Read and Download HERE the report of Spain's legal framework when it comes to processing health data.
"The Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD) is the independent state control authority responsible for ensuring compliance with regulations on data protection. It ensures and oversees the fundamental right to the protection of personal data of the population".