합법적 감청 Spain obligations under the LGTEL create specific compliance requirements for operators. Spain’s telecommunications sector is governed by a regulatory framework that places clear and enforceable obligations on operators to support lawful interception. At the centre of this framework is the Ley General de Telecomunicaciones (LGTEL), most recently updated as Ley 11/2022, which transposes the European Electronic Communications Code into Spanish law. For operators entering or expanding in the Spanish market — including MVNOs, OTT providers, and international carriers — understanding the LGTEL’s LI provisions and the broader institutional landscape is critical to achieving compliance and avoiding enforcement actions.
Spain’s approach to lawful interception is shaped by its legal tradition, its institutional structure, and the practical requirements of a market that serves over 50 million mobile subscribers. The interplay between the LGTEL, the Ley de Enjuiciamiento Criminal (LECrim), for police and judicial investigations, and Organic Law 2/2002, under which interceptions by the intelligence service (Centro Nacional de Inteligencia, CNI) require prior authorisation by a Supreme Court judge, creates a multi-layered compliance environment that operators must navigate carefully.
합법적 감청 스페인: LGTEL 요구 사항
The LGTEL establishes the general framework for telecommunications regulation in Spain, including the obligations of operators regarding national security and lawful interception. The core obligation is article 58 of Ley 11/2022. It applies to operators of public networks and providers of number-based interpersonal communications and internet access services, including MVNOs, who must carry out judicially authorised interceptions at their own cost. The implementing detail is in Royal Decree 424/2005 (arts. 83–101). Number-independent OTT services are outside the LGTEL interception duty, but under art. 588 ter e LECrim they must still assist the court and judicial police in executing an interception order.
The procedural basis for ordering an interception is found in the LECrim (Criminal Procedure Act), which was significantly amended in 2015 through Ley Orgánica 13/2015. The amendments modernised Spain’s interception framework, introducing detailed provisions for the interception of digital communications, the use of technical surveillance measures, and the handling of metadata. Under the LECrim, interceptions must be authorised by a judge (juez de instrucción), usually upon request by the public prosecutor or the police, and must relate to intentional offences punishable by a maximum of at least three years, to organised crime or terrorism, or to offences committed using information and communication technologies (art. 588 ter a LECrim). Orders run for up to three months and can be extended to a maximum of 18 months. In urgent terrorism cases the Minister of the Interior may order the interception, subject to judicial confirmation (art. 588 ter d.3 LECrim).
또한 2015년 개정안에는 IP 기반 통신 감청, 기기에 저장된 데이터의 캡처(적절한 사법적 허가를 받은 경우), 특정 상황에서 원격 감시 도구 사용에 대한 구체적인 조항이 도입되었습니다. 이러한 조항은 진화하는 통신 기술의 특성을 반영하고 스페인의 법적 프레임워크가 사람들의 커뮤니케이션 방식 변화에 발맞추도록 보장합니다. 이는 통신 사업자의 경우 LI 기능이 기존의 음성 및 SMS 감청을 넘어 VoLTE, 데이터 세션, IP 기반 메시징 서비스까지 포함해야 한다는 것을 의미합니다.
The Role of the CNMC and the Sanctioning Authority
The CNMC is Spain’s national regulatory authority for telecommunications, responsible for overseeing the market, with a primary focus on competition and consumer protection. Operators notify the CNMC’s Registro de operadores before starting service (art. 7 LGTEL). Breaches of the LI obligations, however, are serious infringements under art. 107.43 LGTEL, sanctioned by the Secretary of State for Telecommunications and Digital Infrastructure with fines of up to EUR 2 million.
Reports from 법 집행 기관 about non-compliant operators can trigger sanction proceedings. Besides the fine, refusing to cooperate with an interception order can lead to criminal liability for disobedience (art. 588 ter e LECrim). For MVNOs and smaller operators, the risk of enforcement action is a powerful motivator for proactive compliance.
SITEL 시스템 및 법 집행 인터페이스
One of the most distinctive features of Spain’s LI landscape is SITEL, the Ministry of the Interior’s interception system used by the National Police and Guardia Civil to receive intercepted traffic. The law speaks of the receiving centres (centros de recepción) of the authorised agents (agentes facultados: police, Guardia Civil, CNI), to which operators must establish connectivity and deliver intercepted communications (art. 58 LGTEL; RD 424/2005, art. 95).
SITEL was originally developed in the early 2000s and has undergone multiple upgrades to support modern communications technologies. Orders are judicial orders served by the judicial police, and the operator confirms activation by the means agreed with the requesting agency (RD 424/2005, art. 99). Operators must implement the required handover interfaces towards the receiving centres for intercept-related information (HI2) and content of communications (HI3), in addition to the agreed order-handling procedure (HI1).
The handover interfaces and formats are defined by technical specifications issued by the ministry responsible for telecommunications (art. 58.10 LGTEL). The receiving centres of the authorised agents provide the connection details during onboarding. This can be a source of difficulty for foreign operators unfamiliar with the Spanish institutional landscape, as the information is not always readily accessible and the onboarding process may require navigating bureaucratic procedures that are less transparent than in some other European markets.
It is worth noting that SITEL has been the subject of public debate in Spain, particularly regarding its oversight mechanisms and the potential for misuse. The system’s operation is subject to judicial control: interceptions require a judicial authorisation or, in urgent terrorism cases, a ministerial order that a judge must confirm. However, operators should be aware of the political and public sensitivity surrounding SITEL and ensure that their compliance processes include robust safeguards for the protection of intercepted data.
데이터 보존 의무
Spain’s 데이터 보존 regime operates under Ley 25/2007 (the Data Retention Act), which requires operators to retain specified categories of traffic and location data for a period of twelve months. This data must be available for disclosure to competent authorities in response to a valid judicial order. The retained data categories include calling and called numbers, the date, time, and duration of communications, the type of service used, and location data for mobile communications.
디지털 권리 아일랜드와 텔레2 스베리게에 대한 CJEU의 판결로 인해 포괄적 데이터 보존과 EU 기본권의 양립 가능성에 대한 의문이 제기되었지만, 스페인은 데이터 보존 법안을 유지하고 있으며 운영자는 법이 개정되거나 스페인 법원에 의해 취소되지 않는 한 해당 규정을 준수해야 할 것으로 예상됩니다. 데이터 보존 제도의 변경은 규정 준수 의무 및 기술 인프라에 중대한 영향을 미칠 수 있으므로 운영자는 이 분야의 발전 상황을 면밀히 모니터링해야 합니다.
데이터 보존과 실시간 차단 간의 상호 작용은 중요합니다. 데이터 보존에는 과거 메타데이터의 저장 및 추후 공개가 포함되는 반면, 합법적인 감청에는 메타데이터와 콘텐츠의 실시간 캡처 및 전달이 포함됩니다. 운영자는 두 기능에 대해 분리되어 있지만 잠재적으로 중복될 수 있는 기술 역량을 유지해야 하며, 시스템은 두 가지 유형의 요청을 관련 법적 요건을 준수하면서 효율적으로 처리할 수 있어야 합니다.
MVNO별 과제
MVNOs operating in Spain face the familiar challenge of legal responsibility for interception combined with technical dependence on the host MNO. The LGTEL does not provide a reduced obligation for virtual operators. If you operate a public network or provide number-based interpersonal communications or internet access services, you must be able to comply with lawful interception orders. This means either deploying your own LI infrastructure or establishing a formal, technically validated arrangement with your host MNO.
The Spanish market has several active MVNOs, many of which operate on the networks of the major MNOs — Movistar (Telefónica), MasOrange, Vodafone and Digi. The LI arrangements between MVNOs and their host MNOs vary significantly, and operators should not assume that their MNO partner will handle all interception obligations automatically. Explicit contractual provisions covering the scope of interception services, response times, data delivery formats, and cost allocation are essential.
One area of particular complexity is the MVNO’s connectivity to the receiving centres of the authorised agents. In some cases, the host MNO may provide this connectivity as part of the wholesale arrangement. In other cases, the MVNO may need to establish its own connection. The appropriate model depends on the MVNO’s architecture, the terms of its wholesale agreement, and the requirements of the relevant law enforcement agencies. Operators should clarify this point early in the planning process to avoid delays in achieving compliance.
VoLTE interception is another area where MVNOs in Spain must pay close attention. As Spanish operators retire 3G and move voice to VoLTE, the technical requirements for voice interception have changed significantly. MVNOs that rely on their host MNO for VoLTE services must ensure that voice interception is included in their LI arrangements and that the technical implementation meets the requirements of the receiving centres.
기술 요구 사항 및 ETSI 정렬
Spain’s technical requirements for lawful interception are generally aligned with ETSI standards, but with the national adaptations set out in the ministry’s technical specifications (art. 58.10 LGTEL). Operators must support the delivery of IRI and CC through interfaces that conform to these specifications. The IRI must include comprehensive metadata about the intercepted communication, including identifiers (MSISDN, IMSI, IMEI), timestamps, cell and location information, and IP addressing data where applicable.
음성 가로채기의 경우, 콘텐츠는 실시간 오디오 스트림으로 전달되어야 합니다. 데이터 감청의 경우, 콘텐츠는 대상의 세션과 관련된 IP 패킷으로 구성됩니다. 기술 구현은 여러 개의 동시 차단을 지원해야 하며 대상의 서비스 또는 더 넓은 네트워크에 인지할 수 있는 성능 저하를 유발해서는 안 됩니다. 또한 운영자는 인증, 암호화, 감사 로깅 등 감청 명령을 안전하게 관리할 수 있는 메커니즘을 구현해야 합니다.
Testing and validation of the operator’s LI capability is an important part of the compliance process. While the formal testing procedures may vary depending on the authorised agent and its receiving centre, operators should expect to demonstrate their systems’ capabilities through a series of test scenarios covering voice, SMS, and data interception. Successful completion of these tests is a prerequisite for receiving live interception orders.
운영자를 위한 실용적인 권장 사항
스페인의 LI 요건을 준수하기 위해 준비하는 운영자는 몇 가지 실질적인 단계를 우선적으로 고려해야 합니다. 먼저 LGTEL, LECrim 및 Ley 25/2007을 검토하여 법적 의무의 전체 범위를 파악하세요. 다양한 법적 도구 간의 상호 작용에는 전문 지식이 필요하므로 통신 전문 지식을 갖춘 스페인 법률 고문과 협력하세요.
Second, obtain the current technical specifications from the ministry responsible for telecommunications, and contact the receiving centres of the authorised agents (police, Guardia Civil, CNI) to agree the connections and tests. Then plan your technical implementation. Plan the six to twelve months of build and testing before launch: once live, an order without its own deadline must be executed by noon on the next working day (RD 424/2005, art. 99), and the handover interfaces must be ready at all times (art. 58.10 LGTEL).
Third, if you are an MVNO, review your wholesale agreement with your host MNO and ensure that LI obligations are explicitly addressed. Clarify the technical model for interception, the responsibilities of each party, and the arrangements for connectivity to the receiving centres of the authorised agents. Fourth, implement robust internal processes for handling interception orders, including access controls, confidentiality procedures, and audit trails. Finally, stay informed about regulatory developments, particularly regarding data retention and any changes to the SITEL system or its technical requirements.
결론
Spain’s lawful interception framework, anchored by article 58 of the LGTEL and Royal Decree 424/2005 and operationalised through the receiving centres of the authorised agents, presents a comprehensive compliance challenge for operators. The combination of broad legal obligations, several receiving centres with their own connection requirements, active data retention requirements, and the practical complexities of the MVNO model demands careful planning and sustained attention. Operators that invest in understanding the Spanish regulatory landscape and building compliant LI capabilities from the outset will be well positioned to operate successfully in one of Europe’s largest and most dynamic telecommunications markets.
스페인의 합법적 감청 규정 준수를 위해서는 규제 당국과 지속적으로 협력해야 합니다. 운영자는 합법적인 감청 스페인 구현이 기술 및 절차적 요건을 모두 충족하는지 확인해야 합니다.
관련 기사
관련 주제에 대한 자세한 내용은 다음 문서를 참조하세요:
- Italy’s LI Framework: Prosecutors, the Codice and What Foreign Operators Miss
- France’s LI Landscape: CPP, CSI, CPCE and the PNIJ/GIC Channels
- UAE 및 걸프 국가에서의 합법적인 감청: 시장에 진출하는 유럽 사업자가 알아야 할 사항
외부 리소스
다음 외부 리소스에서 추가 컨텍스트와 공식 문서를 확인할 수 있습니다:
