From the ministerial order to the AI Act: forty years of legal evolution of private investigation in Spain
Método 3 was born in 1985.
That year, a Spanish private investigator practised a profession with a long tradition, but one still resting on a regulatory framework far more fragile than today's.
Four decades later, the same profession has a modern law, a statutory reserve of activity, state-issued licensing, intense administrative oversight, rules on legitimate interest, proportionality, data protection, and a regulatory horizon that already includes artificial intelligence.
This journey is also the story of our own firm.
The 1980s: a profession still resting on regulatory rules
The Ministry of the Interior's Order of 20 January 1981 regulated essential aspects of the activity.
One clarification is worth making: that Order wasn't pre-constitutional — it was approved after the 1978 Constitution — but its regulatory (sub-statutory) rank proved insufficient to sustain certain restrictions and a sanctioning regime within the new constitutional framework.
Constitutional Court ruling STC 61/1990 declared certain provisions of the then-current system contrary to the principle that such matters be reserved to statute.
That ruling shook the sector, but it was also an opportunity: it forced the construction of a regulation with sufficient statutory rank.
In one passage the ruling used the expression "special relationship of subjection" ("relación especial de sujeción"), but later constitutional case law has warned that this reference must not become an automatic label capable of justifying any restriction whatsoever. What matters today is to speak of an intense administrative regime of licensing, obligations, inspection, and sanctions, clearly established by statute.
1992: the first major modern Private Security law
Law 23/1992 marked the sector's regulatory coming of age.
It placed private investigation within a legal system of private security and strengthened the figure of the licensed investigator.
Professional reserve
Private investigation became framed within the figure of the licensed private investigator, displacing parallel "investigator" formulas that sought to perform equivalent functions without submitting to the same statute.
The Supreme Court would later reaffirm that the legislator had chosen to unify private investigation in the figure of the investigator.
Criminal-law limit
The regulation maintained a clear boundary regarding the investigation of publicly prosecutable offences: the investigator doesn't replace the judicial police, the Public Prosecutor's Office, or the courts.
When an assignment specifically consists of investigating a crime, current legislation reserves to the investigator only the investigation of offences that are prosecutable solely at the request of a party, and only when commissioned by those with standing to do so.
I wouldn't claim that Spain is "the only country in our environment" with this restriction without a specific comparative study. What can be said is that this is a characteristic and especially significant restriction of our model.
Administrative oversight
Licensing, registers, logbooks, inspection, and a sanctioning regime became part of a far more structured professional model.
We grew up with that law, and ratified reports throughout the years in which case law was shaping the investigator's evidentiary status.
2000: the LEC expressly recognizes the investigator's report
The 2000 Civil Procedure Act (LEC) marked another decisive moment.
Article 265.1.5 expressly recognized reports prepared by legally licensed private investigation professionals on facts relevant to the parties' claims.
And Article 380 regulated the testimony of their authors.
The investigator stopped appearing only through case-law constructions: their report entered expressly into the text of procedural law.
2014: the law of maturity
Law 5/2014 is the current framework, and probably the text that has best conceptualized the profession.
It defined private investigation services.
It turned a demonstrated legitimate interest into an express condition for accepting an assignment.
It established limits regarding homes and reserved places.
It gave statutory force to the principles of reasonableness, necessity, suitability, and proportionality.
It regulated the report, its content, minimization, retention, and confidentiality.
And it strengthened the structure governing agencies, contracting, and oversight.
The profession stopped being regulated only by "what it may do" and came to be regulated also by why it may do it, how far it may go, and how it must document it.
2016-2018: data protection as a second layer
The 2016 General Data Protection Regulation and the 2018 LOPDGDD made explicit a reality private investigation already knew: investigating means processing personal data.
From that point on, the investigator needs not only a legitimate interest under the Private Security Act.
They must also analyse the legal basis for the processing, its purpose, minimization, proportionality, security, retention, and the data subject's rights.
This didn't reduce the usefulness of the profession.
It made it more demanding.
2020-2026: the expectation of privacy and technological scrutiny
Recent years have added a new layer, largely developed by the courts.
STS 380/2023, on the garden, showed that the old rule of "public way yes / home no" was too simple.
A legitimate expectation of privacy requires analysing spaces, context, visibility, and the technical means used.
STS 278/2021, on GPS, was a reminder that a technologically available means can turn out to be disproportionate because of the intensity of the monitoring it enables.
And recent rulings on zoom lenses, balconies, and adjoining spaces show that the court no longer asks only where the investigator was standing.
It also asks what they could see without the device.
Artificial intelligence: the next frontier
EU Regulation 2024/1689 on Artificial Intelligence introduces a new regulatory layer.
Since 2026, transparency obligations relevant to synthetic content and deepfakes have begun to take effect.
For private investigation, the impact will be broader.
AI applied to OSINT.
Classification of large volumes of data.
Image analysis.
Pattern detection.
Authentication of evidence.
Generation of synthetic content.
All of this demands something that at M Intelligence we sum up in one idea: traceability between data, purpose, legal basis, and outcome.
The more powerful the tool, the more important it becomes to know where each piece of data came from and why it could be used.
What forty years teach us
Viewed in perspective, this evolution traces a constant.
Every new regulatory requirement has weakened the improvised investigator and strengthened the professional who works properly.
The reserve of statutory rank drove out regulatory arbitrariness.
The 1992 regulation put order into the sector.
The LEC gave the report procedural recognition.
Law 5/2014 required cause, proportionality, and minimization.
The GDPR raised the standard for data.
Modern case law has raised the standard for privacy.
And AI will raise the standard for traceability and authenticity.
Conclusion
Método 3 was born in 1985 and has worked for four decades while the profession changed around us.
We haven't gone from a profession with no rules to a profession hemmed in by too many rules.
We've gone from a more rudimentary framework to a profession that is more recognizable, more professional, and more defensible before the courts.
The legal history of private investigation in Spain is, to a great extent, the story of how the trade learned to turn technique into evidence and discretion into responsibility.
Or, in our own motto:
truth kept gaining method.
Related reading: La IA: Asedio a la privacidad — Editorial Tirant Lo Blanch
Truth has a method.