AEPD (Spain) - PS/00076/2021

AEPD - PS/00076/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:
Published:	21.04.2021
Fine:	None
Parties:	CLÍNICA VIVANTA S.L
National Case Number/Name:	PS/00076/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD decision (in ES)
Initial Contributor:	n/a

The Spanish DPA held that where an employee had signed an image rights transfer agreement with their employer, prior to the display of an advertisement banner using the employee's image, this could be considered as a legal basis for data processing.

English Summary

Facts

A worker of a clinic lodged a complaint with the Spanish DPA because their employer had used their image for advertisement purposes without consent. They had placed huge banners with it in a display window.

The banners were on sight for more than a year, despite the worker's repetitive request, via different ways, for them to take them down.

Such banners were, however, taken down after the worker made a notarial request. The clinic alleged, mainly, that the worker had signed an image rights transfer agreement previous to the display of the banner.

Holding

The Spanish DPA held that the fact that the worker had signed an image rights transfer agreement previous to the display of the banner was considered as a legal basis for data processing. Hence, they did not find a violation of Article 6.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                1/6










     Procedure No.: PS / 00076/2021


                RESOLUTION OF SANCTIONING PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following:


                                  BACKGROUND

FIRST: D. A.A.A., in the name and on behalf of D. B.B.B. (hereinafter, the
claimant) on November 10, 2020, he filed a claim with the
Spanish Agency for Data Protection. The claim is directed against CLÍNICA

VIVANTA S.L with CIF B82809492 (hereinafter, Vivanta or claimed).

The reasons on which the claim is based are that the claimant has been providing his
services as a maxillofacial surgeon at the Vivanta Clinic, since September
of the year 2009.


Well, the claimed entity Vivanta, at the beginning of 2020 decided to make use of
of the personal image of the claimant for advertising purposes of the clinic by putting
in the shop window of this one a large poster with his image without
ask him anything about it and he does not consent to such action.


Likewise, on numerous occasions he has required those in charge of the clinic to
to proceed to the removal of the poster with the claimant's image, both
verbally as by means of a notarial request, without the complainant having
proceeded to its withdrawal.


Thus, the image without consent has been exposed to the public from the beginning
of the year 2020, approximately one year, without the claimed attending the
requirements for its withdrawal.

Together with the claim, it provides the notarial request made. In the aforementioned

requirement there are various photographs that certify the exhibition of the poster that
motivates the presentation of the claim.

SECOND: In accordance with article 65.4 of the LOPGDD, which has provided for a
mechanism prior to the admission for processing of claims made before

the AEPD, consisting of transferring them to the Data Protection Delegates
designated by those responsible or in charge of the treatment, for the intended purposes
in article 37 of the aforementioned norm, or to these when it has not designated them, it was given
transfer of the claim to the claimed entity to proceed with its analysis and
respond to the complaining party and this Agency within one month.


THIRD: On December 4, 2020, the respondent was asked to
will provide this Agency with the following information:

       1. The decision taken regarding this claim.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/6








       2. In the event of exercising the rights regulated in articles 15 to
           22 of the RGPD, accreditation of the response provided to the claimant.
       3. Report on the causes that have motivated the incident that has originated

           the claim.
       4. Report on the measures adopted to prevent the occurrence of
           similar incidents, implementation dates and controls carried out to
           check its effectiveness.
       5. Any other that you consider relevant.


The writing was notified to the claimed party electronically being the date of
acceptance of the notification on December 4, 2020, as evidenced by the certificate
issued by the FNMT that is on file.

Once the term granted to the claimed party has elapsed without having responded to the

request for information, in accordance with the provisions of article 65.2 of the
LOPDGDD, the admission for processing agreement is signed on February 10, 2021
of this claim.

THIRD: On March 16, 2021, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure to the claimed, by the

alleged violation of Article 6 of the RGPD, typified in Article 83.5 b) of the RGPD.


SIXTH: Notified the initiation agreement, the claimed entity, by writing of
On March 29 of this year, it made, in summary, the following allegations:


   a) “D. B.B.B. On January 22, 2019, he signed a Contract for the Assignment of Rights to
       Image with CLÍNICAS VIVANTA in which you gave your consent, giving
       do your image to it for a period of 24 months. Likewise, it is pointed out that
       The image may only be used through advertising media (television
       sion, press, graphic and exterior, web, mailing, leaflets or any type of

       size or format. In addition to, pedagogical means (presentations, manuals and
       protocols among others). A signed contract between the parties is attached as a document.
       ment # ONE.


   b) On October 16, 2020, it is notified by certified mail
       to CLÍNICAS VIVANTA, specifically, the one located at C / *** ADDRESS. 1 DE

       *** LOCALITY. 1, notarial requirement by the representation of Mr.
       B.B.B. requesting the withdrawal of the image alleging the absence of
       express consent for the use of it for said purpose,
       extreme that is not true since as mentioned in the previous point, D.
       B.B.B. signed an Image Assignment contract on January 22, 2019, with a
       valid for 24 months.



   c) CLÍNICAS VIVANTA once received the request, proceeded to give the
       internal instructions for the removal of images in which the
       whistleblower.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/6








   d) Currently there is no public image of the complainant in CLINICS
       VIVANTA, the photos are provided as documents No. TWO, THREE and FOUR,
       of the facades of the three Clinics mentioned by D. B.B.B ..

    CLÍNICAS VIVANTA, considers that it has taken the diligence measures
    sufficient, and at no time has he committed any infraction regarding the

    legality of the treatment of the data of D. B.B.B., specifically its image, since
    your express consent was requested for the purposes mentioned in the
    This document with the signature of the Image Assignment contract that is
    attached.


    Likewise, once the notarial request had been made, the
    the images that are not currently displayed on any of the facades of
    VIVANTA CLINICS.

    On the other hand, and already mentioned in the first allegation of this document,
    the information requested in the notification of the AEPD of

    dated December 4, 2020 due to an internal procedural error, already resolved, and
    for this reason, this part provides said information in this document ”.


                                PROVEN FACTS


       1st. On November 10, 2020, the AEPD received a letter from
claimant that the claimed entity at the beginning of 2020 made use of its
personal image for advertising purposes of the clinic, placing in its window a
large poster with his image, without consulting anything to the
respect, or consent to such action.


       2nd. It is proven that the claimant required the claimed entity to
proceed to the removal of the poster with his image, by means of a notarial request.
In the aforementioned request there are various photographs of the claimant.


       3rd. The claimed provides, on March 29, 2021, the contract signed by
the claimant of Assignment of Image Rights with CLÍNICAS VIVANTA in which
gave his consent, yielding his image to it for a period of 24
months. Likewise, it is pointed out that the image can only be used through
advertising media (television, press, graphic and outdoor, web, mailing, leaflets or

any type of support or format. In addition to pedagogical means (presentations,
manuals and protocols among others).

       The contract signed between the parties is dated January 22, 2019, where
The name of the claimant with his ID and his signature appears.


       4th. It is accredited by the claimed that they received a notarial request from the
claimant on October 16, 2020, for the removal of the images, proceeding to

its withdrawal.




C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/6








        5th. Currently there is no public image of the claimant in Clinics
Vivanta, the photos are provided as documents no. Two, three and four, of the facades
of the three Clinics mentioned by the claimant.



                            FOUNDATIONS OF LAW

                                              I


By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in arts. 47 and 48.1 of the LOPDPGDD, the Director of
The Spanish Data Protection Agency is competent to resolve this
process.


                                             II


Law 39/2015, of Common Administrative Procedure of the Administrations
Public (LPACAP) establishes in its article 89.1 that “the termination of the
procedure, with filing of the proceedings, without the need for the formulation
of the proposed resolution, when in the instruction of the procedure it is
I manifest that any of the following circumstances concur:


        a) The non-existence of the facts that could constitute the offense ”.


                                             III

The defendant is charged with committing an offense for violation of Article 6
of the RGPD, “Legality of the treatment”, which indicates in its section 1 the cases in which
that the processing of third party data is considered lawful:


        "1. The treatment will only be lawful if at least one of the following is met
terms:

      a) the interested party gave their consent for the processing of their data
      personal for one or more specific purposes;
      b) the treatment is necessary for the performance of a contract in which the

      interested is part or for the application at the request of this of measures
      pre-contractual;
      (…) "


       The offense is classified in Article 83.5 of the RGPD, which considers as such:


      "5. Violations of the following provisions will be sanctioned, in accordance with
with section 2, with administrative fines of a maximum of EUR 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for
the highest amount:



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/6








      a) The basic principles for the treatment, including the conditions for the
      consent in accordance with articles 5,6,7 and 9. "


 Organic Law 3/2018, on Protection of Personal Data and Guarantee of
Digital Rights (LOPDGDD) in its article 72, under the heading "Infractions
considered very serious ”provides:


      "1. Based on what is established in article 83.5 of the Regulation (E.U.)
2016/679 are considered very serious and will prescribe after three years the infractions that
suppose a substantial violation of the articles mentioned in that one and, in
in particular, the following:


       (…)
       b) The processing of personal data without the concurrence of any of the
       conditions of legality of the treatment established in article 6 of the
       Regulation (EU) 2016/679. "


                                          IV

In the case at hand, after a detailed study of the documents
working in this proceeding, and the claims of the claimed entity,
We must point out that the contract for the Assignment of Rights of

Image with the claimed dated January 22, 2019, with the name of the
claimant, their ID and signed by signature,
On the other hand, it is clear that once the petitioner received the notarial request

requesting the withdrawal of the claimant's images, they proceeded to withdraw the
themselves.

Likewise, it should be noted that there is currently no public image of the
claimant in Vivanta Clinics.

Therefore, the file of the present sanctioning procedure proceeds.

Considering the aforementioned precepts and others of general application, the Director of the Agency
Spanish Data Protection RESOLVES:

FIRST: FILE the sanctioning procedure PS / 00076/2021, instructed to

CLÍNICA VIVANTA S.L with NIF B82809492, for having proven that the claimant
I formalize a contract for the Assignment of Image Rights.

SECOND: NOTIFY this resolution to CLÍNICA VIVANTA S.L with CIF
B82809492.


In accordance with the provisions of article 50 of the LOPDPGDD, this
Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the

LOPDPGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to
counting from the day after the notification of this resolution or directly
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/6









contentious-administrative appeal before the Contentious-Administrative Chamber of the

National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from the
day following notification of this act, as provided in article 46.1 of the

referred Law.

Mar Spain Martí

Director of the Spanish Agency for Data Protection






















































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es