AEPD (Spain) - PS/00205/2021

AEPD (Spain) - ps-00205-2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	26.06.2021
Published:	01.07.2021
Fine:	10000 EUR
Parties:	n/a
National Case Number/Name:	ps-00205-2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Paola L.

The Spanish DPA fined an individual €10,000 for disseminating a video, showing images of gender-based violence, on social media without the consent of the parties involved.

English Summary

Facts

In July 2020, the AEPD initiated an investigation after becoming aware of the dissemination, through a social media network (Twitter), of a video that showed images that could constitute a gender-based violence crime. The video was accompanied by a message aiming to raise awareness about violence perpetrated against women.

Although the video was also disseminated by the media, they pixelated the the faces of the victims. However, in the video that was retweeted by the data subject against whom the investigation was launched, it was possible to identify the victim of gender-based violence as well as her child. Considering the facts, the AEPD contacted the data subject, requesting information about the origin of the video and why the faces of the victims had not been blurred.

Subsequently, the AEPD requested Twitter to remove the content from its platform to which Twitter responded that the Tweets were posted with the intention to raise awareness about violence against women, which is aligned with Twitter’s mission to facilitate public conversation. It further added that the content did not violate the Terms of Service of Twitter, the Twitter Privacy Policy, or the Twitter Rules, and will not be removed from the platform.

Nevertheless, later the AEPD could confirm that the content was labelled as sensitive without being removed from the platform.

Holding

The AEPD indicated that the physical image of a person constitutes personal data according with Article 4(1) GDPR therefore its processing falls within the scope of GDPR.

The DPA also analysed whether the data subject had an appropriate legal basis for the processing of personal data, and concluded that as the video was recorded and published without the consent of the parties involved, there was no appropriate legal basis in place for the processing of personal data.

The AEPD held that there had been a breach of Article 6(1)GDPR, which was considered 'grave' because of the nature of the infringement, and fined the data subject €10,000, that was reduced to €6,000 for voluntary payment and for the admission of guilt.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                         1/12











    File No.: PS / 00205/2021


RESOLUTION OF TERMINATION OF THE PROCEDURE BY PAYMENT
VOLUNTARY


Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following


BACKGROUND

FIRST: On June 17, 2021, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure against A.A.A. (onwards,
the claimed party), through the Agreement that is transcribed:


<<

Procedure No.: PS / 00205/2021




AGREEMENT TO START THE SANCTIONING PROCEDURE



Of the actions carried out by the Spanish Agency for Data Protection and in

based on the following



FACTS




FIRST: On July 9, 2020, the Director of the Spanish Agency for
Data Protection agrees to initiate investigative actions in relation to the

facts described below:

On July 8, 2020, this Agency became aware of the dissemination, through
of social networks, of a video in which images of an assault by

part of a male to a female, which could constitute a crime of violence against
gender. The video also shows images of a young male minor, who
he intervenes in the scene trying to avoid the aggression that was taking place.

This video is accessible, at least, through the following URLs:

*** URL.1

*** URL.3

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/12








The second one is a re-tweet of the first one. In the first, the accompanying message
The broadcast of the video is as follows:

“Yesterday in Éibar the sexist violence was shown in the middle of the street. The aggressor finished it by

clawing in front of his son. He has been arrested. At least 80,000 women a year in our
Another country lives this situation. To deny violence is to help the aggressor in each blow ”.

The video reviewed has also been disseminated by the media, although
This disclosure has been done after pixelation that prevents the identification of the per-

physical sonas that appear in it.



SECOND: In view of the facts of which this Agency has had knowledge,
the Subdirectorate General for Data Inspection proceeded to carry out actions

preliminary investigation procedures to clarify the facts in question, in virtue of
of the investigative powers granted to the supervisory authorities in the article
57.1 of Regulation (EU) 2016/679 (General Data Protection Regulation,

hereinafter RGPD), and in accordance with the provisions of Title VII, Chapter I,
Second section, of Organic Law 3/2018, of December 5, on the Protection of
Personal Data and guarantee of digital rights (hereinafter LOPDGDD).




The following points are found:



- On July 23, 2020, the events were transferred to the Attorney General's Office

of the State for its knowledge and timely effects.
- It is verified that at the beginning of these investigative actions the tweets follow

showing the videos. In them it is verified that in certain frames the
It would be possible to identify the child and his mother.

- On July 27, 2020, Doña A.A.A. is requested, through the Town Hall,
to Palma de Mallorca, who will inform about the origin of the published video and the reason

whereby the faces of the minor and the victim had not been pixelated. Dated
July 29, 2020, a reply was received to the request presented by your representative.

tante indicating that the origin of the video is a tweet from Don B.B.B., at the address:
*** URL. 2.

He adds that no manipulation of the video images was done previously.

already published since he understood he was limited to sharing an image already published with
anteriority. It ends by stating that, after reviewing the images, it is not considered to be
have the appropriate quality and perspective to be able to identify the interveners of

better way than if the partial faces that appear in it appear pixelated.
cen.

- Examining the profile of the owner of the origin of the video on the social network TWITTER, it was obtained
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/3








Serva that this works as XXXXXXXX of XXXXXXXX in *** LOCALIDAD. 1. Reali-
After request for identification of this holder to that Provincial Council, a reply is received

to the request providing the same data.

- On January 27, 2021, a precautionary measure to withdraw the twee-
ts outlined below, sent by international certified mail to TWI-
TTER INTERNATIONAL COMPANY (hereinafter TWITTER, headquartered in Ireland). I dont know

it is certain that the precautionary measure has been delivered at destination.

- *** URL.2

- *** URL.1
- *** URL.3

At the same time, the same day that the aforementioned precautionary measure was sent

In the previous paragraph, the withdrawal was requested through the established web form
for this Agency by those responsible for the TWITTER platform.

- On March 1, 2021, it is verified that the tweets of Doña A.A.A. Y
by Don B.B.B. now appear as sensitive content by disabling their display

automatic, being necessary to manually select its display.

- On March 23, 2021, a letter sent by TWITTER manifes-
whereas Tweets appear to have shared the video to raise awareness about
violence perpetrated against women. As such, Twitter believes that Tweets are ali-

nean with Twitter's mission to serve the public conversation, share informa-
tion instantly and without barriers. This includes sharing information that may be of interest
public interest. When people share information of public interest on Twi-

tter, the general public benefits by giving them access to information that
it can be difficult to obtain or learn. It also allows for public discussion around

to issues and issues of public interest such as violence against women. Later
From the review, Twitter determined that the content does not violate the Terms of Service of
Twitter, the Twitter Privacy Policy, or the Twitter Rules, and will not be removed from

the platform.



FOUNDATIONS OF LAW



I




By virtue of the powers that article 58.2 of Regulation (EU) 2016/679 (Regulation-
General Data Protection Mention, hereinafter RGPD), recognizes each Authority

Control, and as established in articles 47, 48.1, 64.2 and 68.1 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/12








digital rights (hereinafter, LOPDGDD), the Director of the Spanish Agency
Data Protection is competent to initiate and resolve this procedure.




Article 63.2 of the LOPDGDD determines that: «The procedures processed by the

Spanish Data Protection Agency shall be governed by the provisions of the
Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in their development and, as long as they do not contradict them, in a

subsidiary, by the general rules on administrative procedures. "



II




The physical image of a person, according to article 4.1 of the RGPD, is data
personal protection and their protection, therefore, is the object of said Regulation. In article 4.2

of the RGPD defines the concept of "processing" of personal data.



It is, therefore, pertinent to analyze whether the processing of personal data (image of

natural persons) carried out through the dissemination of the video object of this
procedure is in accordance with the provisions of the RGPD.




III



In the first place and referring to the publication by Doña A.A.A. of the indicated video

in the background, article 6.1 of the RGPD, establishes the assumptions that allow
consider lawful the processing of personal data:




      "1. The treatment will only be lawful if it complies with at least one of the following
terms:


      a) the interested party gave their consent for the processing of their data
personal for one or more specific purposes;

      b) the treatment is necessary for the performance of a contract in which the

interested is part or for the application at the request of this of measures
pre-contractual;


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/12








      c) the treatment is necessary for the fulfillment of a legal obligation
applicable to the person responsible for the treatment;


      d) the treatment is necessary to protect vital interests of the interested party or of
another natural person.

      e) the treatment is necessary for the fulfillment of a mission carried out in

public interest or in the exercise of public powers conferred on the person responsible for the
treatment;

      f) the treatment is necessary for the satisfaction of legitimate interests

pursued by the data controller or by a third party, provided that on
said interests do not prevail the interests or the rights and freedoms
fundamental data of the interested party that require the protection of personal data, in

particular when the interested party is a child.

      The provisions of letter f) of the first paragraph shall not apply to the
treatment carried out by public authorities in the exercise of their functions. "


      On this issue of the legality of the treatment, also affects the
Recital 40 of the aforementioned RGPD, when it states that “For the
treatment is lawful, personal data must be processed with consent

of the interested party or on any other legitimate basis established in accordance with Law, and
either in this Regulation or by virtue of other Union law or of the
Member States covered by this Regulation, including the need to

comply with the legal obligation applicable to the person responsible for the treatment or the need to
execute a contract with which the interested party is a party or in order to take measures

at the request of the interested party prior to the conclusion of a contract. "

In relation to the above, it is considered that there is evidence that the treatment
of data of the people who appear in the images object of this procedure,

a minor and his mother, has been carried out without legitimizing cause of the collected in the
Article 6 of the RGPD.

The GDPR applies to personal data, which is defined as "personal data":

any information about an identified or identifiable natural person ("the interested party");
an identifiable natural person shall be considered any person whose identity may
be determined, directly or indirectly, in particular by an identifier, such as

for example a name, an identification number, location data, a
online identifier or one or more elements of physical identity,
physiological, genetic, psychic, economic, cultural or social of said person.


Both the minor and his mother, whose data Doña A.A.A. has processed, are identifiable
since their identity can be determined, directly or indirectly.

IV


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/12








The corrective powers available to the Spanish Agency for the Protection of
Data, as a control authority, are established in article 58.2 of the RGPD. Between

they have the power to direct a warning -article 58.2 b) -, the
Power to impose an administrative fine in accordance with article 83 of the RGPD
-article 58.2 i) -, or the power to order the person in charge of the treatment

that the processing operations comply with the provisions of the RGPD, when
proceed, in a certain way and within a specified period - article 58. 2
d) -.


In accordance with the evidence available at the present time of
agreement to initiate the sanctioning procedure, and without prejudice to what results from the
instruction, it is considered that the facts presented do not comply with the provisions of the

article 6.1. of the RGPD, which could lead to the commission of an infringement
typified in article 83.5 of the RGPD, which provides the following:


      "" Violations of the following provisions will be sanctioned, in accordance with
with paragraph 2, with administrative fines of maximum EUR 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the

global total annual business volume of the previous financial year, opting for
the highest amount:

      a) the basic principles for the treatment, including the conditions for the

consent in accordance with articles 5, 6, 7 and 9; "

For the purposes of the statute of limitations for infractions, the infraction indicated in the
previous paragraph is considered very serious and prescribes after three years, in accordance with the

Article 72.1 of the LOPDGDD, which establishes that:

      "Based on what is established in article 83.5 of Regulation (EU) 2016/679
are considered very serious and will prescribe after three years the infractions that suppose

a substantial violation of the articles mentioned therein and, in particular, the
following:

      b) The processing of personal data without the concurrence of any of the

conditions of legality of the treatment established in article 6 of the Regulation
(EU) 2016/679. "

V




In order to determine the administrative fine to be imposed, the
provisions of articles 83.1 and 83.2 of the RGPD, provisions that state:



      "Each control authority will guarantee that the imposition of fines

administrative regulations pursuant to this article for the infractions of this
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/12








Regulations indicated in paragraphs 4, 9 and 6 are in each individual case
effective, proportionate and dissuasive. "



        "Administrative fines will be imposed, depending on the circumstances of

each individual case, as an additional or substitute for the measures contemplated in the
Article 58, paragraph 2, letters a) to h) and j).


Notwithstanding the foregoing, the aforementioned Regulation provides in its art. 58.2 b) —without prejudice
of the provisions of article 83 RGPD - the possibility of directing a warning,
in relation to what is stated in Considering 148:


        "In the event of a minor offense, or if the fine that is likely to be imposed
would constitute a disproportionate burden for an individual, rather than

sanction by fine may be imposed a warning. It must however
pay special attention to the nature, severity and duration of the offense, to its
intentional nature, to the measures taken to alleviate the damages suffered,

the degree of responsibility or any relevant prior infringement, the way in which
that the supervisory authority has had knowledge of the infringement, to the fulfillment
of measures ordered against the person in charge or in charge, to the adherence to codes of

conduct and any other aggravating or mitigating circumstance. "

In the present case, without prejudice to the results of the instruction, they have taken into account

It has, in particular, the following elements.

         That it is about the dissemination of data of the image of a woman who is
           being beaten and her youngest son who comes to help her.


         That it is an individual whose main activity is not related to the
           processing of personal data


         That no recidivism is appreciated, as there is no evidence of the commission of any
           offense of the same nature.


For all this, it is considered that the penalty that would correspond to direct is € 10,000
(Ten thousand euros).

If the infringement is confirmed, it could be agreed to impose on the person responsible the adoption of

adequate measures to adjust its performance to the regulations mentioned in this
act, in accordance with the provisions of the aforementioned article 58.2 d) of the RGPD, according to the
which each supervisory authority may "order the person in charge of the

treatment that the treatment operations comply with the provisions of the
this Regulation, where appropriate, in a certain way and within a

specified term […] '.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/8








In such case, in the resolution adopted, this Agency may require the
responsible so that within the period to be determined:


     Remove the video posted at *** URL.1, or pixelate the images to avoid the
        identification of the minor and his mother.

It is noted that not meeting the requirements of this body may be

considered as an administrative offense in accordance with the provisions of the RGPD,
classified as an offense in its articles 83.5 and 83.6, being able to motivate such conduct the

opening of a subsequent administrative sanctioning procedure.

       Therefore, in accordance with the above,

       By the Director of the Spanish Agency for Data Protection, IT IS AGREED

GIVES:



FIRST: INITIATE SANCTIONING PROCEDURE against Doña A.A.A., with NIF

*** NIF. 1, for the alleged violation of article 6.1, typified in article 83.5 of the
same legal text



SECOND: APPOINT C.C.C. as instructor. and, as secretary, to D.D.D., indi-
Whereas any of them may be challenged, as the case may be, in accordance with the provisions

cited in articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime
of the Public Sector (LRJSP).




THIRD: INCORPORATE to the sanctioning file, for evidentiary purposes, the documents
ments obtained and generated by the General Subdirectorate for Data Inspection

during the investigation phase, as well as the report of previous Ins-
pection.




BEDROOM; THAT for the purposes provided in art. 64.2 b) of Law 39/2015, of October 1,
tubre, of the Common Administrative Procedure of Public Administrations, the
The penalty that may correspond would be € 10,000, without prejudice to the resulting

The instruction.



FIFTH: NOTIFY this agreement to Doña A.A.A., granting her a period of

hearing of ten business days to make the allegations and present the evidence
as you deem appropriate. In your statement of allegations you must provide your NIF and
the procedure number at the top of this document.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/12










If within the stipulated period it does not make allegations to this initiation agreement, the same

may be considered a resolution proposal, as established in article
64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of

the Public Administrations (hereinafter, LPACAP).



In accordance with the provisions of article 85 of the LPACAP, in the event that the

penalty to be imposed would be a fine, you may recognize your responsibility within the
term granted for the formulation of allegations to the present initiation agreement; it
which will entail a reduction of 20% of the penalty to be imposed in

the present procedure. With the application of this reduction, the sanction would be
established at € 8,000 (eight thousand euros), resolving the procedure with the
imposition of this sanction.




In the same way, you may, at any time prior to the resolution of this

procedure, carry out the voluntary payment of the proposed sanction, which
will mean a reduction of 20% of its amount. With the application of this reduction,
the sanction would be established at € 8,000 (eight thousand euros), and its payment will imply the

termination of the procedure.



The reduction for the voluntary payment of the penalty is cumulative to the corresponding

apply for the acknowledgment of responsibility, provided that this acknowledgment
of the responsibility is made manifest within the period granted to formulate
allegations at the opening of the procedure. The voluntary payment of the referred amount

in the preceding paragraph, it may be done at any time prior to the resolution. On
In this case, if both reductions should be applied, the amount of the penalty would be

established at € 6,000 (six thousand euros).



In any case, the effectiveness of either of the two mentioned reductions will be

conditioned to the withdrawal or resignation of any action or remedy in
administrative against the sanction.




In case you choose to proceed to the voluntary payment of any of the amounts
indicated above, you must make it effective by entering account no.
ES00 0000 0000 0000 0000 0000 opened in the name of the Spanish Agency for

Data Protection in the banking entity CAIXABANK, S.A., indicating in the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/12








concept the reference number of the procedure that appears in the heading

of this document and the cause for the reduction of the amount to which it applies.




Likewise, you must send the proof of admission to the Subdirectorate General of
Inspection to continue the procedure according to the quantity
entered.




The procedure will have a maximum duration of nine months from the date of the

cha of the initiation agreement or, where appropriate, the draft initiation agreement. Elapsed
that period will expire and, consequently, the file of actions; from
in accordance with the provisions of article 64 of the LOPDGDD.




Finally, it is pointed out that in accordance with the provisions of article 112.1 of the LPACAP,

There is no administrative appeal against this act.





935-200320


Mar Spain Martí

Director of the Spanish Agency for Data Protection






>>



SECOND: On June 21, 2021, the claimed party has proceeded to pay
the sanction in the amount of 6,000 euros making use of the two reductions
provided for in the Initiation Agreement transcribed above, which implies the

acknowledgment of responsibility.

THIRD: The payment made, within the period granted to formulate allegations to
the opening of the procedure, entails the waiver of any action or appeal in the process
administrative against the sanction and the recognition of responsibility in relation to

the facts to which the Initiation Agreement refers.





C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/12








FOUNDATIONS OF LAW

FIRST: By virtue of the powers that article 58.2 of the RGPD recognizes to each

control authority, and as established in art. 47 of Organic Law 3/2018, of
December 5, Protection of Personal Data and guarantee of rights
digital (hereinafter LOPDGDD), the Director of the Spanish Agency for
Data Protection is competent to sanction the infractions that are committed
against said Regulation; the infractions of article 48 of Law 9/2014, of 9 of
May, General de Telecomunicaciones (hereinafter LGT), in accordance with the

provided in article 84.3 of the LGT, and the offenses typified in articles
38.3 c), d) and i) and 38.4 d), g) and h) of Law 34/2002, of July 11, on services of the
information society and electronic commerce (hereinafter LSSI), according to
Article 43.1 of said Law provides.


SECOND: Article 85 of Law 39/2015, of October 1, on the Procedure
Common Administrative of Public Administrations (hereinafter, LPACAP),
under the heading "Termination of sanctioning procedures" provides the
following:

"1. Initiated a sanctioning procedure, if the offender acknowledges his responsibility,

the procedure may be resolved with the imposition of the appropriate sanction.

2. When the sanction is solely of a pecuniary nature or it is possible to impose a
pecuniary sanction and other non-pecuniary sanction but the
inadmissibility of the second, the voluntary payment by the presumed responsible, in

any time prior to the resolution, will imply the termination of the procedure,
except in relation to the replacement of the altered situation or to the determination of the
compensation for damages caused by the commission of the offense.

3. In both cases, when the sanction is solely of a pecuniary nature, the

competent body to resolve the procedure will apply reductions of, at least,
20% on the amount of the proposed sanction, these being cumulative among themselves.
The aforementioned reductions must be determined in the notice of initiation
of the procedure and its effectiveness will be conditional on the withdrawal or resignation of
any action or appeal in administrative proceedings against the sanction.


The percentage of reduction foreseen in this section may be increased
regulations. "

In accordance with the above, the Director of the Spanish Agency for the Protection of
Data

RESOLVES:

FIRST: DECLARE the termination of procedure PS / 00205/2021, of
in accordance with the provisions of article 85 of the LPACAP.


SECOND: NOTIFY this resolution to A.A.A.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/12










Against this resolution, which puts an end to the administrative procedure as prescribed by

the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, interested parties may file an appeal
administrative litigation before the Contentious-Administrative Chamber of the

National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-Administrative Jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the

referred Law.


936-280621
Mar Spain Martí

Director of the Spanish Agency for Data Protection














































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es