GDPR, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.
Directive (EU) 2016/680 Regulation (EU) 2008/977 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Framework Decision 2008/977
Directive 2013/37/EU Regulation (EC) No 2003/98/EC of the European Parliament and of the Council of 26 June 2013 amending Directive 2003/98/EC on the re-use of public sector information
Additional Provision 21 of Organic Law 4/2007 which modifies Law 6/2001, of December 21, on Universities (non-necessary consent of students to publish grades).