The Spanish law implementing the European Union (EU) Data Protection Directive, advisory guidance on consent, facial recognition and biometric technologies from the European Union Article 29 Data Protection Working Party (WP29) , and proposals for EU data protection law reform are analyzed in this survey piece. EU legislative processes are illustrated by a specific occurence: Spanish Organic Law 15/1999 on the Protection of Personal Data is reviewed in the context of Court of Justice of the European Union (ECJ) joined cases, Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) v. Administración del Estado, and Federación de Comercio Electrónico y Marketing Directo (FECEMD) v. Administración del Estado. The addition of a condition for the processing of personal data not present in the 1995 Data Protection Directive was rejected, and in the process the ECJ case Productores de Música de España (Promusicae) v. Telefónica de España SAU is cited regarding the transposition of European directives into EU Member State national law. WP29 guidance on (i) consent to personal data processing, including in an employment relationship, and on (ii) the special risks involved in the use of facial recognition and biometric technologies, is discussed. Finally, the proposal by the European Commission of the General Data Protection Regulation is seen as the culmination of various trends in the development of EU data protection law.