AEPD (Spain) - E/03932/2020

AEPD (Spain) - E/03932/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR Article 6(1)(a) GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:
Published:	30.04.2021
Fine:	None
Parties:	CAM4
National Case Number/Name:	E/03932/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	CSO

In a case regarding the processing of sexual images by a sex-camera portal, the Spanish DPA concluded that the licensing of the images by clicking a box on their terms and conditions provided a legal basis for such processing.

English Summary

Facts

A data subject addressed the Spanish DPA (AEPD) to request the removal of sexual images of themselves from several websites and from Twitter, where someone had created an account with a fake profile of the complainant where videos and pics were posted.

The DPA sent requests to Twitter and the mentioned websites to take down the content, with limited success.

With regards to the original images, they had been uploaded by the data subject to a sex-camera portal. This site, as the respondent, alleged that the complainant had accepted their terms and conditions, that included a box that provided:

"Check this box to attest you have read and agree with the Terms of Use of Cam4 and you acknowledge you have licensed your images to Cam4 and that you will keep all documents."

The DPA could verify that the box had been ticked by the complainant.

Holding

The AEPD concluded that, given that the complainant had ticked the mentioned box and therefore had handed their rights over their images to the controller, the controller had a legitimate basis for the processing.

Hence, the AEPD archived the case.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                 1/6








     Procedure Nº: E / 03932/2020

                   RESOLUTION OF ACTION FILE



Of the actions carried out by the Spanish Agency for Data Protection and
based on the following


                                       FACTS

FIRST: The claim filed by A.A.A. (hereinafter, the claimant) has
entry dated May 4, 2020 in the Spanish Agency for Data Protection.

The claim is directed against a person of Colombian nationality, with number

phone *** PHONE. 1
For the following facts according to the statements of the complainant: Request legal support

for the removal of images and videos in which it appears with sexual content
found on some websites that sell videos. Add that this
material has copyright protection that belongs to you and is being
disclosing without your authorization. Request help to block and delete your profile
*** USER. 1. This account, according to your claim, has been intervened and has

used to create other fake profiles on the internet such as on the social network
“*** RED.SOCIAL.1” with your CAM4 alias and the photo from your Twitter profile. East
profile of “*** RED.SOCIAL.1” has managed to report it and eliminate it. However, it has
contacted several times with the support area of the social network Twitter without
receive satisfactory reply. He has also communicated with the support area of
Google and have removed some of the information that appeared in the search engine

and in the images section. Request that your personal data not be made public and
are not related to videos with sexual content, to avoid cases of harassment.

Which, according to the complainant, took place at the time of the complaint
And, among others, attach the following documentation:

     Requests for removal of videos and images to various websites
     Screenshot of Twitter account

     Screenshot of the Google report of “Withdrawal of content due to a
        intellectual property infringement "

On May 7, 2020, this Agency receives a new letter from the
complainant requesting assistance to delete his Twitter profile.

And attach the following documentation:
     Screenshot of the application on the Twitter website

     Automatic reply of confirmation of receipt of the request

On May 11, 2020, this Agency receives a new letter from the
claimant, indicating the websites with images that are under their rights of
Author. He adds that he has communicated with all the pages to request his rights
Author, but has not received a response.

 - *** URL.1

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/6








 - *** URL.2
 - *** URL.3

 - *** URL.4
 - *** URL.5

 - *** URL.6
 - *** URL.7

 - *** URL.8
 - *** URL.9

 - *** URL.10
 - *** URL.11

 - *** URL.12
 - *** URL.13

 - *** URL.14
 - *** URL.15
 - *** URL.16

 - *** URL.17
 - *** URL.18

 - *** URL.19

And, among others, attach the following documentation:
     New email requesting the deletion of the TWITTER profile in which
       informs the TWITTER platform that it does not have access to the original email that

       was used for the creation of the profile and attaching its national document of
       identity requested by TWITTER.
     Automatic reply of confirmation of receipt of the request


SECOND: The Subdirectorate General for Data Inspection proceeded to carry out
of previous investigative actions to clarify the facts that are the object of the

of the claim, having knowledge of the following points:
       ~ Regarding the telephone number indicated in the claim of the possible author

from the creation of the false profile in “*** RED.SOCIAL.1”, it is observed that this number
has a length of 8 digits, which indicates that it does not belong to the system of
Spanish telephone numbering.

       ~ Regarding the TWITTER profile that the complainant states that she cannot
delete as you do not have access to the email the account was created with, with
date of May 20, 2020 the removal of the profile from the social network is requested
TWITTER through the form provided for this purpose at the internet address (URL):

https://help.twitter.com/forms/private_information

Without being aware of the possible action of TWITTER and verifying that
the profile is still active and accessible, it is requested again on June 14, 2020
to TWITTER SPAIN and February 8, 2021 to TWITTER INT precautionary measure of
withdrawal of their profile from the social network requested by the claimant.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/6








Clarifications requested by TWITTER, in writing received dated October 10,
March 2021, on the profile that has been requested to delete, and once the

statements that the claimant collects in her claim, dated December 30,
March 2021 is received by this Agency, a letter sent by TWITTER stating
which according to its double verification factor protocol has been sent with the date of
March 24, 2021 an email confirming the deletion of the profile to the
email associated with the profile account.

As of April 5, 2021, the profile is still active.

    ~ Regarding the publication of the claimed videos, during these performances
Research verifies that the content is no longer available in the URLs:

*** URL.20
*** URL.8

*** URL.16
*** URL.9

*** URL.21

*** URL.18


Both in the claim filed on May 4, 2020, and in the one filed on

May 11, 2020, the claimant refers to the content claimed,
video made by herself as a model on the CAM4 web cams platform and
contained in the address *** URL.22, are protected by copyright that
indicates belong to you.

In order to verify this, the claimant is asked for the signed contract
with the CAM4 platform. On June 24, 2020, this Agency receives the following:
Answer to the request by presenting the requested contract. In this contract it is

note that the images produced on this platform are licensed to CAM4,
as indicated in a checkbox with the text “Check this box to attest you
have read and agree with the Terms of Use of Cam4 and you acknowledge you have
licensed your images to Cam4 and that you will keep all documents […] ”. I know
check that the box is checked.

Consulted the document "Conditions and Terms of Service" of the platform
CAM4 that is in the URL https://www.cam4.es/legal/termsofuse it is verified that

in epigraph 6 "Generated Business Content" section "c" in its second
Paragraph the user of the platform grants a royalty-free license to CAM4 to
distribute, reproduce, publish, etc. all the material generated on the platform (EGC:
Enterprise Generated Content) globally, perpetually and irrevocably. Textually
establishes:

“By distributing your EGC through the Platform, you grant Cam4 a license for worldwide use,
non-exclusive, royalty-free, sublicensable and transferable to use, reproduce, prepare
derivative works of, displaying and transmitting the EGC in connection with our service,
including but not limited to promoting and redistributing part of the Cam4 page (and works
derivatives) in any media format and through any media channel. Also

you give each guest on the Cam4 page (or any additional format or media channel) a
non-exclusive license to access your EGC through the page and to use, display and
transmit said EGC as allowed through the functionality of the page and under these
Terms. The above licenses granted by you are perpetual and irrevocable. "
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/6








It is verified that all the claimed pages report as the origin of the videos
to the CAM4 platform, so it is interpreted that there is a commercial relationship
among this, to which the claimed content was licensed in an unlimited way and free of

rights, and the websites of the pages claimed.
Notwithstanding the foregoing, content removal requirements are made by
email, the only known means of contact, to the platforms that continue

posting claimed content without success.


                            FOUNDATIONS OF LAW

                                             I

By virtue of the powers that article 58.2 of Regulation (EU) 2016/679 (Regulation-
General Data Protection Mention, hereinafter RGPD), recognizes each Authority

Control, and as established in articles 47, 48.1, 64.2 and 68.1 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter, LOPDGDD), the Director of the Spanish Agency
Data Protection is competent to initiate and resolve this procedure.


Article 63.2 of the LOPDGDD determines that: «The procedures processed by the
Spanish Data Protection Agency shall be governed by the provisions of the
Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in their development and, as long as they do not contradict them, in a
subsidiary, by the general rules on administrative procedures. "


                                            II

The physical image of a person, according to article 4.1 of the RGPD, is data
personal protection and their protection, therefore, is the object of said Regulation.


Article 4.2 of the RGPD defines "treatment" as: "any operation or set
of operations carried out on personal data or personal data sets,
whether by automated procedures or not, such as collection, registration,
organization, structuring, conservation, adaptation or modification, extraction,
consultation, use, communication by transmission, broadcast or any other form of

authorization of access, collation or interconnection, limitation, deletion or destruction. "

The inclusion of images, which identify or make a person identifiable, on websites
It involves a processing of personal data and, therefore, the person who does it has
to take refuge in any of the legitimizing causes indicated in article 6 of the

GDPR. In these cases, as in the case that is the subject of the claim, the only cause
The legitimating factor is usually consent, in general. And it is the person who records and / or
upload the images to a website which must demonstrate that it has that
consent.

In order for this treatment to be carried out lawfully, the following must be fulfilled.

established in article 6.1 of the RGPD, which indicates:



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/6








       << 1. The treatment will only be lawful if at least one of the following is met
terms:
       a) the interested party gave their consent for the processing of their data

personal for one or more specific purposes;
       b) the treatment is necessary for the performance of a contract in which the
interested is part or for the application at the request of this of measures
pre-contractual;
       c) the treatment is necessary for the fulfillment of a legal obligation
applicable to the person responsible for the treatment;

       d) the treatment is necessary to protect vital interests of the interested party or
of another natural person;
       e) the treatment is necessary for the fulfillment of a mission carried out in
public interest or in the exercise of public powers conferred on the person responsible for the
treatment;

       f) the treatment is necessary for the satisfaction of legitimate interests
pursued by the data controller or by a third party, provided that on
said interests do not prevail the interests or the rights and freedoms
fundamental data of the interested party that require the protection of personal data, in
particular when the interested party is a child.


       The provisions of letter f) of the first paragraph shall not apply to the
treatment carried out by public authorities in the exercise of their functions. >>.


                                            III


In the claim presented, the claimant indicates, in relation to protection of
data, that videos and images of sexual content that are in
pages that market these videos and that belong to you for your rights of
author, requesting its deletion.


The investigative actions carried out have managed to eliminate some of the
videos that were being published in some URLs, indicated in the background.

Both in the claim filed on May 4, 2020, and in the one filed on
May 11, 2020, the claimant refers to the content claimed,

video made by herself as a model on the CAM4 web cams platform and
contained in the address *** URL.22, are protected by copyright that
indicates belong to you.

The claimant requested the contract signed with the CAM4 platform, in this
contract it is observed that the images produced on this platform are licensed to
CAM4, as indicated in a check box with the text “Check this box to
attest you have read and agree with the Terms of Use of Cam4 and you acknowledge

you have licensed your images to Cam4 and that you will keep all documents […] ”. I know
check that the box is checked.
The document "Conditions and Terms of Service" of the CAM4 platform includes in

epigraph 6 "Generated Business Content" section "c", in its second paragraph
the user of the platform grants a royalty-free license to CAM4 to distribute,


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/6








reproduce, publish, etc. all the material generated on the platform (EGC: Enterprise
Generated Content) in a global, perpetual and irrevocable way.

It is verified that all the claimed pages report as the origin of the videos
to the CAM4 platform, so it is interpreted that there is a commercial relationship

among this, to which the claimed content was licensed in an unlimited way and free of
rights, and the websites of the pages claimed.


Therefore, in accordance with the provisions, by the Director of the Spanish Agency for
Data Protection, IT IS AGREED:


FIRST: PROCEED WITH THE FILING of these actions.

SECOND: NOTIFY this resolution to the claimant.

In accordance with the provisions of article 50 of the LOPDGDD, this

Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure

Common of Public Administrations, and in accordance with the provisions of the
arts. 112 and 123 of the aforementioned Law 39/2015, of October 1, interested parties may
file, optionally, an appeal for reconsideration before the Director of the Agency
Spanish Data Protection within a period of one month from the day
following notification of this resolution or directly contentious appeal

administrative before the Contentious-Administrative Chamber of the National Court,
in accordance with the provisions of article 25 and paragraph 5 of the provision
Additional fourth of Law 29/1998, of July 13, regulating the Jurisdiction
Contentious-Administrative, within two months from the next day
upon notification of this act, as provided in article 46.1 of the aforementioned Law.


                                                                                    940-0419
Mar Spain Martí
Director of the Spanish Agency for Data Protection





















C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es