AEPD (Spain) - PS/00405/2020

AEPD - PS/00405/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1)(a) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	15.03.2021
Fine:	3000 EUR
Parties:	n/a
National Case Number/Name:	PS/00405/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD decision (in ES)
Initial Contributor:	n/a

The AEPD fined €3,000 a Cultural Association for sharing in WeChat pictures of the minor child of the complainant without their complaint.

English Summary

Facts

A Cultural Association, where the minor child of the claimant attended Chinese classes, shared in WeChat, in 3 different groups with over 400 persons each, some pictures of the child, without consent, although partially covering their face with a digital sticker. The claimant asked the association to remove the pictures and to publicly apologize for having shared them.

Dispute

Is sharing without consent images of a minor a violation of Article 6(1)(a)?

Holding

The AEPD held that sharing in WeChat pictures of the minor child of the complainant without their complaint constituted a a violation of Article 6(1)(a), and fined the association €3,000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                1/7










     Procedure No.: PS / 00405/2020


                RESOLUTION OF SANCTIONING PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following


                                  BACKGROUND

FIRST: On July 31, 2019, a written statement of
claim submitted by A.A.A. concerning the dissemination of images of your minor child
of four years, without parental consent, by the Cultural Association

*** ASSOCIATION. 1, which the minor attended to receive Chinese classes, in several
Wechat groups (according to the complainant, a service similar to WhatsApp
used by the Chinese community).

The reasons on which the claim is based are the dissemination of images of a minor
four years, without parental consent, by the Cultural Association
*** ASSOCIATION. 1, in which the minor attended Chinese classes, in various groups of
WeChat (according to the complainant, a service similar to WhatsApp used by

the Chinese community).
The claimant states that the images, in which it appears that
the child's face partially by superimposing a digital sticker, it is

spread from the telephone number of a teacher of the Association to the
groups.

He accredits having addressed the Association so that they remove those publications and request
apologies in those same forums, stating that they have disregarded these requests.

Which, according to the complainant, took place on: May 31, 2019
And, among others, attach the following documentation:

     Various captures of the photos distributed via WeChat messaging
     Letter addressed to the association


The claimant states that the images, in which the face is partially hidden
of the minor by superimposing a sticker, would have spread from the

telephone number of a teacher of the Association to the groups named:
*** GROUP.1, *** GROUP.2 or *** GROUP.3 of said Association, all of them
made up of an average of four hundred people.

Likewise, the claimant certifies that she has approached the Association to eliminate
those publications and apologize in those same forums, stating that they have
neglected such requests.

SECOND: On September 3, 2019, after analyzing the documentation that
was in the file, a resolution was issued by the Director of the Spanish Agency
of Data Protection, agreeing to file the claim, as it is not appreciated
elements that would allow investigating a violation of the rights recognized in

the jurisdiction of the Spanish Agency for Data Protection.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/7








The resolution was notified to the affected party on September 6, 2019, according to
notice of receipt that appears in the file.


THIRD: As of October 4, 2019 A.A.A. has filed an appeal for
replacement -RR / 00669 / 2019-, reiterating the arguments presented in its brief of
claim and adding that the controversial images were republished

from the telephone number *** TELEPHONE 1, contact number of the Association,
along with comments about the child's misbehavior.

Likewise, the claimant points out that, despite the fact that the minor's face is
hide, continues to be identifiable, especially for the rest of the parents who carry
their children to the Association.


FOURTH: On November 19, 2019 it is resolved to estimate the appeal of
replacement filed by the claimant against the resolution of this Agency issued
on September 3, 2019, and agree to admit the claim for processing
filed against the claimed.

The claimant is notified on December 3, 2019 and a new
file with reference number E / 08183/2020.

FIFTH: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), with reference number E / 08183/2020, a transfer of

said claim to the defendant, on September 3, 2020, to proceed
to its analysis and inform this Agency within a month, of the actions
carried out to comply with the requirements set forth in the regulations of
Data Protection.


SIXTH: In view of the facts reported in the claim and the documents
provided by the claimant, the Subdirectorate General for Data Inspection proceeded
to carry out preliminary investigation actions to clarify the
facts in question, by virtue of the powers of investigation granted to the
control authorities in article 57.1 of Regulation (EU) 2016/679 (Regulation

General Data Protection, hereinafter RGPD), and in accordance with the
established in Title VII, Chapter I, Second Section, of Organic Law 3/2018,
of December 5, Protection of Personal Data and guarantee of rights
digital (hereinafter LOPDGDD).

As a result of the investigative actions carried out, the

following extremes:

     Made a request for information on the facts claimed through
        certified postal service to the investigated Association, to the address provided

        by the claimant, on June 26, 2020, it is returned by
        "A stranger".
     It is verified in Google Maps that this Association appears in the aforementioned

        postal address.
     The complainant indicates that the dissemination took place, in the first instance, on

        May 2019 at 11:30 from the phone number *** PHONE. 2 which
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/7








       manifests belongs to a teacher of the Association. Accomplished
       Requirement on the ownership of this telephone number to VODAFONE
       ESPAÑA S.A.U., operator of this number, dated October 6,
       2020 is received in this Agency, written response to the request
       stating that on the date indicated by the claimant the telephone number

       it was not assigned to any user. This phone number does not appear in
       the WeChat messages provided but if some characters in Chinese, in
       replacement of the telephone number, which could correspond to the owner of the
       same that the claimant had recorded in the agenda.

     The claimant does provide evidence of a second broadcast of videos from
       a second phone number on May 31, 2019 at 11:45 a.m.
       corresponds to the contact number of the association. In the pictures
       provided corresponding to frames of a video of the minor, the face of the

       minor is completely covered by a digital sticker except for one of them
       that is partially covered and in which it can be identified
       clearly to the minor.

     It is verified, by the screenshots of the messages, that this diffusion
       it was produced to groups containing between 400 and 500 followers.

     On October 26, 2020, the request for information on
       the facts denounced to the investigated Association resulting in returned by
       Unknown recipient on October 29, 2020.

     Requested the tax identification number of the Cultural Association
       *** ASSOCIATION. 1 to the TAX AGENCY SERVICE OF
       PLANNING AND INSTITUTIONAL RELATIONS, dated 28

       October, the requested information is received at this Agency.

SEVENTH: On January 12, 2021, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure for the complained party, by the
alleged infringement of article 6.1.a) of the RGPD, typified in article 83.5 of the
GDPR.


EIGHTH: The agreement to initiate this sanctioning procedure was notified
to the claimed on January 26, 2021, but the latter has not issued any allegation in the
deadline given for it.

In view of all the actions, by the Spanish Agency for Data Protection

In the present proceeding, the following are considered proven facts,

                                     ACTS

FIRST: The dissemination of images of a child under four years of age, without
consent of the parents, by the Cultural Association *** ASOCIACIÓN.1, to which

the youngest attended Chinese classes.

SECOND: On September 3, 2019, the file of the
claim, as elements were not appreciated that would allow investigating a violation of
the rights recognized in the field of competence of the Spanish Agency for
Data Protection.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/7









However, on November 19, 2019 it is resolved to estimate the appeal for reconsideration
filed by the claimant on October 4, 2019, reiterating the arguments

set forth in its claim and adding that the controversial images
were republished from the phone number *** PHONE. 1, phone number
contact of the Association, and a new file is opened with reference number
E / 08183/2020.


THIRD: On January 26, 2021, the agreement to initiate this
procedure, becoming the same proposal for resolution of conformity
with articles 64.2.f) and 85 of Law 39/2015, of October 1, on the Procedure

Common Administrative Law of Public Administrations (LPACAP), by not carrying out the
claimed allegations within the indicated period.

                            FOUNDATIONS OF LAW

                                             I


By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in articles 47 and 48 of the LOPDGDD, the Director
of the Spanish Data Protection Agency is competent to initiate and to
solve this procedure.


                                             II

Article 6.1 of the RGPD, establishes the assumptions that allow to consider lawful the
processing of personal data, specifically in section 1.a) it is indicated that

the processing of personal data will be considered lawful if he gave his consent.

In this sense, and in application to the present case, which deals with the right to
protection of the image of minors, note that article 8 of the RGPD regulates the
conditions applicable to the consent of the child in relation to the services of the
information society, indicating that:


"1- When article 6, paragraph 1, letter a) is applied in relation to the offer
direct information society services to children, the treatment of
Personal data of a child will be considered lawful when they are at least 16 years old.
If the child is under 16 years of age, such treatment will only be considered lawful if the

consent was given or authorized by the holder of parental authority or guardianship over the child, and
only to the extent that it was given or authorized.

Member States may establish by law a lower age for such purposes,
provided that this is not less than 13 years.


2. The person in charge of the treatment will make reasonable efforts to verify in such
cases where consent was given or authorized by the holder of parental authority or
guardianship of the child, taking into account available technology.




C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/7








3. Section 1 shall not affect the general provisions of the contract law of
Member States, such as rules regarding the validity, formation or effects of
contracts in relation to a child. "


Therefore, for the processing of the personal data of minors to be lawful
object of this case, the consent of the person with parental authority will be required
or guardianship.
                                            III


In the present case, the claim focuses on the unauthorized use of the image of the
minor child of the claimant, without the legal standing required for this purpose.

Point out that the exceptions of article 2 of the RGPD would not apply, among the
that the domestic use of personal data is contemplated since the image object

of this claim has been sent to more than 400 people, all of them
members of the denounced association.

In accordance with the facts denounced, we are faced with an infraction,
attributable to the complained party, for the processing of personal data, regulated in art. 6.1
a) of the RGPD, in relation to article 8.1 of the RGPD when dealing with the image of a minor,

without the consent of the person who has parental authority.

                                            IV


By virtue of the provisions of article 58.2 of the RGPD, the Spanish Agency for
Data Protection, as a control authority, has a set of
corrective powers in the event of an infringement of the precepts of the

GDPR.
Article 58.2 of the RGPD provides the following:

“2 Each supervisory authority shall have all the following corrective powers
listed below:

(…)

b) punish any person responsible or in charge of the treatment with warning
when the processing operations have infringed the provisions of this
Regulation;"

(...)

“D) order the person in charge of the treatment that the operations of
treatment comply with the provisions of this Regulation, where appropriate,
in a certain way and within a specified period; "

“I) impose an administrative fine in accordance with article 83, in addition to or instead of
the measures mentioned in this section, according to the circumstances of each
particular case;"


Article 72.1.b) of the LOPDGDD states that “depending on what is established in the
Article 83.5 of Regulation (EU) 2016/679 are considered very serious and will prescribe


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/7








At three years, the infractions that suppose a substantial violation of the
articles mentioned therein and, in particular, the following:


b) The processing of personal data without any of the conditions of
legality of the treatment established in article 6 of Regulation (EU) 2016/679.

                                           V

This offense may be punished with a fine of a maximum of € 20,000,000 or,

in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for the
of greater amount, in accordance with article 83.5 of the RGPD.

Likewise, it is considered that the sanction to be imposed should be adjusted in accordance with the

following criteria established in article 83.2 of the RGPD:

As aggravating factors the following:

  In the present case we are dealing with unintentional negligent action, but

 significant (article 83.2 b)

  Basic personal identifiers are affected, in this case the
 image of the minor, according to article 83.2 g).


Therefore, in accordance with the applicable legislation and assessed the criteria of
graduation of sanctions whose existence has been proven,

the Director of the Spanish Data Protection Agency RESOLVES:


FIRST: IMPOSE CULTURAL ASSOCIATION *** ASSOCIATION. 1, with NIF
G98925795, for an infringement of article 6.1.a) of the RGPD, typified in article
83.5 of the RGPD, a fine of 3,000 euros (three thousand euros).

SECOND: NOTIFY this resolution to ASOCIACIÓN CULTURAL
*** ASSOCIATION. 1.


THIRD: Warn the sanctioned person that the sanction imposed by a
Once this resolution is enforceable, in accordance with the provisions of the
art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter LPACAP), within the payment period

voluntary established in art. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,
of December 17, by means of their entry, indicating the NIF of the sanctioned person and the number
procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000 opened in the name of the Agency

Spanish Data Protection in the banking entity CAIXABANK, S.A .. In case
Otherwise, it will be collected in the executive period.

Received the notification and once executive, if the date of execution is found
Between the 1st and the 15th of each month, both inclusive, the deadline for making the payment

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/7








volunteer will be until the 20th of the following or immediately subsequent business month, and if
between the 16th and the last day of each month, both inclusive, the payment term

It will be until the 5th of the second following or immediate business month.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to
counting from the day after the notification of this resolution or directly

contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from the
day following notification of this act, as provided in article 46.1 of the

referred Law.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the final resolution through administrative channels if the
interested party expresses his intention to file contentious-administrative appeal.

If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Agency for Data Protection, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
web /], or through any of the other records provided for in art. 16.4 of the
cited Law 39/2015, of October 1. You must also transfer to the Agency the

documentation that proves the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the
notification of this resolution would terminate the precautionary suspension.



Mar Spain Martí
Director of the Spanish Agency for Data Protection



















C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es