Article 30 to 43 of Law 8/2005 (Personal Data Protection Act) provide for a penalty system that covers administrative offences and crime. Article 28 of the same law provides that, when the data subject finds their personal data abused, they may lodge complaints with the PDPB. If the PDPB thinks that the reported case involves crime, the case will be referred to judicial authorities to follow. Where the reported case involves issues of proportionality but no administrative offence, the PDPB will deliver an advisory to the institution concerned, urging it to handle personal data in appropriately.