As the use of AI involves personal data processing, it entails the risk of non-compliance of the referred regulation if, for example, there is a lack of transparency about the way in which the personal data is processed or if personal data is used illegitimately.

Among all data subjects’ rights established in the GDPR, probably the right not to be subject to automated individual decisions is the one that may be most exposed by the use of AI technology. This right is intended to ensure that an individual is not the subject of automated decision-making with no meaningful human involvement or constitutes profiling of personal data that produces undesired legal effects on the individual or significantly affects the individual in a similar way.

Profiling carried out by means of AI technology will certainly imply the processing of personal data that may be intended to evaluate personal aspects, in particular analysing or predicting aspects related to any individual’s performance at work, economic situation, health, preferences or interests, reliability or simply general behaviour.

The availability of open data from Public Administrations is essential for the proper functioning of AI systems, as algorithms need to be fed and trained by data whose quality and availability allows for continuous improvement.

Thanks to the different initiatives undertaken in recent years, the already mentioned National AI Strategy highlights how Spain has become a European benchmark in the field of open data, stressing the role of the “Aporta Initiative”, a project launched in 2009 aimed at promoting the disclosure of public information and the development of advanced data-based services launched by the Ministry of Economic Affairs and Digital Transformation and Red.es, a public business entity.

This strategy also points out several key actions that can be taken in order to develop AI infrastructure in terms of open data. Among others, the development of a regulatory framework for open data, the definition of a strategy that ensures access to public administration data and the creation of the Data Office at state level, which will coordinate all public administrations with a view to standardising the storage, access and processing of data.

It is clear that the interaction of AI tools with voice and facial recognition enhance biometric information with a higher potential, but in parallel, may also generate an extraordinary (not always positive) impact on the rights of individuals.

In Spain, it is worth mentioning Report (36/2020) issued by the AEPD which analyses the use of biometric data for the purposes of facial recognition in online student’s tests. The legal report shows that consent on the part of the student can only be considered free, and therefore valid, when an equivalent alternative in terms of duration and difficulty has been offered. Additionally, said report proposes that when the legal basis for facial recognition of the students is in the public interest, this would require a regulation with the status of a law enabling it and providing specific safeguards for such processing.

In this respect, the AEPD issued a sanction in July 2021 against a retail supermarket group in for EUR 2.5 million in relation to a facial recognition system implemented by them to monitor the entry of people who were banned from accessing their shops by a judgment. 

The AEPD ruled that the processing of data based on facial recognition for identification purposes as implemented by the company was prohibited by the provisions of article 9.1, as none of the exceptions set out in article 9.2 of the GDPR for carrying out the type of processing utilised were applicable.

As AI works on the basis of algorithms, the prevailing idea is that objective and neutral decision making should be achieved and consequently become even more impartial than human decision making by way of overcoming social and cultural prejudices. However, this may not always be the case. It has been shown that the data used in AI systems often reproduce human stereotypes and biases. 

There is no doubt that the use of AI for these purposes in Spain is subject to compliance with the laws promoting equality and fighting discrimination (like any other activity). It should also be pointed out that in Spain there are also certain sector-led initiatives aimed at the adoption of self-regulatory standards designed to prevent bias and discrimination by the application of AI in business processes, based on already adopted Spanish general regulations on the protection of citizens’ rights against discrimination.

There are an increasing number of companies and public administrations in Spain that take advantage of the benefits offered by AI to automate processes. As an example, the VeriPol system, estimates the probability that a crime report is false, or the VioGén system, which indicates the dangerousness of possible male abusers by determining decisions on pre-trial detention.

As of today in Spain, with the exception of the already mentioned article 14 of the Spanish Constitution, the following are the main regulations that guarantee the equality and non-discrimination of citizens that could be invoked in the event of the use of AI systems in violation of the referred fundamental right:

• Law 3/2007 for effective equality of women and men.
• Law 14/1986 of General Healthcare. Article 3 regulates that access to and provision of healthcare shall be carried out under conditions of equality, avoiding discrimination between women and men due to their physical differences or associated stereotypes.
• Royal Decree-Law 19/2018 on payment services and other urgent measures in financial sector. This law makes reference to equality and non-discrimination in relation to payment services throughout multiple articles.
• Workers’ Statute Law (Royal Legislative Decree 2/2015). Article 4.2 paragraph (c) recognizes worker’s right not to be discriminated.
• General Law for the Defence of Consumers and Users (Royal Legislative Decree 1/2007). Consumers, in those cases in which they believe the principle of equality has been violated, have the right to know the justification for a company’s refusal to provide services or sell products to them. In the absence of a relevant explanation, the consumer may take action against the same as an infringement in accordance with article 47.1, paragraphs (k) and (m).

Competition in the digital economy has been evolving mainly due to the incorporation of innovations in business models and company strategy, as evidenced by the massive use of AI, Machine Learning and Big Data. In particular, as stated by the Spanish National Commission on Markets and Competition (CNMC) as well as by the Regional Government of Catalonia Competition Authority, the use of AI entails radical changes in the functioning of markets, and poses a series of challenges for the defence of competition. Among others:

• Data mergers or concentrations between companies handling large volumes of data, which can be comparatively more complicated to assess.
• The use of algorithms to set prices is becoming more widespread and, therefore, the possibility of algorithmic collusion increases. 
• New barriers to market entry linked to AI may emerge, including access to data, given the essential contribution of data in the operation of algorithms.

At the present time, there are no final and formal administrative or judicial resolutions in Spain containing evidence of market abuses, algorithmic collusion or dark patterns caused by using AI technology.

In the field of trade, anti-trust and competition, the main Spanish regulations governing the application of AI are:

• Law 3/1991 on Unfair Competition;
• Telecommunications Law 9/2014; and
• Order ECC/2316/2015 (Spanish Ministry of Economy and Competitiveness) on obligations of information and classification of financial products. 

The adaptation of Spanish legislation to AI is still at a progressive and preliminary stage, taking into account the lack of understanding of the nature and functioning of AI that characterises this new technology. The emergence of a domestic Spanish legal regime on AI is a slow and complex process, since, as we have already expressed in the above sections, it is not only necessary to abstract from existing legislation that may be applicable, even where AI is not expressly contemplated, but also to carry out a detailed study to ensure the development of regulations that are proportionate and consistent with the social and economic impact that AI may have.

As for new regulatory initiatives in Spain, it is worth mentioning three key initiatives for Spain’s digital transformation that have recently been approved: 

• Draft General Law on Audio-visual Communication. 

The draft law intends to modernize the audio-visual regulatory framework by establishing a regulation more in line with the digital age by governing the provision of the audio-visual communication and the video exchange services through digital platforms guaranteeing the rights of all users, including those of minors and the general public.

• Draft General Law on Telecommunications. 

It will become the Spanish implementation of the directive on the European Code of Electronic Communications. The text goes beyond the field of electronic communications networks and services to regulate aspects related to telecommunications equipment, common telecommunications infrastructures in buildings and all uses of the public radio domain. It also incorporates new measures to promote investments in the telecommunications sector with a view to achieve the goal of guaranteeing adequate high-speed connectivity to 100% of the population by 2025. The text introduces improvements to facilitate the deployment of very high capacity networks, such as: more flexible regulation for co-investment agreements between operators; a boost to the sharing of passive infrastructures; the possibility of setting out low-power base stations necessary for 5G deployment; and, promoting the secondary market for radio spectrum. Along these lines of action, a communication system is also envisaged for the Internet Exchange Points (IXP) to facilitate information collection from Data Processing Centres.

• The Charter of Digital Rights. 

Elaborated from the work carried out by the Advisory Group of Experts constituted by the Secretary of State for Digitization and Artificial Intelligence of the Spanish Ministry of Economic Affairs and Digital Transformation, the Charter does not intend to create new fundamental digital rights, but rather to somehow redefine in the digital environment the most relevant rights already recognised in the Spanish Constitution. Thus, the Charter does not intend to reach normative character as its objective focuses on acknowledging the new challenges on the application and interpretation of fundamental rights faced by the society in the digital environment as well as to propose a framework of reference for future action by public authorities. Therefore, it is important to point out that this Charter is subject to and is understood without prejudice to the legal system currently enacted in Spain. Furthermore, under the chapter "Digital Rights in Specific Environments", article XXV of the Charter of Digital Rights addresses the "Rights before Artificial Intelligence".

1. Who is liable for the damages caused by AI?

Given that AI systems do not currently have legal personality in accordance with article 322 of the Spanish Civil Code, the subject who created the AI, who must ensure in the training process that the system cannot learn things that could lead it to commit illegal acts or cause damages, shall be the potentially liable party under Spanish civil law.

2. How can I guarantee that my AI system complies with the applicable legislation?

A prior legal assessment should be carried out to determine the potential impact of your AI system on the rights of individuals, in much the same way as a DPIA (or Data Protection Impact Assessment) is carried out in relation to data processing under the GDPR. On the basis of this assessment you should take a series of steps in terms of transparency, non-discrimination and privacy in order to ensure compliance with the applicable legislation.

3. Can works created by AI be subject to IP protection? 

Under Spanish law, such protection is not currently possible as it would require a legislative change in order to broaden the concept of author or inventor to include parties other than human beings.