AEPD (Spain) - PS/00408/2020

AEPD - PS/00408/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:
Published:	30.04.2021
Fine:	None
Parties:	n/a
National Case Number/Name:	PS/00408/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD decision (in ES)
Initial Contributor:	n/a

The Spanish DPA issued a warning to a minor that recorded a video while assaulting another minor, together with a group of others, and subsequently posted it on Instagram.

English Summary

Facts

A Secondary School reported to the Spanish DPA (AEPD) that they had found that several minors had a assaulted another student, and that they had recorded the assault and subsequently posted it on Instagram. This led to the distribution of the video, that ended in several newspapers and digital media.

Following an investigation, the police was able to identify the minor that created the Instagram account and uploaded the video. Afterwards, the minor deleted the video and the account, that later could only be found on the media.

All the minors involved were prosecuted and condemned for the assault by a criminal court.

Holding

The AEPD concluded that the minor involved in the assault that had recorded such acts and uploaded the video to Instagram had infringed Article 6(1) GDPR, for processing personal data without a legitimate basis (namely without consent).

They decided to issue only a warning for this behaviour, given that the violation was committed by a natural person, that was also a minor. They considered that a fine would have been a disproportionate sanction.

They also ordered the minor never to process data without a legitimate basis again.

The AEPD also discussed the interplay between the right to data protection and the right to information that the minor could have by posting the video on Instagram, mentioning the fact that, according to Spanish case law, the right to one's own image and the right to data protection is not an absolute right. However, for any of those rights to be overridden, there must be a public interest that prevails, what did not happen in this case.

The authority also discussed whether a minor could be sanctioned by administrative law, as there is not such a clear legal framework on the subject as it exists in criminal law. They concluded that, for minors aged 14 onward, legal responsibility could be claimed, and therefore they can be sanctioned, even if their parents are co-responsible.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                               1/16








     Procedure No.: PS / 00408/2020

                RESOLUTION OF SANCTIONING PROCEDURE


Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following

                                  BACKGROUND


FIRST: On September 26, 2019, the Director of the Spanish Agency
ñola of Data Protection agrees to initiate the present investigation actions
in relation to the news appeared in the media related to the aggression
suffered by a girl under 14 years of age at the XXXXXXX Institute by some of her
comrades, who proceeded to record the images of the attack and disseminate them to

through a social network.

SECOND: The Subdirectorate General for Data Inspection proceeded to carry out
of previous investigative actions to clarify the facts in
question, by virtue of the investigative powers granted to the investigation authorities

in article 57.1 of Regulation (EU) 2016/679 (General Regulation of Protec-
tion of Data, hereinafter RGPD), and in accordance with the provisions of Title
VII, Chapter I, Second Section, of Organic Law 3/2018, of December 5, of
Protection of Personal Data and guarantee of digital rights (hereinafter
LOPDGDD).


       On September 27, 2019, the Institute of Secondary Education
*** INSTITUTE.1 sends this Agency the following information and statements:

    1. That the students who have confessed to having uploaded images to Instagram are:


       A.A.A., born 07/25/2005.
       B.B.B., born on 05/02/2006
       C.C.C., born 11/19/2005

    2. That, according to the Judicial Police, the video published on Instagram by

       A.A.A. was made with the profile *** PROFILE.1

    3. That they are unaware of the Instagram profiles of the other videos that apparently
       the other students have posted.


       Dated *** DATE.1, it is verified that, after a search for the assault
In Google, videos and news appear in the first 50 search results in
the following domains:

*** URL.1
*** URL.2

*** URL.3
*** URL.4
*** URL.5
*** URL.6

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/16








*** URL.7
*** URL.8
*** URL.9

*** URL.10
*** URL.11
*** URL.12
*** URL.13
*** URL.14
*** URL.15

*** URL.16
*** URL.17
*** URL.18
*** URL.19
*** URL.20

*** URL.21
*** URL.22
*** URL.23
*** URL.24
*** URL.25
*** URL.26

*** URL.27
*** URL.28
*** URL.29
*** URL.30
*** URL.31

*** URL.32
*** URL.33
*** URL.34
*** URL.35
*** URL.36

*** URL.37
*** URL.38
*** URL.39
*** URL.40
*** URL.41
*** URL.42

*** URL.43
*** URL.44
*** URL.45
*** URL.46
*** URL.47








       Dated *** DATE.2, the existence of profile *** PERFI.1 is verified in
Instagram where the name of A.A.A. and the indicative of “*** INDICATIVE.1”.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/16








       On October 7, 2019, it is verified that when performing a search
profile *** PROFILE.1 on Instagram, you get the message “No results found.
two".


       On October 8, 2019, the Madrid Superior Police Headquarters (Di-
Directorate General of the Police) transmits to this Agency the following information and declares
festivals:

    1. That according to the information sent to the Madrid Minors Group by the

        guardian agents of the Municipal Police of Madrid in Attested *** ATESTADO.1:

           to. The author and main broadcaster of the video is D.D.D .., with date of birth.
               ment 05/03/2005. Releasing the recording later to Insta-
               gram, social network through which it is certain that it circulated.

           b. That it can be stated with certainty that the video circulated on the social network
               Instagram as it has been possible to verify from the account of the witness
               A.A.A. *** PROFILE. 1.

       On October 24, 2019, the Madrid Superior Police Headquarters (Di-
Directorate General of the Police) sends this Agency the following information and declares

festivals:

    1. That having carried out a user-level search in engines such as
        Google and Bing, as well as hashtags with word combinations like “XXX-
        XX ”,“ XXXXX ”,“ XXXXX ”,“ XXXXX ”, only news found in

        media about the aforementioned event.
    2. That by consulting the profile of the user *** PROFILE.1 who uploaded it to Instagram,
        said profile can no longer be found in the aforementioned social network, having disappeared
        do.


       On February 25, 2020, the Institute of Secondary Education *** INS-
TITUTO.1 of Madrid sends this Agency the following information and statements:
    1. That of the four minors referred to, A.A.A., B.B.B., C.C.C. and D.D.D., the latter
        ma, D.D.D. it is not registered in that center.

       On July 1, 2020, the State Attorney General's Office refers to this

Agency the following information and statements:

    1. That it has proceeded to initiate a governmental file with reference *** REFE-
        RENCIA. 1.
    2. That the request for information has been transferred to the Provincial Prosecutor's Office

        from Madrid.

       On July 24, 2020, the State Attorney General's Office refers to this
Agency the following information and statements:


    1. That a conviction has been handed down against the minors involved, the
        which is firm.

       On October 19, 2020, the District Police Station of *** INSTITUTE.1

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/16








of Madrid (General Directorate of the Police) sends this Agency the following information:
tion and manifestations:


    1. DNI data and postal addresses of the parents of D.D.D .;
        Mr. E.E.E. and Doña F.F.F .. What about D.D.D. no data is obtained from the
        itself, and the DNI may never have been issued.

THIRD: After the investigative actions carried out, it is found that the author
and main broadcaster of the video of the aggression suffered by a minor under 14 years old at the

day of the XXXXXXX Institute classes, on *** DATE.1, by some of its
companions is D.D.D.

FOURTH: In view of the facts denounced, the Director of the Spanish Agency
of Data Protection, on December 14, 2020, agreed to initiate procedures

sanctioning penalty against D.D.D., for the alleged infringement of article 6 of the RGPD
typified in article 83.5.a), imposing an initial sanction of “APERCIBIMIEN-
TO ”.

FIFTH: The initiation agreement has been notified to E.E.E., with NIF *** NIF.1, as it lacks the NIF
the alleged person responsible for the infringement, which appears as received on December 30,

December 2020.

SIXTH: Notified the initiation agreement, the one claimed at the time of this resolution
tion has not submitted a brief of allegations, so the aforementioned is applicable
in article 64 of Law 39/2015, of October 1, on Administrative Procedure

Common of Public Administrations, which in its section f) establishes that in case
not to make representations within the term provided on the content of the initiation agreement
ciation, it may be considered a resolution proposal when it contains a
precise statement about the responsibility imputed, so we proceed to
issue Resolution.


                                 PROVEN FACTS


FIRST: Dated *** DATE.2, they appear in the media images
related to the aggression suffered by a girl under 14 years of age at the Institute of *** INS-

TITUTO.1 (Madrid), by some of his colleagues, who proceeded to record the
images of the aggression and to disseminate them through an Instagram social network.

SECOND: The Secondary Education Institute *** INSTITUTE.1 (Madrid), identified
to the students who uploaded the images to Instagram, who confessed the
chos.

THIRD: The video with the images of the attack was published on the account of
Instagram *** PROFILE.1, whose owner was A.A.A ..

FOURTH: The Higher Police Headquarters of Madrid transfers to this Agency that,
According to the information sent by the Madrid Municipal Police, the author and main broadcaster
Lead of the video was D.D.D.

FIFTH: The State Attorney General's Office informed this Agency about the fact that
that a conviction had been handed down against the minors involved, which is
firm.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/16












                             FOUNDATIONS OF LAW

                                              I

        By virtue of the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), recognizes each

Control Authority, and as established in articles 47, 48.1, 64.2 and 68.1 of the
Organic Law 3/2018, of December 5, Protection of Personal Data and guarantees
aunt of digital rights (hereinafter, LOPDGDD), the Director of the Es-
The Data Protection Office is competent to initiate and resolve this procedure.
to.


        Article 63.2 of the LOPDGDD determines that: “The procedures
processed by the Spanish Agency for Data Protection will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in their development and, as long as they do not contradict them, in a
subsidiary, by the general rules on administrative procedures. "


                                             II

        The fact that is the object of this procedure is the diffusion made by D.-
D.D. of the recording of the images of a minor who was being attacked by

a group of minors; which constitutes an infringement of the regulations for the protection of
data.

        The physical image of a person, according to article 4.1 of the RGPD, is data
personal protection and their protection, therefore, is the object of said Regulation.


        Article 4.2 of the RGPD defines "treatment" as: "any operation or
set of operations carried out on personal data or personal data sets
sonal, whether by automated procedures or not, such as collection, registration,
organization, structuring, conservation, adaptation or modification, extraction,
consultation, use, communication by transmission, broadcast or any other form of

authorization of access, collation or interconnection, limitation, deletion or destruction. "

        The recording and dissemination of images, which identify or make identifiable
a person, in social networks implies a processing of personal data and, for
Therefore, the person who does it has to take refuge in one of the legitimate causes.

ras indicated in article 6 of the RGPD.

        In order for this treatment to be carried out lawfully, it must comply with-
is established in article 6.1 of the RGPD, which indicates:


        << 1. The treatment will only be lawful if at least one of the following is met
terms:
        a) The interested party gave their consent for the processing of their personal data.
endings for one or more specific purposes;

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/16








        b) the treatment is necessary for the performance of a contract in which the
the party is part of or for the application at his request of pre-contractual measures;
        c) the treatment is necessary for the fulfillment of an applicable legal obligation

cable to the controller;
        d) the treatment is necessary to protect vital interests of the interested party or
of another natural person;
        e) the treatment is necessary for the fulfillment of a mission carried out in
public interest or in the exercise of public powers conferred on the person responsible for the
treatment;

        f) the treatment is necessary for the satisfaction of legitimate interests perse-
guided by the person responsible for the treatment or by a third party, provided that on said
interests do not override the interests or fundamental rights and freedoms of the
interested party who require the protection of personal data, in particular when the in-
be a child.


        The provisions of letter f) of the first paragraph shall not apply to the treatment
operation carried out by public authorities in the exercise of their functions. >>.


        Article 7 of the LOPDGDD establishes the following:


        "1. The processing of personal data of a minor only
It may be based on your consent when you are over fourteen years of age.


    Exceptions are those cases in which the law requires the assistance of the holders of the
parental authority or guardianship for the celebration of the act or legal business in which
context the consent for the treatment is obtained.


        2. The treatment of the data of minors under fourteen years of age, based on the

consent, it will only be lawful if it consists of that of the holder of parental authority or guardianship, with
the scope determined by the holders of parental authority or guardianship. "


        On the one hand, we do not know the age of the minor whose image was the subject of
recording and broadcasting while she was assaulted, so it is unknown if she could
have given consent for that treatment, or should have been given by the
holders of parental authority.


        However, this sanctioning procedure is processed for the recording and
main broadcast of the video, whose authorship corresponds to D.D.D., which, when
produced the events, he had turned 14 years old.

        As indicated, for the processing of personal data it is necessary

that there is a cause that legitimizes it, as has been indicated, and that it must be collected
in article 6 of the RGPD outlined above.

        In this sense, it is included in Considerations 40 and following of the RGPD,
which indicate the following:


        “(40) For the treatment to be lawful, personal data must be processed
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/16








two with the consent of the interested party or on some other legitimate basis established
given in accordance with Law, either in this Regulation or by virtue of another Law
the Union or the Member States referred to in this Regulation,

including the need to comply with the legal obligation applicable to the person responsible for the treatment.
ment or the need to perform a contract to which the interested party is a party or with
object of taking measures at the request of the interested party prior to the conclusion of
a contract.

       “(41) When the treatment is carried out with the consent of the interested party

do, the controller must be able to demonstrate that he has given his
consent to the treatment operation ...

       In these cases, as in the case that is the subject of the claim, the only legal cause
gitimizing is usually consent, in general. It is the interested party, in this

In the case of the attacked person, the one who is entitled to protect their personal data and
your image. And it is the person who records and uploads the images to a social network who
You must show that you have that consent.

       The judgment of April 16, 2007 (STC 72/2007) of the Constitutional Court,
Regarding the dissemination of images, it indicates the following:


       “This Court has had the opportunity to rule in relation to complaints about
violations of the right to one's own image (art. 18.1 CE) in SSTC 231/1988, of
December 2, 99/1994, April 11, 117/1994, April 17, 81/2001, April 26
March, 139/2001, of June 18, 156/2001, of July 2, 83/2002, of April 22,

14/2003, of January 28, and 300/2006, of October 23.

       In what is interesting to highlight here, it follows from said doctrine that, in its
constitutional dimension, the right to one's own image (art. 18.1 CE) is configured
as a personality right, which attributes to its holder the power to dispose of

representation of their physical appearance that allows their identification, which entails
both the right to determine the graphic information generated by physical features
that make it recognizable that it can be captured or have public dissemination, such as the
right to prevent the obtaining, reproduction or publication of their own image by
an unauthorized third party (STC 81/2001, of March 26, FJ 2.


       Now, what cannot be deduced from art. 18.1 CE is that the right to
own image, as a limit of the actions of others, understand the unconditional right
and without reservation to prevent the physical features that identify the person from being captured
or spread. The right to one's own image, like any other right, is not a
absolute right, and therefore its content is delimited by that of other

constitutional rights and assets (SSTC 99/1994, of April 11, FJ 5; 81/2001, of
March 26, FJ 2; 156/2001, of July 2, FJ 6; and 14/2003, of January 28, FJ 4),
specifically the freedoms of expression or information [art. 20.1, a) and d), CE].

       The determination of these limits must be carried out taking into consideration

the teleological dimension of the right to one's own image, and for this reason we have
considered that the interest of the person in avoiding the recruitment or
dissemination of your image without your authorization or without circumstances that
legitimize that meddling. Hence, we have argued that "the capture and dissemination

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/16








of the image of the subject will only be admissible when the own - and previous - conduct of
the one or the circumstances in which he is immersed, justify the decrease of
reserve barriers so that the interest of others or the public prevails that may

collide with that one ”(STC 99/1994, of April 11, FJ 5).

       It is, therefore, that the right to one's own image (art. 18.1 CE) is
is delimited by the own will of the owner of the right, which is, in principle,
It is up to whom to decide whether or not to allow the capture or dissemination of its image by
a third. However, as already noted, there are circumstances that may

lead to the enunciated rule giving way, which will happen in cases where there is
a public interest in capturing or disseminating the image and this public interest is
considers constitutionally prevailing the interest of the person in avoiding
capture or dissemination of your image. Therefore, when this fundamental right enters
in collision with other assets or constitutionally protected rights, they must

weighing up the different competing interests and, taking into account the circumstances
specific to each case, decide which interest deserves greater protection, if the interest of the
owner of the right to the image in which their physical features are not captured or disseminated without
your consent or the public interest in capturing or disseminating your image (STC
156/2001, of July 2, FJ 6) ”.


       Likewise, the Judgment of the National High Court, of May 9, 2019,
Appeal 491/2017, affects the collision of fundamental rights and its necessary
weighting, noting in its FOURTH Law Foundation the following:

       << As we have stated in cases similar to this one (sts of May 15

from 2017 (R. 30/16); st. of June 19, 2017, (R. 1842/15) and st. July 18
2017, (R. 114/16), for the correct approach to the questions raised in the
present appeal, it should be emphasized that the Constitutional Court, in the ruling
39/2016, of March 3, recalling what was already reasoned in judgment 292/2000,
declares that: "[...] the right to data protection is not unlimited, and although the

The Constitution does not expressly impose specific limits, nor refer to the powers
public for its determination as it has done with other fundamental rights, not
doubt that they are to be found in the remaining fundamental rights and
constitutionally protected legal assets, as required by the principle of
unity of the Constitution [...] ". Based on the foregoing, and in view of the approach
of the parties, the issue raised in these proceedings is limited to the

judgment of weighting of rights and interests in confrontation. To this end, it is considered
First of all, it is necessary to define the object and content of the rights
fundamentals at stake, as this Chamber has carried out in previous
occasions when the same legal controversy has arisen.


       Following the STC just cited, it must be stated that the fundamental right
to the protection of data enshrined in article 18.4 of the Spanish Constitution, to
difference from the right to privacy of art. 18.1 CE, with whom you share the objective
to offer effective constitutional protection of personal and family privacy,
excluding the knowledge of others and the interference of third parties against your

will, seeks to guarantee that person a power of control over their data
personal information, on their use and destination, in order to prevent their illicit and harmful traffic
for the dignity and rights of the affected party. The right to data protection has,
therefore, a broader object than that of the right to privacy, since the right

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/16








fundamental to data protection extends its guarantee not only to privacy in its
constitutionally protected dimension by art. 18.1 CE, but to the sphere of
personality assets that belong to the sphere of private life,

inseparably linked to respect for personal dignity, such as the right to honor,
and to the full exercise of the rights of the person. The fundamental right to
data protection extends the constitutional guarantee to those of those data that
are relevant or have an impact on the exercise of any rights of the
person, whether or not they are constitutional rights and whether or not they relate to honor,
ideology, personal and family privacy to any other constitutionally good

protected. Thus, the object of the fundamental right to data protection
It is not limited only to the intimate data of the person, but to any type of data
personal, whether or not intimate, whose knowledge or use by third parties may affect
their rights, whether or not they are fundamental - such as those that identify or allow
identification of the person, being able to serve for the preparation of their ideological profile,

racial, sexual, economic or of any other nature, or that serve for any other
utility that in certain circumstances constitutes a threat to the individual-
because its object is not only individual privacy, already protected by art. 18.1 CE,
but the personal data. Consequently, it also reaches those
public personal data that, by virtue of being public, if accessible to the
knowledge of anyone, they do not escape the power of disposition of the affected person because

This is guaranteed by your right to data protection. As regards the right to
freedom of expression, in light of the doctrine of the Constitutional Court (SSTC
23/2010, of April 27, and 9/2007, of January 15) enshrined in article 20 of the
Constitution, includes, together with the mere expression of thoughts, beliefs,
ideas, opinions and value judgments, criticism of the behavior of another, even when the

itself is bland and may annoy, disturb or displease the person it addresses, since
This is required by pluralism, tolerance and a spirit of openness, without which there is no
democratic society exists.

       Freedom of expression is broader than freedom of information by not

operate in the exercise of the former the internal truthfulness limit that is applicable to it,
what is justified in that it aims to present ideas, opinions or value judgments
subjective that do not lend themselves to a demonstration of their accuracy, nor by their nature
abstract are susceptible of proof, and not to state facts or affirm objective data.
However, this difference does not preclude affirming that both constitute rights.
individual that all natural persons hold and that can be exercised at

through word, writing or any other means of reproduction, without prejudice to
that when such freedoms are exercised by information professionals through
of an institutionalized vehicle for the formation of public opinion, its degree of
protection reaches its highest level (STC 165/1987, of October 27). Definitely,
the recognition of freedom of expression guarantees the development of a

free public communication that allows the free circulation of ideas and value judgments
inherent in the principle of democratic legitimacy. In this sense, it deserves special
constitutional protection the dissemination of ideas that collaborate in the formation of the
public opinion and facilitate that citizens can freely form their opinions and
participate responsibly in public affairs. However, just like

happens with the other fundamental rights, the exercise of the right to freedom
expression is subject to constitutional limits that the Constitutional Court has
progressively outlined. Thus, it does not protect the presence of phrases and expressions
injurious, outrageous and offensive without regard to the ideas or opinions

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/16








expose and, therefore, unnecessary for this purpose, nor does it protect the disclosure of
facts that are nothing but mere rumors, inventions or insinuations devoid of
foundation, nor does it give shelter to tricks or insults, since it does not recognize a

alleged right to insult. Along with this, the expansive trend of freedom of
expression also finds its limit in respecting the normative content
guaranteed by other fundamental rights, the affectation of which is not necessary
for the constitutional realization of the right. Delimitation that can only be done
by means of the adequate weighting of the constitutional values faced, among
which highlights the guarantee of the existence of public opinion, indissolubly

united to political pluralism, it must be remembered that, as recognized by the
section 4 of art. 20 CE, all the freedoms recognized in the precept have their
limit on the right to honor, privacy, self-image and protection of the
youth and childhood, which play a "limiting function" in relation to these
freedoms. Therefore, the protection of these other rights is weakened.

constitutional provisions that Article 20.4 CE recognizes regarding freedom of expression
and information, when exercised in connection with matters that are of interest
in general, by the subjects to which they refer and by the people who intervene in them
and contribute, consequently, to the formation of public opinion, as occurs
when they affect public persons, who exercise public functions or are
involved in matters of public relevance, thus obliged to bear a certain

risk that your subjective rights of personality are affected by
opinions or information of general interest (SSTC 107/1988, of June 8,
20/2002, of January 28, 160/2003, of September 15, 151/2004, of
September, and 9/2007, of January 15). >>


       In the case analyzed, there is a collision between the right of
information that D.D.D. to disseminate the recording of the minor attacked
through social networks and the right to the protection of personal data of the
young woman attacked. When weighing the interests of the attacked young woman, we must determine
that your right to the protection of your personal data prevails.

                                           IV


       Article 3 of Law 39/2015 grants the ability to act to minors under
age “for the exercise and defense of those of their rights and interests whose

action is allowed by the legal system without the assistance of the person
that exercises parental authority, guardianship or curatorship ”. In what interests us here, age
to grant consent for the processing of personal data, as well as to
exercise data protection rights, without the assistance of the owner of
parental authority is 14 years old, therefore, in this case the minor has that

capacity to act and, consequently, you can be charged with a violation of the
data protection regulations.


       In this same sense, the Administrative Court of Navarra, in its
RESOLUTION number 00743/15, March 24, 2015 states the following in the
Second Law Foundation:

       << SECOND.- Imputability of minors for administrative offenses.

       The appellants invoke the doctrine contained in Resolution number 949, of

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/16








March 31, 2014, of this Court. However, as the City Council alleges, the
It referred to a child under 14 years of age. In said resolution the following were made
considerations:


        “Indeed, current criminal law sets an age below which per-
sona is unimputable (14 years old), and establishes an age range from 14 and under
18 years of age, respectively, to whom the Penal Code for adults should not apply.
but a specific one promulgated for them, with a clearly educational purpose, and a
third stage or step from the age of 18 and under 21, considered

totally attributable, for all intents and purposes, but according to the gravity of the facts
committed, and given his youth, his newly acquired maturity, lack of life experience,
prolongation of adolescence, for reasons of criminal policy, in some cases
should be considered in the previous section (from 14 to 18 years old) to apply
carles the same Code or criminal law.


        And it is that, as the Organic Law 5/2000, of January 12, of Responsible-
Criminal bility of Minors, in its Statement of Motives, "4. Article 19 of the validity
The Penal Code, approved by Organic Law 10/1995, of November 23, sets effect-
the legal age of majority at eighteen years of age and requires express regulation
sa of the criminal responsibility of minors of that age in an independent Law

tea. Also to respond to this requirement, this Organic Law is approved, if
Well, the provisions on this point in the Penal Code must be complemented in a
double meaning. First, firmly establishing the principle that responsibility
Criminal bility of minors presents a primordial character compared to that of adults
educational intervention that transcends all aspects of its legal regulation.

ca and that determines considerable differences between the meaning and the procedure of the
sanctions in both sectors, without prejudice to the guarantees common to all justice-
ble. Second, the age limit of eighteen years established by the Code
Criminal to refer to the criminal responsibility of minors requires another limit
minimum starting from which the possibility of demanding that responsibility begins and that

has been completed in fourteen years, based on the conviction that infractions
committed by children under this age are generally irrelevant and that, in
the few assumptions in which they can cause social alarm, are sufficient
to give them an equally adequate response in the family and care settings
civil, without the need for the intervention of the State sanctioning judicial apparatus ".


        And add, later, the following:

        "10. In accordance with the aforementioned principles, the limit is unequivocally established
half of fourteen years of age to demand this type of sanctioned responsibility-
ra to minors of criminal age and are differentiated, in the scope of the Law

and the graduation of the consequences for the acts committed, two sections, of ca-
twisted sixteen and seventeen to eighteen years, for presenting one and the other different group-
characteristics that require, from a scientific and legal point of view, a
differentiated treatment, constituting a specific aggravation in the section of the
over sixteen years the commission of crimes characterized by violence,

intimidation or danger to people ".

        And, therefore, article 1 of said Organic Law, entitled "General Declaration",
prescribes the following:

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/16









       "1. This Law shall be applied to demand the responsibility of the elderly
fourteen years old and under eighteen for the commission of acts classified as

crimes or misdemeanors in the Penal Code or special criminal laws.

       2. The persons to whom this Law applies shall enjoy all the rights
rights recognized in the Constitution and in the legal system, particularly
in Organic Law 1/1996, of January 15, on the Legal Protection of Minors, as well
as in the Convention on the Rights of the Child of November 20, 1989 and in

all those rules on the protection of minors contained in the valid Treaties
damente celebrated by Spain ".

       Well, based on the above, it is considered that, transferring the principles
principles from criminal law to administrative sanctioning law, cannot be considered

responsible for an administrative offense against a 13-year-old person (a "child", in
bras of the Statement of Motives of the referred Organic Law) »...

       Unlike what happens in the criminal sphere, there is no administrative right
specific sanctioning procedure for minors. Although the doctrine comes
I send a new administrative sanctioning law for minors who

adopts criminal legal dogmatics as far as possible and includes sanctions
adequate sanctions for minors, more effective sanctions with a clearly educational purpose
cative, as is already foreseen in the criminal sphere, for the moment the laws and regulations that
typify administrative offenses and establish the corresponding sanctions not
they usually make a distinction between adults and minors. In general,

then, we have to understand that those over 14 years of age can be charged for such
infringements, unless otherwise tacitly or expressly provided ...

       There are in our legal system some other laws that take for granted
put the responsibility of minors. Thus, articles 24, 25 and 26 of the Or-

Genic 3/2013, of June 20, on the protection of the athlete's health and the fight against
doping in sports activities, establish penalties for very serious infractions
you see but they add that "when a minor is involved in the aforementioned behaviors
of age, or in case of recidivism, the pecuniary sanction may only be valid
accessory character and will be sanctioned with a fine of 40,000 to 400,000 euros ".
50.3 of Law 11/2007, of October 26, on Libraries of the Basque Country and article

54.3 of Law 16/2003, of December 22, of the Andalusian System of Libraries and
Documentation Centers, attribute to parents, guardians or people who exercise the
keeps the minor user the subsidiary responsibility of the pe-
cuniaries that are imposed on him.


       The Sentence of the Superior Court of Justice of Madrid of July 3,
2001 (JUR 2001/307309) makes the following considerations in this regard:

       "The plaintiff's first substantive allegation is that it was a me-
nor of 18 years, and over 16, at the time of committing the offense, so

there is a cause of administrative unimputability, and in this regard it can be said that the
Article 30 of Law 30/1992, on the Legal Regime of Public Administrations and
of the Common Administrative Procedure determines that minors have
capacity to act before said Public Administrations for the defense of their interests

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/16








cattle, therefore they are also qualified to assume the responsibility
administrative authority derived from their actions; the fact that the age of majority pe-
nal is set at 18 years, it does not deprive administrative responsibility, which does not

it has a punitive character but rather of protection of public interests, it has to be assumed
by those who have the capacity to act also before the Administration.

        Administrative responsibility, whether through fraud or fault, and even
simple negligence, is widely recognized by our jurisprudence, and even
expressly in article 130.1 of the aforementioned Law 30/1992, the simple failure to obey

servance ".

        The municipal ordinance on the protection of public spaces and conduct
Civicas de Zizur Mayor does not contain any limitation in this regard. Its article 40,
responsible persons, provides that "they shall be directly responsible for the infractions

to this Ordinance the material authors of the same ", and adds in its section
3:

        "In general, the people will be jointly and severally liable for the damages.
private physical or legal entities on which the legal duty to protect
come administrative infractions that others may commit.


        In the event that the person responsible is a minor or participates in the former,
na legal cause of inimputability, the parents, guardians or those who have
entrusted with legal custody ".


        Therefore, we must consider that the responsibility for the commission of the
infractions that typify the Ordinance is enforceable from the age of 14 and that, only-
mind for the purpose of answering for the damages committed by minors under 18 years of age,
the joint and several liability of their parents or guardians may be required. In the present case,
the contested act is the imposition of an administrative sanction and does not include the

liability requirement for damages that, where appropriate, the City Council could
require in separate file. Therefore, it is in accordance with the law that
imposed the penalty on its author. >>

        In application of the fundamentals outlined, D.D.D. is responsible for the treatment
data collection of the minor attacked when recording and disseminating her image, being

data protection regulations.

                                             V

      D.D.D., in its capacity as data controller, in accordance with article 6

RGPD, was obliged to have a cause of legitimacy of those indicated in the menu.
cited article, having totally and absolutely dispensed with it.

      In short, the recording and subsequent dissemination of the images of the least aggressor
dida does not have any legitimizing cause as required by article 6 of the RGPD.


      The data processing carried out violates article 6 of the RGPD conduct that
is subsumed in article 83.5 of the RGPD, which provides: “Violations of the dis-
Subsequent positions will be penalized in accordance with section 2, with fines administered

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/16








nistrative of EUR 20,000,000 maximum or, in the case of a company, a
an amount equivalent to a maximum of 4% of the total global annual business volume of the
previous financial year, opting for the one with the highest amount:


      a) the basic principles for the treatment, including the conditions for the treatment
consent in accordance with articles 5, 6, 7 and 9;

      For the mere purposes of prescription, article 72.1.b) of the LOPDGDD qualifies
very serious "b) The processing of personal data without the concurrence of any of the

conditions of legality of the treatment established in article 6 of the Regulation
(EU) 2016/679. ". The statute of limitations for very serious offenses provided for in the
Organic Law 3/2018 is three years.



                                             SAW

      Article 58.2 of the RGPD establishes:

      “Each supervisory authority shall have all the following corrective powers
listed below:

      to) (..)
      b) punish any person in charge or in charge of treatment with warning
when the processing operations have infringed the provisions of this
Regulation;
      c) ...

      d) order the person in charge or in charge of treatment that the operations of
treatment comply with the provisions of this Regulation, where appropriate,
in a certain way and within a specified time;
      (...)
      i) impose an administrative fine in accordance with article 83, in addition or instead

of the measures mentioned in this section, according to the circumstances of
each particular case ”.

      Without prejudice to the provisions of article 83 of the RGPD, the aforementioned Regulation
provides in its art. 58.2 b) the possibility of sanctioning with warning, in relation to
with what is stated in Considering 148:


      “In the event of a minor offense, or if the fine that is likely to be imposed constitutes
would have a disproportionate burden on a natural person, instead of a me-
A fine may be imposed. It must nevertheless be paid special
attention to the nature, seriousness and duration of the offense, to its intentional nature

nal, to the measures taken to alleviate the damages suffered, to the degree of
liability or any relevant prior infringement, to the way in which the authority
of control has had knowledge of the infraction, to the fulfillment of
denounced against the person in charge or in charge, the adherence to codes of conduct and
any other aggravating or mitigating circumstance. "


      In the present case, taking into account the special circumstances that concur in the
person responsible for the infringement and making a broad interpretation of the criteria
that inspires Recital 148 of the RGPD, according to which when the fine that proves

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 15/16








If it were imposed, it would constitute a disproportionate burden, it is estimated that
Infringement of article 6 of the RGPD proceeds imposes the sanction of warning.


      Likewise, it is appropriate to impose the corrective measure described in article 58.2.d)
RGPD and order the respondent not to process personal data (such as,
for example, the recording and dissemination of videos) without having the right to do so;
For example, the consent of those affected is one of the legitimizing causes of the
treatment, under article 6 of the RGPD.


       The respondent is considered to have violated article 6 of the RGPD by recording and
disseminating the images of a minor who was being attacked without cause
legitimizing for it. This conduct is typified in article 83.5.a) of the RGPD and
Such conduct is sanctioned with warning and with the corrective measure already indicated.


       Therefore, in accordance with the applicable legislation and assessed the criteria of
graduation of sanctions whose existence has been proven,

       Therefore, in accordance with the foregoing, By the Director of the Agency
Spanish Data Protection Company, the following is issued:


                                       RESOLVES:


APPEAR: A D.D.D., for the violation of article 6 of the RGPD typified in article
83.5.a).

REQUIRE: A D.D.D., in accordance with the provisions of article 58.2 d) of the RGPD
that it does not carry out any data processing without having any legitimate cause

scam of such treatment.

THIRD: NOTIFY this resolution to D. E.E.E., as the father of the
less.

       In accordance with the provisions of article 50 of the LOPDPGDD, the
This Resolution will be made public once it has been notified to the interested parties.

       Against this resolution, which ends the administrative procedure in accordance with art.
48.6 of the LOPDPGDD, and in accordance with the provisions of article 123 of the LPA-
CAP, the interested parties may file, optionally, an appeal for reconsideration before
the Director of the Spanish Data Protection Agency within one month to

count from the day after the notification of this resolution or directly appeal
contentious administrative procedure before the Contentious-Administrative Chamber of the
National authority, in accordance with the provisions of article 25 and section 5 of the
Fourth additional provision of Law 29/1998, of July 13, regulating the Jurisdiction
Contentious-administrative diction, within two months from the day if-
following the notification of this act, as provided in article 46.1 of the aforementioned

Law.

       Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the
LPACAP, the firm resolution may be suspended in an administrative way
If the interested party expresses his intention to file a contentious appeal-

administrative. If this is the case, the interested party must formally communicate this
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 16/16









made by writing to the Spanish Data Protection Agency,
Presenting it through the Electronic Registry of the Agency
[https://sedeagpd.gob.es/sede-electronica-web/], or through any of the rest
records provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. Also

must forward to the Agency the documentation that proves the effective filing
of the contentious-administrative appeal. If the Agency is not aware of the
filing of the contentious-administrative appeal within a period of two months from the
day after the notification of this resolution, I would terminate the

precautionary suspension. 938-131120

Mar Spain Martí
Director of the Spanish Agency for Data Protection

















































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es