1. Constitutional Layer

Art 18.4 CE: "Law shall limit use of informatics to guarantee honour and family intimacy and full exercise of rights".

STC 292/2000 - Court held this creates autonomous fundamental right to data protection: power of disposition and control over personal data, empowering person to decide which data to provide to State or private. This is core of sovereignty - not just privacy, but control.

This means in finance, customer has constitutional right to know and control where his financial data is processed.

2. Financial Ecosystem Model in Spain

According to IMF FSAP 2024 and Bank of Spain:

Cloud outsourcing is on the rise, but core banking systems are kept on-premises. There are no cloud migration plans for short and medium-term involving core banking sectors in LSI segment. LSIs typically migrate office, collaboration, analytics, CRM to cloud

Bank of Spain / ECB Rule: Financial institutions must have available on request all appropriate information necessary to oversee compliance. Bank of Spain / ECB, CNMV and DGS have direct audit right regarding financial institutions' outsourcing arrangements

EBA Recommendations on outsourcing to cloud 2017 - Bank of Spain ensures compliance. Google Cloud contracts for financial institutions in Spain address Bank of Spain requirements

Result: Spanish model = Local nodes. Example: Devo in March 2025 launched differentiation strategy based on concept of "data sovereignty": allowing customers to keep data on local nodes within Spain built with Telefonica, rather than US or German clouds. Brought 200 new clients mainly Spanish banks

3. EU Layer - DORA - New Sovereignty

DORA Regulation 2022/2554 applies since 17 Jan 2025. Requires financial entities to maintain Register of Information on all ICT third-party arrangements and share with supervisors

DORA Head of Technological Risk Group of Bank of Spain opened lecture emphasizing DORA aims to create risk control over all external providers working with banking, thus ensuring operational security

DORA Article 31 will designate Critical Third-Party Providers (CTPP) - AWS EMEA, Microsoft Ireland, Google Cloud EMEA ∼70% EU cloud market - as systemic. This is sovereignty codified.

Problem: Ireland, Spain, France and Netherlands still outstanding on NIS2 transposition, and on 8 Jul 2026 Commission referred all four to CJEU seeking financial sanctions

4. The Spanish Innovation: Sovereignty via Electricity

Royal Decree Draft 27 Aug 2025 - Council of Ministers approved urgent processing of draft royal decree establishing new regulatory framework for data center development, linking expansion to energy sustainability, water efficiency, resilience and digital sovereignty

Applies to facilities >=1 MW, introduces grid access, water efficiency and EU data sovereignty requirements

Enforcement Mechanism Unique in EU: Spain found enforcement mechanism no other EU government has: electricity connection. Under draft, data centre's grid access permit granted on condition that it passes digital sovereignty test, and finding against it is precondition for network operator to take permit away

Draft Sovereignty Conditions:

• EU-only handling of metadata, telemetry, logs, replicas and backups for public sector workloads
• Oversight of third-country support and subcontractors, and exposure to foreign-government access demands

Enforced by loss of connection permit itself

5. Landmark Case Laws for Financial Sovereignty

A. ASNEF Cases - Core of Spanish Financial Data Protection

CJEU Joined Cases C-468/10 and C-469/10 - ASNEF v Administración del Estado - Spanish Supreme Court 28 Sept 2010 referred. ASNEF claimed that legitimate interests could not act as justification for data processing in Spain, affecting development of business as international companies deterred. CJEU held Spain cannot require additional conditions beyond Directive for legitimate interest - but also confirmed financial solvency files need proportionality.[2011]

CJEU C-238/05 Asnef-Equifax v Audiencia Nacional (2006) - Competition - system for exchange between financial institutions of information on customer solvency. Tribunal Supremo sought whether credit information register is restrictive of competition. Court held such registers can be pro-competitive if they improve risk assessment but must be proportionate.

Spanish Supreme Court - Equifax Liability - Supreme Court confirms Equifax liability and 50,000 euros fine. Contract between Equifax and Testa: Equifax as processor obliged to make request for payment prior to inclusion in ASNEF file and check letter contains warning. Establishes processor sovereignty - cannot hide behind bank.

BBVA vs Client - Tenerife Court + Supreme Court Doctrine - ASNEF Inclusion - Bank BBVA communicated data to Badex and Asnef-Equifax after client refused to pay 1,051 Euros charged illegally. Supreme Court dismissed BBVA appeal, ordered indemnity for moral damages 18,030 Euros. Later Unicaja ordered to pay 5,000 euros damages for unfair blacklisting, violation of personal honour and data protection. Spanish Supreme Court doctrine: compensation for moral damages for undue inclusion in asset solvency files is possible

B. Banking Consent Sovereignty

BBVA €5M and CaixaBank €6M - AEPD PS/00477/2019 & PS/00068/2020 - Violated Articles 6,13,14 GDPR for no specific mechanism for collection of customer consents. Options limited to marking box to oppose. This is sovereignty breach - customer lost disposition power under STC 292/2000.

BBVA Identity Verification €70k - EXP202201721 - Third party who stole identity able to withdraw money, violating Art 6 and 32 GDPR. Bank failed sovereign duty to protect access.

C. Google Spain SL v AEPD C-131/12 - Right to be Forgotten - Spanish origin case that created EU right to be forgotten from Art 18.4. Financial data old debts cannot be perpetually searchable.

D. EU Commission Fined Itself - 2025 - "Sign in with Facebook" - First time EU institution financially liable for GDPR breach due to US transfer via Facebook login. Direct Schrems II sovereignty enforcement.

6. What Sovereignty Means for a Bank in Spain Today

To be compliant you need 4 proofs:

1. Geographic Proof: Primary, replica, backup, logs, telemetry in EU-only, with grid permit proving sovereignty test passed under new Royal Decree.
2. Access Proof: No third-country remote access for support without Bank of Spain approval, and US CLOUD Act exposure mitigated via encryption where bank holds keys - Telefonica local node model.
3. Audit Proof: Bank of Spain / ECB can audit cloud provider directly - contract must include audit clause.
4. DORA Proof: Register of ICT providers, exit plan, concentration risk assessment.

If you are designing architecture for Spanish bank, use: OCI / Azure Spain Central + Telefonica as host partner for planned region to address DORA and EBA guidelines, plus deny cross-region replication policy.