The Constitutional Court has issued Ruling 142/2018, of December 20, published in the Official State Gazette No. 22, of Friday, January 25, 2019, by which it partially upholds the appeal of unconstitutionality filed by the State Attorney on behalf of the President of the Government against Law 15/2017, of July 25, on the Cybersecurity Agency of Catalonia.
The full text of the Judgment can be consulted at the following link:
The Constitutional Court declares unconstitutional and null and void paragraph 1; the clause “in relation to natural or legal persons located in Catalonia” in paragraph 3; the subsection “to plan, manage, coordinate and supervise cybersecurity in Catalonia, establishing the preventive and reactive capacity necessary to mitigate the effects of cybersecurity incidents affecting the territory of Catalonia, as well as the tests that may be organized in terms of cybersecurity and continuity” of letter b) of section 4, all of them in Article 2 of the aforementioned Law 15/2017, of 25 July, of the Cybersecurity Agency of Catalonia.
While on the other hand declaring that Article 2.2 of Law 15/2017, also challenged, is not contrary to the Constitution interpreted in the terms of legal ground 7 b) paragraph i) of the aforementioned Judgment.
The Court understands that the wording of these sections exceeds the competences of the autonomous legislator, since art. 149.1.29ª of the EC grants exclusive competence to the State in matters of public security, within which cybersecurity is integrated.
Art. 2.1 of Law 15/2017 prescribes that “the purpose of the Cybersecurity Agency of Catalonia is to guarantee cybersecurity in the territory of Catalonia, understood as the security of electronic communications networks and information systems”. The sentence explains that “the definition of the object made by the precept is very extensive in its conception, since cybersecurity is integrated in the state competences in matters of public security and telecommunications”. Therefore, this “unconditional attribution” to the Agency in the territory of Catalonia exceeds in its enunciation the margins in which cybersecurity is included in the autonomic competences.
Article 2.3 establishes that the Agency may exercise its functions “in relation to natural or legal persons located in Catalonia”. The Court also declares it unconstitutional and null and void because “it is not limited to objectives related to the need to protect the Agency’s own networks and information systems and those of individuals and other administrations that relate by electronic means with the Administration”.
With respect to letter b) of the aforementioned article 2.4, the sentence states that “the function of this section b) presupposes the design of a strategic and institutional framework in this matter that exceeds the competences of the Generalitat in this field, since it does not refer to the actions of the administration and neither can it be related to the autonomic competences derived from the creation of its own security police”.
