Article 88.2 of Value Added Tax Law 37/1992 states that VAT shall be charged through the invoice, on the conditions and with the requirements determined by regulations. A clear indication that the new invoicing regulations approved by Royal Decree 1619/2012, of November 30, 2012, aim to promote electronic invoicing is that they establish the same treatment for electronic invoices as for paper invoices. A new definition is provided for electronic invoice, i.e., an invoice that meets the requirements established in the Royal Decree but which has been issued and received on electronic format.

Therefore, this equal treatment for paper and electronic invoices broadens the possibilities for the supplier to be able to issue invoices electronically without needing to use specific technology to do so.

This obligation to issue electronic invoices applies regardless of the contracting channel used (face-to-face or distance, electronic or non-electronic), provided that the customer agrees to receive them or has expressly requested them. However, travel agencies, carriage services and retail trade businesses are only required to issue electronic invoices where the contracting has taken place by electronic means.

In any event, it is the recipient of the invoices who has the power to give his or her consent to the issuance and sending of invoices in electronic format and to revoke such consent in order to receive them on paper again. In the absence of consent, the trader should issue and send the invoices on paper.

The Electronic Signature Law 59/2003 of December 19 aims to promote more widespread use of electronic signatures as an instrument that generates trust and security in telematic communications, thereby contributing to the development of e-commerce and of the “e-government.”

“Electronic signature” is defined by the Law as a set of data, in electronic form, attached to or associated with other electronic data, which can be used as a method for identifying the signatory. A separate class of electronic signature is the “advanced electronic signature,” which is recognized as a signature which permits the signatory to be identified and the integrity of the data signed to be verified, since it is linked exclusively to the signatory and to the data to which it relates and since it has been created by means that the signatory can keep under his sole control.

The Law includes the concept of “recognized electronic signature”, defining it as an advanced electronic signature based on a certificate recognized and generated through a secure-signature-creation device.

Under the referred Law, both individuals and legal entities can act as signatories. In this way, the Law aims to encourage the placing of orders and issuing of invoices by telematic means, while at the same time safeguarding legal certainty for the entity holding the electronic signature and for the third parties who have dealings with it. However, electronic certificates of legal entities will not alter civil and commercial legislation as regards the provisions governing the concept of the hierarchical or voluntary representative.

At present, the applicable legislation on these matters in Spain, as in the rest of the European Union, is the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), known as GDPR.

In the framework of the GDPR, which is directly applicable in Spain since 25th May 2018, the Constitutional Law on the Protection of Personal Data and guarantee of digital rights (LOPD-gdd) has been passed, repealing the previous Constitutional Law 15/1999, of 13 December, on Personal Data Protection. The LOPD-gdd regulates some aspects of the processing of an individual’s personal data within the margins that the GDPR allows to the EU Member States.

The GDPR applies to “personal data,” meaning any information concerning identified or unidentified individuals. Accordingly, it does not apply to data concerning legal entities; however, as opposed to the previous legislation in Spain, it applies to data concerning individual entrepreneurs or individuals being the contact person of a legal entity where the personal data is used.

Personal data protection legislation revolves around the following principles:

Sanctions for infringement of GDPR may consist of fines of up to €20,000,000 or 4% of the global annual turnover of the group during the previous fiscal year.
The data controller has to rely on one of the legal basis established in the GDPR in order to be able to process personal data.
The processing of specially protected data (i.e., data referring to ideology, labor union membership, religion, beliefs, ethnicity, health, and sex life) is subject to very strict limitations or, in some cases, prohibitions.
The data subject must be informed of a number of matters in relation to the envisaged processing of his or her personal data.
Personal data may only be processed where they are adequate, relevant and not excessive in relation to the purpose for which they have been obtained.
Personal data may only be disclosed if a legal basis applies.
When the communication is addressed to a third party classified by the Law as a data processor, which provides a service entailing access to such data, prior consent by the data subject is not required, but the relationship must be regulated in a contract for services that includes a number of provisions established by the GDPR.
Data subjects are granted the rights of access, rectification, cancellation, and opposition to the processing of their personal data, as well as other new rights such as portability or limitation of the processing.

Law 34/2002 on E-Commerce and Information Society Services (ECISSA) defines as “information society services” any service provided for a valuable consideration, long-distance, through electronic channels and upon individual request by the recipient, also including those not paid for by the recipient, to the extent that they constitute an economic activity for the provider. Specifically, the following are deemed to be information society services:

Contracting for goods and services through electronic means.
Organization and management of auctions using electronic means or of virtual shopping centers or markets.
Management of purchases on the network by groups of persons.
Sending of commercial communications.
Supply of information through telematic channels.
Video upon demand, as a service that the user may select through the network and, in general, the distribution of contents upon individual request.

Except for Spain’s commitments to the European Union (“EU”) on value added tax (“VAT”), at present there is no in force tax regime in Spain that specifically regulates the trading of goods and services on the Internet. Therefore, the same taxes and the same rules as those for other forms of commerce apply to e-commerce. This approach is in tune with the principles enunciated by the Spanish Tax Agency in the Report of the Commission analyzing the impact of e-commerce on the Spanish tax system, prepared by the Office of the Secretary of State for Finance.