AEPD (Spain) - EXP202103878

AEPD - e-11644-2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR Article 17 GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	e-11644-2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Michelle Ayora

The Spanish DPA dismissed a complaint about an unauthorised publication of nude photos of a minor on a pornographic website due to the lack of evidence to identify the author of the upload. The photos were deleted from the Internet.

English Summary

Facts

The data subject’s parent (claimant) submitted a complaint before the Spanish DPA stating that images of the data subject, a minor below 16 years old, were published on a pornographic website. The claimant added that those photos were manipulated by taking the data subject’s face and putting it on naked bodies. In addition, the claimant had already reported the facts to the police and requested the deletion of the material from the website with no answer from them.

The Spanish DPA started an investigation proceeding according to Articles 57(1) and 58(2) GDPR for the processing of personal data without the consent of the data subject, as foreseen in Article 6 GDPR.

Firstly, the DPA found out that the request to the website did not expressly asked for the exercise to the right to erasure of Article 17 GDPR, however, the photos were deleted from the website.

Secondly, the police sent the file to a court which started an investigation and finally closed the case due to the lack of evidence to assign the authorship of the crime to a particular person. The court had requested information regarding the IP addresses from the website, whose representative stated that they acted as an archiving service for content and public information from another website without keeping any type of information from their users except for an email address. However, they were able to delete the content in question. After visiting the other website, no material related to the investigation was found.

Finally, the DPA proceeded with the search on Google for all the photos from the investigation with no results.

Holding

Having analysed the case, the Spanish DPA dismissed the complaint since, as a result of the investigation, it was not possible to assign the authorship of illegal processing to a particular person, considering that the investigating court closed the case for the same reason. Furthermore, the DPA held that the request to exercise the right to erasure (Article 17 GDPR) was observed since the photos had been deleted from the website.

In addition, the DPA highlighted that the publication of images of persons in videos or news available on the internet constitutes the processing of personal data and the person who does it must rely on one of the legal basis of Article 6 GDPR. Consent being the most common legal basis, the controller must hold evidence of that consent.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/6








     File No.: EXP202103878



                  RESOLUTION OF FILE OF ACTIONS


Of the actions carried out by the Spanish Agency for Data Protection and
based on the following:


                                       FACTS

FIRST: Mrs. A.A.A. (hereinafter, the claimant party), dated October 22
2021, filed a claim with the Spanish Data Protection Agency.


The grounds on which the claim is based are as follows:

       The claimant, mother of a minor under 16 years of age, states that they have obtained
Instagram and TikTok images of her daughter's profiles have been manipulated
(putting their face on naked bodies) and have uploaded them to a pornographic website,
specifically to Archivohot.com. He has brought the facts to the attention of the police,

attaching the complaint filed with the DGP and stating that they have requested the
withdrawal of the content to the webmaster, without success. It also provides screenshots.
of the publication of the images of the minor on the aforementioned website. in the complaint
formulated before the police, the web addresses (URL) of access to the
referred content: ***URL.1 and ***URL.2, verifying the publication of photos of

a girl with a bare chest.

       The website contains the following contact address:
filehot@protonmail.com.


SECOND: On October 28, 2021, in accordance with article 65 of the
LOPDGDD, the claim filed by the claimant was admitted for processing.

THIRD: The General Subdirectorate for Data Inspection proceeded to carry out
of previous investigative actions to clarify the facts in
question, by virtue of the functions assigned to the control authorities in the

article 57.1 and the powers granted in article 58.1 of the Regulation (EU)
2016/679 (General Data Protection Regulation, hereinafter RGPD), and
in accordance with the provisions of Title VII, Chapter I, Second Section, of the
LOPDGDD, having knowledge of the following extremes:


The claimant does not present the document exercising the right of deletion nor does it indicate the
specific date on which the communication was made, but dated October 28
2021, six days after filing the claim, it is found that the
claimed content has been removed from the website in question.


Requested information from the General Directorate of the Police on whether it has opened
investigation related to the statement presented in this Agency aimed at clarifying the
authorship of the facts, and if the complaint has given rise to the opening of proceedings in
some court, dated December 13, 2021 is received in this Agency,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/6








document sent by the Technical Office of the Police informing that "according to the
wording given by article 284.2 of the LECR, according to wording given by Law
41/2015, of October 5, which establishes that "when there is no known author
The Judicial Police will keep the report at the disposal of the Public Prosecutor and the
Judicial Authority, without sending it to him”, after taking the complaint ***REFERENCE.1,

considered that initially there was no known author, so the
proceedings to the corresponding Court.”

Requested information again from the General Directorate of the Police on the status
of the investigation and whether it has been possible to determine the authorship of the publication, with
dated May 25, 2022, this Agency receives a document issued by the

data protection delegate of that Directorate informing that it has been
at the opening of the Preliminary Proceedings number ***REFERENCE.2 by the
Investigating Court ***COURT.1, so this Agency should address, in
case of deeming it opportune, to said Court of Instruction, as there is a procedure
judicial open and find included the information required within the exercise of

its judicial function.

Requested to the Investigating Court ***COURT.1 if during open proceedings
in that court it had been possible to clarify the authorship of the publications, dated
of July 4, 2022 is received in this Agency official letter sent by that court
informing that "the procedure initiated by police report ***REFERENCE.3,

It is currently in PROVISIONAL ARCHIVE due to the lack of evidence
sufficient and there are no sufficient reasons to attribute the commission of the crime to
any particular person”.

Examined the website where the images are stated to have been posted, only
find the email address as a means of contact

filehot@protonmail.com.

On January 14, 2022, a request for information was sent to the
mentioned email address requesting the IP addresses from the
that the claimed content was uploaded. On January 16, 2022, it is received
reply email stating that “Archivohot.com is a

tool that allows you to archive content and public information from hispasexy.org and
itself we do not store any information about our users, the only thing that
we can do is remove the content if someone so wishes. They can write to
hispasexy administrators to this email info@hispasexy.org”

Regarding the possible publication on the website hispasexy.org, it has not been possible

locate the content claimed on this website for which it could not be requested
information to the person in charge about the IP of publication of the content.

No copies of these images have been found by performing a search on
Internet using Google image search of several of the images

indicated in the complaint filed with the Police.

Regarding the right of deletion exercised by the claimant before the website
Archivohot.com, given that 6 days after submitting the claim, and without
were to carry out any action for this inspection the images had been

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/6








eliminated, it follows that the claimant's right was addressed by the
responsible for this website in a timely manner.


                            FOUNDATIONS OF LAW

                                            Yo
                                      Competition

In accordance with the functions that article 57.1 a), f) and h) of the Regulation (EU)

2016/679 (General Data Protection Regulation, hereinafter RGPD) confers
each control authority and according to the provisions of articles 47 and 48.1 of the Law
Organic 3/2018, of December 5, on the Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD), is competent to resolve these
investigative actions the Director of the Spanish Agency for the Protection of

Data.

Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Agency for Data Protection will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations issued in its development and, as long as they do not contradict them, with a

subsidiary, by the general rules on administrative procedures."


                                            II
                     Right of erasure ("the right to be forgotten")


Article 17 of the RGPD provides the following:

       "1. The interested party shall have the right to obtain without undue delay from the
responsible for the treatment the deletion of the personal data that concerns him, the

which will be obliged to delete personal data without undue delay when
any of the following circumstances occur:
       a) the personal data is no longer necessary in relation to the purposes for
those that were collected or otherwise treated;
       b) the interested party withdraws the consent on which the treatment of
in accordance with Article 6(1)(a) or Article 9(2)(a) and

it is not based on another legal basis;
       c) the interested party opposes the treatment in accordance with article 21, paragraph 1,
and other legitimate reasons for the treatment do not prevail, or the interested party
object to processing pursuant to Article 21(2);
       d) the personal data has been illicitly processed;

       e) the personal data must be deleted for the fulfillment of a
legal obligation established in the Law of the Union or of the Member States that
applies to the data controller;
       f) the personal data has been obtained in relation to the offer of services
of the information society referred to in article 8, paragraph 1.


       2. When you have made the personal data public and are obliged, by virtue of
of the provisions of section 1, to delete said data, the person in charge of the
treatment, taking into account the available technology and the cost of its application,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/6








will take reasonable measures, including technical measures, with a view to informing the
Responsible for processing the personal data of the interested party's request for
deletion of any link to such personal data, or any copy or replica of

the same.

       3. Sections 1 and 2 will not apply when the treatment is necessary:
       a) to exercise the right to freedom of expression and information;
       b) for the fulfillment of a legal obligation that requires the treatment of
data imposed by the law of the Union or of the Member States that is applied

to the person in charge of the treatment, or for the fulfillment of a mission carried out in
public interest or in the exercise of public powers vested in the controller;
       c) for reasons of public interest in the field of public health of
in accordance with article 9, paragraph 2, letters h) and i), and paragraph 3;
       d) for archival purposes in the public interest, scientific research purposes or

historical or statistical purposes, in accordance with article 89, paragraph 1, in the
to the extent that the right indicated in paragraph 1 could make it impossible or
seriously impede the achievement of the objectives of said treatment, or
       e) for the formulation, exercise or defense of claims."

In the present case, the complaining party does not present the document exercising the

right of deletion nor does it indicate the specific date on which the
communication, but, dated October 28, 2021, six days after
file the claim, it is verified that the content claimed has been removed
of the website in question; Therefore, the exercise of the right is considered attended.


                                           III
                           Processing of personal data

The physical image of a person, in accordance with article 4.1 of the RGPD, is a
personnel and their protection, therefore, is the subject of said Regulation. Same as him

name and surnames are personal data that identify a natural person.

Article 4.2 of the RGPD defines "treatment" as: "any operation or set
of operations carried out on personal data or sets of personal data,
whether by automated procedures or not, such as the collection, registration,
organization, structuring, conservation, adaptation or modification, extraction,

consultation, use, communication by transmission, diffusion or any other form of
authorization of access, collation or interconnection, limitation, suppression or destruction.”

Including images that identify or make a person identifiable, as well as their
name and surnames, in published videos or news supposes data processing

personal and, therefore, the person who does it has to rely on one of the
legitimizing causes indicated in article 6 of the RGPD. In these cases, as
In the case object of the claim, the usual legitimizing cause is usually the
consent in general. Y is the person who uploads the personal data and
images to a social network that can be viewed without any limitation, which must be

demonstrate that you have that consent.

In order for this treatment to be carried out lawfully, the following must be fulfilled:
established in article 6.1 of the RGPD, which indicates:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/6









       "1. The treatment will only be lawful if at least one of the following is met
conditions:

       a) the interested party gave their consent for the processing of their data
personal for one or more specific purposes;
       b) the treatment is necessary for the execution of a contract in which the
interested party is a party or for the application at the request of the latter of measures
pre-contractual;
       c) the treatment is necessary for the fulfillment of a legal obligation

applicable to the data controller;
       d) the processing is necessary to protect the vital interests of the data subject or
of another natural person;
       e) the treatment is necessary for the fulfillment of a mission carried out in
public interest or in the exercise of public powers vested in the person responsible for the

treatment;
       f) the treatment is necessary for the satisfaction of legitimate interests
pursued by the controller or by a third party, provided that on
such interests do not override the interests or rights and freedoms
fundamental data of the interested party that require the protection of personal data, in
particularly when the interested party is a child.


       The provisions of letter f) of the first paragraph shall not apply to
treatment carried out by public authorities in the exercise of their functions.”

In the present case, in order to verify the authorship of the person who tried

the data of the minor without any legitimizing cause for it, a request was sent
of information to the e-mail address of the denounced site requesting the
IP addresses from which the claimed content was uploaded. Received mail from
reply stating that they do not store user information, being able to
delete the content


Regarding the hispasexy.org website, the claimed content could not be located
on this website, so it has not been possible to request information from the person in charge about
the publishing IPs of the content.

No copies of these images have been found by performing a search on

Internet using Google image search of several of the images
indicated in the complaint filed with the Police, whose complaint has resulted in
archived due to not being able to identify the author of the treatment of the image of the minor
origin of this claim.
.

                                            IV
                                       conclusion

It has been possible to eliminate the images indicated in the claim, but it has not been
been able to identify the author of the processing of these images.


Thus, in accordance with what was indicated, by the Director of the Spanish Agency for
Data Protection,
HE REMEMBERS:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/6










FIRST: PROCEED TO FILE these proceedings.

SECOND: NOTIFY this resolution to Ms. A.A.A.


In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which puts an end to the administrative procedure as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common to Public Administrations, and in accordance with the provisions of the
art. 112 and 123 of the aforementioned Law 39/2015, of October 1, interested parties may

file, optionally, an appeal for reconsideration before the Director of the Agency
Spanish Data Protection Authority within a month from the day
following the notification of this resolution or directly contentious appeal
before the Contentious-Administrative Chamber of the National High Court,

in accordance with the provisions of article 25 and paragraph 5 of the provision
additional fourth of Law 29/1998, of July 13, regulating the Jurisdiction
Contentious-Administrative, within two months from the day after
to the notification of this act, as provided in article 46.1 of the aforementioned Law.



                                                                                 940-110422
Sea Spain Marti
Director of the Spanish Data Protection Agency

































C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es