Cotino and Pérez Bes to led the Spanish Data Protection Agency

The Spanish Data Protection Agency (AEPD) has appointed Lorenzo Cotino Hueso as President and Francisco Pérez Bes as Deputy, following a rigorous selection process based on merit, competence, and suitability. Their appointments, published yesterday at the BOE, were confirmed by a favorable vote in the Spanish Congress.

Lorenzo Cotino Hueso, a professor of law at the University of Valencia for over 30 years, holds a PhD and a law degree from the same institution. He has extensive academic credentials, including a Master’s in Fundamental Rights from ESADE, and has served as a Constitutional Law Professor since 2017. Cotino is a prolific researcher and author, with 14 monographs, over 200 academic publications, and leadership in numerous privacy and data protection projects. He has also held key advisory and judicial roles, including as a substitute magistrate in the High Court of Justice of Valencia (2000–2019) and Vice President of Spain’s Open Government Forum. Since 2020, he has been the Privacy Director of OdiseIA, the Observatory for Ethical and Social Impact of AI.

Francisco Pérez Bes, a lawyer with specialized studies in business law, cybersecurity, and corporate finance, has extensive leadership experience in the legal and cybersecurity sectors. He was Secretary General and Data Protection Officer at the National Cybersecurity Institute of Spain (INCIBE) from 2014 to 2019 and served as Compliance Officer at Ladbrokes Betting & Gaming (2011–2014). His expertise has earned him multiple accolades, including the Cyber Defense Medal and the Merit Medal from the Civil Guard. He has also published extensively on data protection and cybersecurity.

The appointments were made in accordance with Article 48 of the Organic Law on Data Protection and Digital Rights, which mandates that the AEPD’s leadership be selected from individuals with recognized professional expertise, particularly in data protection. Following evaluation by a selection committee, the appointments were ratified by the Spanish Congress’s Justice Committee on February 19 by an absolute majority.

Both appointments carry a five-year term, renewable for an additional five years. These leadership changes mark a significant step in strengthening Spain’s data protection framework amidst evolving technological and regulatory challenges.