Discovery and Disclosure of Secrets in Marbella

Two basic forms: communications (Article 197.1) and data files (Article 197.2)

Article 197.1 of the Criminal Code punishes anyone who, in order to discover another's secrets or violate their privacy, without their consent, seizes their papers, letters, emails, or any other documents or personal effects, intercepts their telecommunications, or uses technical devices for listening to, transmitting, recording, or reproducing sound or images. Article 197.2 of the Criminal Code, for its part, specifically protects personal or family data recorded in files or on computer media, punishing anyone who, without authorization, seizes it, uses it, or modifies it to the detriment of a third party. Case law has clarified that the "seizure" required by both provisions does not demand physical apprehension: it is enough to obtain the content by any technical means allowing its subsequent reproduction, including simply viewing or photographing it.

The moment of consummation: mere access already constitutes the offense

One of the issues of greatest practical significance is that the offense is consummated by the simple unauthorized access, without it being necessary to read the messages in full or subsequently disclose them:

"...se consuma tan pronto el sujeto activo 'accede' a los datos, esto es, tan pronto los conoce y tiene a su disposición, pues solo con eso se ha quebrantado la intimidad protegida."

(The offense is consummated as soon as the perpetrator "accesses" the data — that is, as soon as they become aware of it and have it at their disposal, since that alone breaches the protected privacy.) This doctrine means that simply viewing the inbox of another person's email account, without needing to open a single message, already satisfies the statutory definition. Our defense accordingly focuses on establishing the existence of consent — express or tacit — from the holder of the account or device, a circumstance that entirely excludes the offense and that constitutes, in practice, the most common line of defense in the context of couples or former couples who shared access credentials.

The aggravating circumstance of disclosure (Article 197.3 CP) and non-consensual sexting (Article 197.7 CP)

Article 197.3 of the Criminal Code imposes a higher sentence — from two to five years' imprisonment — on anyone who discloses, reveals, or transfers to third parties the data, facts, or images discovered, with a reduced penalty where the person disclosing them did not take part in the original discovery. Alongside this offense, Article 197.7 of the Criminal Code separately punishes the disclosure, revelation, or transfer to third parties of images or audiovisual recordings of another person obtained with their consent at their home or any other place beyond the sight of third parties, when they seriously affect that person's privacy and are carried out without their consent — the scenario known as "revenge porn" or non-consensual sexting — with the sentence aggravated to its upper half when the acts were committed by a spouse or partner, or when the victim was a minor or a person with a disability in need of special protection. Case law has clarified that these offenses are semi-public: prosecutable only upon a complaint by the victim, except where the victim is a minor or a person with a disability, in which case the Public Prosecutor's Office may act ex officio.

Unlawful access to computer systems (Article 197 bis CP): "hacking" properly speaking

Article 197 bis of the Criminal Code separately punishes, regardless of whether specific personal data is actually accessed, anyone who accesses all or part of an information system without authorization by breaching the security measures established to prevent it, or remains within it against the will of the person with the legitimate right to exclude them. This is the offense applicable to unauthorized access to email accounts, social media, or mobile devices through the breaching of passwords or security measures, regardless of the content ultimately accessed. Article 197 ter of the Criminal Code further punishes, as an autonomous preparatory act, the production, acquisition, or supply of computer programs or of passwords and access codes specifically designed to commit these offenses.

Frequently invoked defenses and their rejection by case law

In the context of a couple or former couple, it is common for the person under investigation to invoke necessity — to uncover an infidelity — or the legitimate exercise of a right as a justification for accessing another's device. Case law systematically rejects these arguments, on the grounds that there is no serious and imminent danger of the kind necessity requires, nor any right that legitimizes non-consensual access to another person's private communications, whatever the romantic relationship between them. In the employment context, the mere fact that an employer provides a corporate email account to an employee does not legitimize access to that employee's personal correspondence without express authorization and without observing the previously notified monitoring protocols, a matter on which there is settled case law taking a restrictive approach.