The Spanish government has asserted before the Congress of Deputies that employees provided by the Cuban state enterprise Grupo Palco to the Spanish Consulate in Havana are bound by confidentiality and data protection obligations. However, a review of the signed contract between the two parties reveals no specific clauses governing these assurances.
The contract in question, referenced as file 2024SWs00114 and spanning 13 pages, outlines the economic and administrative conditions for personnel provision, yet it fails to include specific provisions regarding the confidentiality or protection of personal data.
This absence of explicit provisions is significant given the volume of transactions handled by the Spanish Consulate in Cuba, particularly applications for nationality under the Democratic Memory Law, commonly referred to as the Grandchildren's Law.
These applications include personal and familial information, such as birth certificates, identity documents, and other necessary records to validate the right to Spanish nationality.
Spanish Government Acknowledges Palco Staff's Access to Consular Documentation
In a parliamentary response dated September 23, 2026, the Spanish government stated that Palco's provided personnel access documentation and IT systems only as service necessities dictate and are subject to authorization, supervision, and traceability mechanisms.
The government also affirmed that these workers are subject to confidentiality obligations and must adhere to current data protection and information security regulations.
Nevertheless, the response does not specify which documents outline these obligations or detail the mechanisms employed to ensure compliance.
The government clarified that these workers perform administrative, technical, and auxiliary roles under Spanish supervision and are not involved in duties reserved for Spanish public officials, nor do they participate in decision-making on civil registry, passport, or visa files.
Concerns from the Popular Party on Palco's Connections and Data Security
The issue has also raised concerns from the Popular Party (PP), whose deputies submitted multiple parliamentary initiatives in July to request explanations about the contracts with the Cuban state enterprise.
In one such initiative, registered on July 9, the deputies inquired about the number of Palco-provided workers involved in tasks related to the Grandchildren's Law and what access they have to files, birth certificates, family data, and consular IT systems.
They also sought information on measures to prevent unauthorized copying, extraction, or use of personal data.
The PP further questioned potential ties between Palco and GAESA, a business conglomerate linked to Cuba's Revolutionary Armed Forces, and asked whether the Spanish government had assessed the risks stemming from these possible connections.
The contractual documentation reviewed does not establish a connection between Palco and GAESA, and the parliamentary response does not address this issue further.
Spain Justifies Contract Based on Cuban Law
The Spanish government explained that the Consulate must hire local workers through a state enterprise in compliance with Decree-Law 384 of 2019, which governs the provision of personnel to foreign representations in Cuba.
According to the government, this mechanism has been in use since 2017, and no other legal modality allows for the direct hiring of local personnel.
The contract with Palco, signed on January 1, 2025, includes a budget of 1,131,295.68 euros for four years, extending until December 2028.
The agreement specifies that the labor relationship of the workers is with the Cuban company, although their activities are directed and supervised by the Consulate.
Spanish and European data protection regulations impose security and confidentiality obligations, which may require specific contractual instruments depending on the legal function of each entity in processing personal information.
Thus, the lack of explicit clauses in the reviewed contract does not alone indicate legal non-compliance, but it leaves unanswered where the guarantees that the Spanish government claims are applied are documented.
The arrangement with Palco has previously sparked controversy in Spain, due to the involvement of a Cuban state enterprise and the conditions under which personnel is provided to diplomatic representations.
The unresolved question is what protocols or supplementary agreements regulate access to consular information and how the personal data protection of Cubans engaging with the Spanish Consulate in Havana is practically ensured.
Key Concerns About Spanish Consulate's Data Protection Practices
What is the main concern regarding the contract with Grupo Palco?
The main concern is the absence of specific clauses in the contract ensuring confidentiality and data protection, despite these being critical given the sensitive personal information handled by the Consulate.
Why is the involvement of Grupo Palco controversial?
The involvement of Grupo Palco is controversial due to its status as a Cuban state enterprise and potential ties to GAESA, raising concerns about data security and the influence of the Cuban government.
How does the Spanish government justify the use of Palco's services?
The Spanish government justifies using Palco's services by citing Cuban law, specifically Decree-Law 384 of 2019, which mandates the hiring of local workers through a state enterprise for foreign representations.