The compliance of the LOPD (LO 15/1999 on Personal Data Protection) and its development regulation (RD 994/1999, Ordinance of Security Measures of Automated Files that contain Personal Data) applies to the legalization, legal standing and personal data files protection, as well as to the practical application in organizations, that is, the incorporation of the governing principles of personal data protection to the dynamics of the enterprise.

The incorporation of the governing principles of the personal data protection to the rules of enterprises is important from the moment when the violation of the law generates responsibilities for the organization as well as for the personnel who has access to the personal data. Penalties are not only administrative and addressed to the organization, but they can also result in accountabilities in terms of civil, criminal and labor regulations.

Administrative: Penalties estimated in the LOPD and imposed by the Spanish Agency of data protection when executing its roles, ex officio or upon request of a party. These penalties are economic and the amount is between 601,01 and 601.012,10 euros.

Civil: Articles of the Civil Code relative to the contractual and extra contractual responsibility (art. 1902 and 1903 CC). When a particular service is contracted between a third party and the organization and this implies an access to the personal data files, there should be preceded by a contract for the access to the personal data with a limitation to its usage by the third party, a specification of security measures to be observed by the third party for the file protection, and the determination of the derived responsibilities of the non-fulfillment of the LOPD or as articulated in the contract.

Penal: The Penal Code establishes offenses against privacy, particularly the disclosure of secrets in the articles 197 and the following articles. For instance, recently, a public official of Social Security has been convicted to five years and three months in prison, a fine of 330.556 euros and special disqualification for public positions for 11 years due to the sale of personal data of national insurance payers.

Labor: Lost of data, improper treatment of personal data files, unauthorized access to personal data, and improper protection of files can occur within the organization. When a penalty is imposed to the organization, labor responsibilities can be imposed as well.

As a consequence, it is absolutely necessary to establish additional measures for the appropriate application of the Law on data protection in enterprises, in order to inform and train the personnel who deal with data, independently from their position or function.

As principal action addressed to inform and train personnel with regards to the principles of personal data treatment, we can find the following:

Establishment of data treatment policy within the organization. The policy of data treatment must be delivered to each employee who deals with personal data treatment. The employee must sign it after being instructed about the policy. This policy informs about the character and objectives of the LOPD and its development regulation, basic obligations, and different principles, actions and procedures that should be adopted in daily operation of the enterprise.

Furthermore, employees can be informed about other measures or security policies of the implemented information systems by the organization, and about the responsibilities that can be incurred from its violation.

Training on protection of information. Another possible measure that can be adopted is the establishment of training seminars or conferences on data protection within the organization. The main advantages of the training are: -Information and training for employees, -Personal training for each enterprise. Analysis of special cases of each organization and their particular problems, -More participation of employees. They can consult and comment on the particularities of each work place.