The Government of Spain assured the Congress of Deputies that the workers provided by the Cuban state company Grupo Palco to the Consulate General in Havana are subject to confidentiality and data protection obligations. However, a review of the contract signed between both parties does not allow for the identification of specific clauses that regulate these guarantees.
The consulted contract, corresponding to the file 2024SWs00114 and consisting of 13 pages, outlines the economic and administrative conditions for the supply of personnel; however, its clauses do not include specific provisions regarding confidentiality or the protection of personal data.
The absence of those explicit provisions is significant due to the volume of procedures handled by the Spanish Consulate in Cuba, especially the nationality applications submitted under the Law of Democratic Memory, known as the Law of Grandchildren.
These files contain personal and family information, such as birth certificates, identity documents, and other documentation necessary to establish the right to Spanish nationality.
The Spanish government acknowledges access for Palco personnel to consular documentation
In a parliamentary response dated September 23, 2026, the Spanish government stated that the access of personnel provided by Palco to documentation and computer systems "is limited to service needs and is subject to authorization, supervision, and traceability mechanisms."
He also assured that those workers "are subject to confidentiality obligations and to the regulations in force regarding data protection and information security."
However, the response does not identify the specific documents that contain these obligations nor does it detail the mechanisms employed to ensure their compliance.
The Government also clarified that the workers perform administrative, technical, and support functions under Spanish supervision and that "under no circumstances do they exercise functions reserved for Spanish public officials nor do they participate in the decision-making regarding civil registry files, passports, or visas."
The PP questions Palco's connections and the security of the files
The matter has also raised questions from the Popular Party (PP), whose deputies submitted several parliamentary initiatives in July to request explanations regarding the contracts with the Cuban state company.
In one of them, registered on July 9, the parliamentarians asked how many workers provided by Palco are involved in tasks related to the Grandchildren's Law and what access they have to files, birth records, family data, and consular computer systems.
They also requested information on measures to prevent the unauthorized copying, extraction, or use of personal data.
The PP also raised questions about possible ties between Palco and GAESA, the business conglomerate linked to the Revolutionary Armed Forces of Cuba, and requested to know whether the Spanish Government had assessed the risks stemming from these potential relationships.
The reviewed contractual documentation does not establish a connection between Palco and GAESA, while the analyzed parliamentary response does not address that issue.
Spain justifies the contract by citing a Cuban law
The Spanish government explained that the Consulate is required to hire local workers through a state-owned company, in accordance with Decree-Law 384 of 2019, which regulates the provision of personnel to foreign representations in Cuba.
According to the Executive, this mechanism has been in use since 2017 and there is no other legal modality for the direct hiring of local personnel.
The contract with Palco, signed on January 1, 2025, includes a budget of 1,131,295.68 euros for four years, until December 2028.
The agreement stipulates that the employment relationship of the workers pertains to the Cuban company, although their activities are directed and supervised by the Consulate.
Spanish and European data protection regulations establish obligations regarding security and confidentiality, which may require specific contractual instruments depending on the legal role of each entity in the processing of personal information.
Therefore, the absence of explicit clauses in the examined contract does not in itself demonstrate a legal breach, but it leaves unclear where the guarantees that the Spanish government claims to apply are documented.
The hiring with Palco had already caused controversy in Spain, both due to the involvement of a Cuban state-owned company and the conditions under which personnel are provided to diplomatic representations.
The outstanding question is to understand what protocols or supplementary agreements govern access to consular information and how, in practice, the protection of personal data for Cubans who carry out procedures at the Spanish Consulate in Havana is ensured.
Related videos:
Filed under: