Spanish bodies rarely manage their information systems themselves - this is not just related to police, all public servants work with applications built by private companies.

Usually, consulting firms such as Indra and Deloitte build and maintain them after getting publicly available contracts.

You make a good point because Spanish public servants have probably never had their own systems hacked, since pretty much all the stuff they use has been built by consulting firms or contractors.