Primary issues: Constitution and procedural process
This answer to a previous question quotes and briefly explains the relevant articles of the Spanish Constitution. The Spanish Wikipedia page Proceso soberanista de Cataluña de 2012-2017 outlines various actions taken by Catalan politicians and ruled unlawful by the Constitutional Court over several years. The consultation of 2014 is particularly relevant. Summarising the highlights of the summary (which mix the legal with the political):
- A national law passed in 1980 allows regional governments to hold non-binding referenda but only under licence from the national government.
- The 2006 regional constitution of Catalonia claimed the exclusive right to hold "popular consultations". This was struck out by the Constitutional Court in 2010.
- In January 2013, the Catalan parliament passed a resolution claiming that the people of Catalonia had "the character of a sovereign political and juridical subject" and affirming its right to decide its future by referendum. In May the Constitutional Court agreed to hear a case brought by the national attorney general's office which argued that it was an "open challenge to the Constitution", and in consequence automatically suspended this resolution provisionally. In March 2014 it passed sentence, ruling the resolution inconstitutional and void, but that the references to the "right to decide" were constitutional if they were interpreted as referring to the right to participate in regional and national politics and to hold referenda in accordance with national law.
- Meanwhile, in December 2013 the president of Catalonia, Artur Mas, announced a referendum for November 2014 which would ask two questions. The national government immediately responded that it would not be held because the content of the questions made it unconstitutional. In January 2014 the Catalan parliament passed a law authorising the Catalan government to hold a referendum on terms agreed with the national government.
- In April 2014, the national parliament voted heavily against permission to hold a referendum. In response, the Catalan government decided to hold a "non-referendum popular consultation" instead of a referendum.
- In September 2014 the Catalan parliament passed the "Law of non-referendum popular consultations and citizen participation", and shortly afterwards Mas signed a decree to call a consultation, saying that "the moment has come to exercise the right to decide". The national government immediately took the matter to the Constitutional Court, which automatically suspended the law and the decree provisionally and ordered that no work be carried out on preparations until it had made its ruling.
- The Catalan government again changed tack and began to organise an unofficial consultation, avoiding documentation and relying on volunteers. The national government again took matters to the Constitutional Court, on the basis that it was using the same question and public resources. The Constitutional Court automatically suspended the new process, just days before it was due to occur.
- The day before the consultation, the Catalan prosecutors' office opened a case to investigate whether the use of public buildings was a crime.
- Voting began at 9 a.m. on the 9th of November. On the same day certain political organisations asked the courts to intervene and stop it as contempt for the Constitutional Court's injunction, and a case was opened to investigate possible crimes of contempt (literally disobedience), misconduct in public office, and misuse of public funds.
- Shortly afterwards the public prosecutor charged the Catalan president (Mas), vicepresident, and minister of education (responsible for the use of schools as polling stations) with those three crimes and with exceeding their legal authority. In March 2017 they were convicted of contempt but acquitted of misconduct. All three were fined and barred from public office for varying amounts of time, and the Court of Public Accounts found Mas personally liable to reimburse five million euros of public money spent on the consultation.
With all that as background, we can skip to recent months. Since this is already a long answer, I'll skip a lot.
- In September 2017 the committee of the Catalan parliament which determines the agenda for the parliament voted to use emergency procedures to (briefly) debate and pass a law enabling a binding referendum. This went against the advice of the parliament's lawyers that previous rulings of the Constitutional Court required the committee to prevent the law from being placed on the agenda, and that even were that not the case, it was an illegal use of the emergency procedures. The secretary of the parliament refused to publish the proposed law, so the president of the Catalan parliament (not the same as the president of the Catalan government!) did it herself. The proposal was debated for 45 minutes and passed. Shortly thereafter the Catalan government issued a decree implementing the law.
- The following day it was referred to the Constitutional Court, which again automatically suspended it provisionally. In addition, the public prosecutor laid charges of contempt of the Constitutional Court, misconduct in public office, and misuse of public funds against various of the politicians involved.
- The day after that, the highest regional court ordered the seizure of ballot boxes and other paraphernalia related to the ballot.
- On the 19th of September the Constitutional Court ruled that the use of emergency procedures was void, the decision to skip various parts of the normal procedures was void, and that the public prosecutor should investigate whether various members of the agenda committee had committed crimes. It has not yet ruled on the constitutionality of the law and decree per se, but they remain provisionally suspended.
TL;DR The national government's claims that the referendum is illegal follow a long series of rulings by the Constitutional Court which found that even non-binding regional "consultations" on the subject of independence are unconstitutional. Moreover, the legislation which was intended to provide a legal basis for the referendum is still suspended pending a decision by the Constitutional Court (although I don't think there's any doubt what they will rule).
In consequence of the legislation which provided a basis for the referendum being suspended, spending public money on carrying it out is likely to result in charges of misuse of public funds.
In addition, the Spanish Data Protection Agency issued a warning in the run-up to the referendum about illegal use of personal data. This will require some explanation. The way elections work in Spain is that each voter has an assigned polling station, and an assigned table at that polling station. People are selected at random from the electoral register to run the tables, which is compulsory (and compensated by the right to have the following day off work with full pay). It is their responsibility to check the ID of each person who comes in to vote at their table, and to cross them off a list so that they can only vote once.
Now, the EU Data Protection Directive, which is implemented in Spanish law by the Data Protection Act (LOPD), defines personal data as any data which can be linked to a specific individual, and it heavily regulates the use of personal data. A list of names and ID card numbers obviously qualifies as personal data, and since the legal basis for the referendum was suspended the use of those lists would not meet the requirements of national and European law that personal data be used only for specific purposes which have been registered with the appropriate national agency. The Spanish Data Protection Agency warned that people who served on the tables would be committing crimes under the LOPD on two counts: firstly by receiving and using the lists, and secondly by sending in the marked up lists at the end of the referendum.