AEPD (Spain) - EXP202202837

AEPD - ps-00107-2022
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR Article 83(2) GDPR §169(1) Criminal Code §7 LOPDGDD §76(2)(a) LOPDGDD
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	5.000 EUR
Parties:	n/a
National Case Number/Name:	ps-00107-2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Michelle Ayora

The Spanish DPA imposed a €5,000 fine on a 16 years-old teenager for using videos and pictures received via WhatsApp to blackmail a 13 year-old minor who could not express valid consent. The DPA also ordered the teenager to delete any other personal data regarding the data subject and to report about the measures adopted to do so.

English Summary

Facts

The 16 year-old (controller) and the 13 year-old (data subject) were in contact through Instagram and WhatsApp, where the data subject sent intimate images to the controller. After some time, the controller asked for more images and, to obtain that, the controller threatened and blackmailed the data subject by stating that those videos and images will be made public on social media. As a result, the data subject sent more images. For the above-mentioned facts, the defendant was sentenced by the Juvenile Court.

The data subject’s parent also submitted a complaint before the Spanish DPA, which initiated an investigative proceeding for an alleged violation of Article 6(1) GDPR.

The defendant claimed the violation of the constitutional principle non bis in idem since the controller was already found guilty of criminal threats by a juvenile court.

Holding

In the first place, the DPA challenged the claim regarding the principle non bis in idem. In order to guarantee legal certainty, no administrative sanction should be adopted if a criminal sanction was already applied for materially the same offence. However, the DPA held that in this case, the sanctioning offences were not the same. The DPA stated the necessary elements to consider sanctioning concurrence, that is, the similarity between subject, facts and ground. In the present case, there was only similarity regarding the subject; however, there was neither a factual nor a causal similarity. About the correlation of facts, the DPA stated that the juvenile criminal proceedings started and ended due to the violation of Article 169(1) of the Spanish Criminal Code (threatening the data subject) whereas the present sanctioning proceeding started due to the alleged violation of Article 6(1)(a) GDPR (unlawful processing of data subject’s personal data and void consent). Regarding the ground or reason, the DPA stated that in the juvenile criminal proceedings, the protected legal good was the right to freedom of choice whereas, in this administrative proceeding, it was the right to have one's personal data protected. Therefore, the DPA was allowed to start sanctioning proceedings against the controller.

Secondly, the DPA mentioned that the mere collection, register, and storage of the data subject’s images and videos made by the controller were enough to be considered as processing of personal data under Article 4(2) GDPR, hence making the GDPR applicable.

In third place, the DPA recalled the need for a legal basis for processing. Regarding consent, since the data subject was a minor, Article 7 of the National Legislation was applicable. The provision foresees that consent is only valid if given by someone over 14 years old. Otherwise, the consent of parents or another legal representative is mandatory. In the present case, the minor was 13 years old, therefore, the processing could not be based on consent in relation to Article 6(1)(a) GDPR since the consent could not be considered valid.

Finally, the DPA applied two aggravating circumstances of Article 83(2) GDPR: the nature scope and purpose of the processing concerned as well as the level of damage for the data subjects, and the intentional character of the infringement, since the defendant threatened the data subject, and this was proven by a judicial sentence. Similarly, the DPA applied one aggravating circumstance contained in Article 76(2)(a) of the National Legislation: prejudice to a minor.

On the other hand, the DPA applied the principle of proportionality as well as individualisation of sanctions and considered the defendant’s testimony about the deletion of the images and videos, which stopped the processing of such data.

The DPA imposed a fine of €5,000 for a lack of valid legal basis for processing under Article 6 GDPR, ordered the contrroller to delete any other personal data regarding the data subject and requested the controller to report about the measures adopted to do so.

Comment

In Spain, the administrative law allows minors over 14 years old to be administratively sanctioned for violations of such laws. In those cases, their parents become responsible for the payment (indirect liability) as explained by the DPA in this brochure: https://www.aepd.es/es/documento/responsabilidad-menores-padres-madres.pdf . The legal basis for this measure is Article 3 LPAC .

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/18








     Procedure No.: PS/00107/2022 (EXP202202837)

                 RESOLUTION SANCTION PROCEDURE


By Agreement dated 03/11/22, the sanctioning procedure was initiated,
PS/0107/2022, instructed by the Spanish Data Protection Agency before D.
A.A.A., by virtue of the claim presented by D. B.B.B., on behalf of its
minor daughter, for the alleged violation of the regulations for the protection of
Data: Regulation (EU) 2016/679, of the European Parliament and of the Council, of

04/27/16, regarding the Protection of Physical Persons with regard to the
Processing of Personal Data and the Free Movement of these Data (RGPD), and
violation of Organic Law 3/2018, of December 5, on Data Protection
Personal Rights and Guarantee of Digital Rights (LOPDGDD), and based on
the following:


                                  BACKGROUND

FIRST: On 03/02/22, you have an entry in this Agency, writing presented by
the claimant, in which he indicated, among other things, the following:


       "In the court ruling it is described how the defendant threatened and blackmailed
       my underage daughter to send her sensitive images via chat
       Instagram and WhatsApp. Through Instagram communications begin on
       10/15/19 at 23:20 and by WhatsApp the communications that are preserved
       They are as of 01/02/20.”


Along with the claim document, provide the data and dates of the Instagram accounts
and WhatsApp and telephone numbers of the defendant and his underage daughter.

A copy of Judgment No. XX/02020 of Juvenile Court No.

(...).- Reform File number XXX/2020 (Prosecutor's Office number XXX/2020), where
The following is stated in the “Proven Facts” of the Judgment:

       That the defendant, browsing the Instagram application, met the minor
       of age (Claimant's daughter) aged 13, entering into such a close relationship
       of confidence that the minor sent him videos and photos of an intimate nature,

       both through the Instagram application and through WhatsApp.

       That, after some time, the defendant demanded that the girl follow him
       sending photos and videos, but since she refused, the defendant intimidated her
       telling him that he would upload the photos and videos he already had to social media.


       That the minor, fearful of her threats, sent (...).

SECOND: On 03/09/22, by the Director of the Spanish Agency for
Protection of Data, an agreement is issued to admit the processing of the claim

presented by the claimant, in accordance with article 65 of the LOPDGDD Law,
when assessing possible rational indications of a violation of the rules in the field
of the powers of the Spanish Data Protection Agency.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/18








THIRD: On 03/11/22, by the Board of Directors of the Spanish Agency for
Data Protection, sanctioning procedure begins when appreciating indications
reasonable violation of the provisions of article 6.1 of the GDPR, imposing

an initial penalty of 10,000 euros (ten thousand euros).

FOURTH: Once the initiation agreement has been notified to the claimed person, the latter by means of
brief dated 04/06/22 made the following allegations:

       "PREVIOUS. - Go ahead that at the time of the facts my

       represented was a minor, and was 16 years old, without even
       He will not even be forced to delete the videos that are the object of litigation because in his
       statement stated that they had been deleted and that inferring to the minor that
       send him more videos because if he didn't post them on the internet it was and was for what
       has been sentenced, that is to say for that conditional threat requiring more

       videos, insisting that they were deleted.

       VIOLATION OF THE CONSTITUTIONAL PRINCIPLE "NON BIS IN IDEM"

       The defendant was convicted criminally in the referenced File of
       Reform as author of a crime of conditional threats, in accordance

       between the parties the measure of four months maximum of socio-educational tasks,
       oriented to a sexual affective program and gender perspective.

       This fundamental right is recognized in art. 18.4 C.E. is the one
       is violated. Said article provides that "The Law shall limit the use of the

       information technology to guarantee the honor and personal and family privacy of the
       citizens and the full exercise of their rights". According to repeated
       jurisprudence of the Constitutional Court, article 78.4 EC contains a
       institute for the guarantee of the rights to privacy and honor, and to full
       enjoy the remaining rights of citizens, and therefore also, "the

       fundamental right to data protection, understood as the right to
       freedom from potential attacks on the dignity and freedom of the
       person from an illegitimate use of the automated treatment of
       data, what the Constitution calls "informatics". (STC 290/2000 of 30
       November, in its Fundamental'7"; SRC 743/7994' of May 9 in its
       Foundation J"; STC 17/7998 of January 13, in its Foundation 4").


       The constitutional and legal configuration of the fundamental right to protection
       of data (specifically through the Organic Law on Data Protection)
       confers on its holder a series of powers to guarantee its protection, and Ie
       gives peculiarities in its content, which distinguishes it from others since

       confers on its owner a series of powers consisting of imposing on third parties,
       certain legal duties, which, for example, are contained in the law
       fundamental to privacy, that is, "guarantees the person a power of
       control over your personal data", which is only possible and effective
       imposing on third parties certain duties to do (namely: the right to

       that prior consent is required for the collection and use of data
       personal information, the right to know and be informed about the destination and use of the
       data, and the right to access, rectify and cancel said data. to avoid
       this type of interference, the LOPD grants the Spanish Agency of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/18








       Data Protection the protective and preventive nature of such rights, to
       ensure, through its exercise, the safeguarding and ensuring the right
       fundamental to the protection of said personal rights in relation to the

       limits, to the use of computing.

       The Spanish Data Protection Agency, after completing the proceedings
       previous inspection carried out since the month of May, has given transfer
       the final inspection report to the Investigating Court No. XX of Madrid, and
       has launched a disciplinary procedure, which is suspended

       until the resolution of the criminal judicial procedure given the pendency of the
       same, as provided for in the Administrative Procedure legislation.

       The criminal process will question the sanctioning reaction of the AEPD in due course,
       since the judicial resolution that is definitively handed down in the criminal process

       will condition its action as a consequence of respect for the non bis principle
       in idem, included in article 25.7 of the Constitution, which constitutes a
       true fundamental right of the citizen in our Law.

       The "non bis in idem" principle has a double dimension, as explained by the
       STC 188/2005, of July 7:


       a) Material or substitute that prevents sanctioning the same fact with the same
       same disproportionate punitive.

       b. The procedural or formal, which proscribes the duplication of procedures

       sanctions in case there is a triple identity of subject, fact and
       foundation, and which has as its first concretion "the rule of preference or
       precedence of the criminal judicial authority over the Administration with respect to
       its performance in disciplinary matters in those cases in which the facts
       to sanction may be, not only constituting an administrative infraction, but also

       also crime or misdemeanor according to the Penal Code. Therefore, it will be necessary
       determine whether both in the criminal procedure and in the procedure
       sanctioner there is total identity, or on the contrary, there is some element
       novelty that excludes the application of the Principle.

       The ECHR did not begin to consider the question of the criminal characterization of

       a procedure with the first application of art. 4, but had already entered
       to assess these disquisitions on the occasion of the application of the guarantees of the
       art. 6 of the Convention relating to fair trial. First, you enter
       to consider the classification of the offense and its sanction by law
       national. In the event that domestic law classifies these as criminal or

       criminals, will automatically be classified as such for the purposes of the convention.

       TWO.- LACK OF PUBLICATION TO THIRD PARTIES OF ANY
       THE VIDEOS THAT THE MINOR (14 YEARS OLD) SENT TO THE MINOR (16 YEARS OLD)
       YEARS).


       There is no evidence whatsoever, with which it can be determined that the data of
       personal nature in terms of videos sent some voluntarily by the
       minor through the INSTAGRAM and WHATSSAP applications, have been

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/18








       disclosed to third parties and not only that there is no proof that said
       personal data have not been disclosed to third parties, but rather
       stated that said videos had been deleted and that those sent without

       consent of the minor are exclusively due to criminal reproach
       suffered with the Judgment that, according to the complainant, contributes to his
       written complaint, in addition to the ignorance of the age of the minor, but
       for whose acts he was sentenced for conditional threats, threats
       that were based not on the own sending of said vices but on the demand
       that could be carried out for the minor, regarding the person who was also a minor.


       THIRD.- REGARDING THE CONSENT OF THE MINOR, THE
       ILLEGITIMATE USE BY THE LESSER OF THE NETWORKS
       SOCIAL, BREACH OF PARENTAL OBLIGATIONS OR
       IMPLIED CONSENT FOR THE USE OF NETWORKS

       SOCIAL COMPANIES THAT DO NOT REPORT THEIR APPS TO MINORS.

       The Royal Decree 1720/2001, of December 27, which approves the
       Regulations for the development of Organic Law 15/1999, of December 13, of
       protection of personal data, literally says:


       Section 1 Obtaining the consent of the affected party

       Article 12. General principles.

       1.- The data controller must obtain the consent of the

       interested personal character unless required in accordance with the treatment
       of your data itself from in no to those cases in which the Io provided in
       laws. The request for consent must refer to a treatment or
       series of specific treatments, with delimitation of the purpose for which they are
       collects, as well as the remaining conditions that occur in the treatment

       or series of treatments.

       2.- When the consent of the affected party is requested for the assignment of their
       data, he must be informed in such a way that he knows unequivocally the
       the purpose for which the data will be used with respect to whose communication
       requests the consent and the type of activity carried out by the assignee.

       Otherwise. consent will be void.

       3.- The person responsible for the treatment will be responsible for the existence of the
       consent by any means of evidence admissible by law.


       Article 13. Consent for the treatment of data of minors.

       1.- The data of those over fourteen may be processed
       years with your consent, except in those cases in which the Law requires
       for its provision the assistance of the holders of parental authority or guardianship.

       In the case of minors under fourteen years of age, the consent of
       parents or guardians.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/18








       2.- In no case may data be collected from the minor that allows obtaining
       information about the other members of the family group, or about the
       characteristics thereof, such as data relating to the professional activity of

       parents, economic information, sociological data or any other
       others. In no case may data be collected from the minor that allows obtaining
       information about the other members of the family group, or about the
       characteristics of the same, such as the data related to the professional activity of
       parents, economic information, sociological data or any
       others, without the consent of the owners of such data. However, they may

       collect the identity and address data of the father, mother or guardian with the
       sole purpose of obtaining the authorization provided for in the previous section.

       3.- When the treatment refers to data of minors, the
       information addressed to them must be expressed in a language that is

       easily understandable by those, with express indication of the provisions
       in this article.

       4.- It will correspond to the person in charge of the file or joint treatment the
       procedures to ensure that the correctness of the
       age of the minor and the authenticity of the consent given in his case, for

       parents, guardians or legal representatives.

       Article 14. Form of obtaining consent.

       1.- The controller may request the consent of the

       interested party through the procedure established in this article, except
       when the Law requires the same to obtain express consent for the
       treatment.

       2.- The person in charge may address the affected party, informing him in the terms

       provided for in articles 5 of LO 15/1999, of December 13 and 12.2 of
       this regulation and must grant them a period of thirty days to express
       refusal to treatment, warning him that in case of ruling to such
       effect, it will be understood that you consent to the processing of your personal data
       staff.


       In other words, in Instagram's own conditions of use you can
       clearly read what is the minimum age to create a profile on Instagram
       just like WhatsApp.

       But of course, made the Law cheated. If a preteen under the age of 14

       years old, you want to create a profile on Instagram, all you have to do is vary a few
       numbers of your date of birth.

       There is also the issue of parental control, that is, if our inferior son or daughter
       14 year old wants an Instagram profile, we can create it with our

       authorization and then activate parental control, which we understand that this must
       be the case... right?... Without the existence of consent being controversial
       express of a minor under 13 years of age from an Instagram and WhatsApp account.
       Who has consented for the minor to have an account on Instagram and on

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/18








       WhatsApp? Parents? , Who has bought the mobile to the minor? , the
       fathers? , because the parents do not report, activate or control what their
       13 year old daughter with a mobile.


       The defendant has responded with respect to criminal justice. Parents shouldn't
       to answer anything regarding their parental obligations?

       At the most favorable point for parents.... Consequently, is the
       tacit consent? That is, that consent has been obtained by

       writing and that this has not been expressly stated (although neither
       YOUR opposition) what is understood that there is authorization for it, since it is not
       there is evidence against the fact that the parents were unaware that their daughter was not
       had the Instagram or WhatsApp applications, or documented
       that he fences without hesitation, the express opposition to his daughter having Instagram.


       Is there that tacit consent of the person who holds parental authority, for
       application of Article 14.2 of the Regulation?

       Are parents responsible for non-compliance with Article 154 of the Code
       Civil, insofar as this is defined as ... Parental authority, as

       Parental responsibility will always be exercised in the interests of the sons and daughters, in
       accordance with their personality, and with respect for their rights, their integrity
       physical and mental... this is also being breached by the parents, they must
       Does the Social Services have knowledge of said individual?


       Instagram prevents adults from sending private messages to people
       under 18 if they are not followed. In this way, if an adult pretends
       write to a teenager, a notification will come that it is not possible to send him
       a Direct Message.


       As for WhatsApp, its security and privacy positioning is still
       more severe and says: ...About the minimum age to use WhatsApp

       If you reside in a country of the European Economic Area (including the Union
       Union) or in any other country or territory that is part of it

       (collectively referred to as the European Region), you must be at least 16 years of age (or
       more, if required by the legislation of your country) to register in WhatsApp.

       If you reside in a country that does not belong to the European Region, you must have at
       least 13 years (or more, if required by the legislation of your country) to

       register in WhatsApp and use the service.

       For more information, see our Terms of Service.
       Note:
       Creating accounts with false information constitutes a breach of
       our Conditions.


       The registration of accounts on behalf of other minors also
       constitutes a breach of our Conditions. report a minor
       age

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/18









       If a minor in your care created a WhatsApp account, you can show them
       how to remove it For information on how to delete an account,

       Check out our Help Center.

       If you want to report an account that belongs to a minor, please,
       send us an email. In your email, provide the
       following documentation and delete or hide any personal information not
       related:

       Proof that the WhatsApp number belongs to you (for example, a copy of a
       government-issued ID and a phone bill
       with the same name) Proof that you are the minor's legal representative (for
       example, copy of the child's birth or adoption certificate)


       Proof of the minor's date of birth (for example, a copy of the certificate
       of birth or adoption of the minor)

       If we can verify that the WhatsApp account belongs to a minor
       old, we will deactivate it immediately. You will not receive any confirmation of

       this action. Our ability to review and take action
       about a report is greatly improved if you provide us with all
       information that we just requested.

       If we cannot verify that the reported account belongs to a minor, it is
       we may not be able to take action on it. case, if you are not

       representative of the minor, we recommend that you encourage the person representing him to
       that you contact us using the instructions described above.

       A question that their own parents never did. The already claimed
       responded regarding the more punitive justice such as criminal justice, should they

       answer the parents of the minor regarding their obligations that typify the
       parental authority of 154 of the Civil Code? Should an investigation be initiated into
       through social services about whether parents do not comply with their
       obligations and consequently the minor must be protected?


       FOURTH.- SCOPE OF THE PSYCHOLOGICAL OR MORAL DAMAGE SUFFERED BY
       THE MINOR.

       There is no accredited psychological or moral damage in the criminal procedure
       nor is there evidence of civil liability attributable to the defendant. By
       all of it,


       I REQUEST THE DIRECTOR: That she consider this document presented, as
       admit, so that, after the appropriate legal procedures, the ARCHIVE proceeds,
       of this file for all the arguments put forward in the body of the
       this document, and all this prior to the practice of the evidence requested

       in the body of this document:




C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/18








       - That, as means of proof, it is requested that the Court of
       Minors (...) to send a complete and witnessed copy of the Record of
       Reform No. XXX/20.


       -That the company Instagram S.L. located in Finca la Vaqueria. crta
       Belvis del Jarama k, MADRID, to provide supporting documents of the
       privacy policy and also that it be provided, upon request to the
       parents of the minor of the name of his Instagram profile as well as the
       parental consent for use by the

       minor, or if in his case the data was falsified in order to create a
       Instagram at only 13 years old.

       -That it be officiated at the WhatsApp Inc company, with smb email
       web@support.whatsapp.com and tax address at 1601 Willow Road (MenIo

       Park of California 94025 ), to provide supporting documents of the
       privacy policy and also that it be provided, upon request to the
       parents of the minor of the phone associated with WhatsApp as well as the
       parental consent for use by the
       minor, or if in his case the data was falsified in order to create a
       Instagram at only 13 years old.


       - That the parents of the minor are required to provide the invoice
       Telephone purchase of the telephone or the telephone bill to which your
       associated phone to open said apps and justify that they were
       knowing that his daughter was the owner of said mobile phone.


       .- That the parents of the minor be required to contribute a single
       indication about the transmission to third parties of the videos of sexual content that
       allegedly the defendant has spread on the Internet.


       .- That the Juvenile Court of (...) be required to report on the
       measures or socio-educational plan that my principal is studying and he barely
       there are a few days left for compliance and consequently said report is not
       has at disposal.

       ANOTHER I SAY: This part anticipates the nullity of full-fledged Actions

       for depriving my principal of the right of defense and not officiating or requesting or putting
       implement the requested measures.

FIFTH: On 07/27/22, the claimant is notified of the proposed resolution in
which responded to the allegations raised and proposed that, due to the

Director of the Spanish Data Protection Agency proceed, in accordance with
the provisions of articles 63 and 64 of Law 39/2015, of October 1, of
Common Administrative Procedure of Public Administrations (LPACAP), to
impose a penalty of 10,000 euros (ten thousand euros) on the defendant, for the infringement
of article 6.1 of the GDPR and that it proceed to order, as a measure, the

suspension of all processing of personal data relating to the girl, minor and
deletion of said data, in accordance with the provisions of art. 69 of the LOPDGDD.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/18








SIXTH: Once the proposed resolution was notified to the claimant on 07/27/22, the
dated 08/12/22, in this Agency writing of allegations to the proposal of
Resolution that is an identical reproduction of the one presented against the initiation agreement

of the present proceeding and which is reproduced in its entirety above.

                                PROVEN FACTS.

Of the actions carried out in this procedure and of the information and
documentation submitted, the following circumstances have been accredited:


First: As can be seen from Judgment No. XX/02020 of the Juvenile Court
Nº (…) (Reform File number XXX/2020), the defendant demanded from the girl,
underage, to continue sending her photos and videos, but since she
denied, he intimidated her by telling her that he would upload the photos and videos that he already had to the networks

social. Despite his opposition and refusal for the defendant to continue obtaining photos
and intimate videos of her, fearful of her threats, she sent (...) with
images of you to the claimant.

                           FUNDAMENTALS OF LAW


                                           YO-
                                     Competition.

It is competent to initiate and resolve this Disciplinary Procedure, the Director of
the Spanish Data Protection Agency, by virtue of the powers that art 58.2

of the GDPR recognizes the control authority, as well as what is established in arts. 47,
64.2 and 68.1 of the Law, LOPDGDD.
                                          II.-
    On the allegations presented to the proposed resolution of the file
                                     sanctioning.


As a preliminary matter, it is stated that for the Resolution of this
disciplinary proceedings have taken into account the allegations presented by the
claimed throughout the entire procedure and that, in order not to repeat itself, considers them
reproduced.


However, before assessing the offense committed in this case, it must be
make the following considerations regarding the allegations presented to the
resolution proposal:

       On the concurrence of the principle "non bis in idem":


This principle, developed in article 31.1 of Law 40/2015, of October 1, on
Legal Regime of the Public Sector (LRJSP), "Concurrence of sanctions", establishes:

       "1. Acts that have been criminal or

       administratively, in the cases in which the identity of the subject is appreciated,
       fact and foundation.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/18








And it has the task of guaranteeing the “favor libertatis”, that is, guaranteeing freedom by contributing
legal certainty to the process, through the prohibition, in our case, of the
application of an administrative sanction in those cases in which, to the same

subject, for carrying out a certain act, a criminal sanction could be imposed. EITHER
which is the same, the prohibition of the imposition of a double penal sanction-
administrative, in those cases in which there is identity of subject, fact and
basis.

Its application is subsequent to the sanction of a first event that has already been sanctioned,

worth the redundancy, in criminal proceedings. However, a problem arises when a
fact injures two different legally protected assets, in this case it is
administrative sanction together with the criminal one. Therefore, in order for you to operate this
In principle, the following elements must be present:


    - Subjective identity: in this case the affected subject always has to be the
       itself, regardless of the nature, the body that has resolved, the
       accuser or if there is concurrence or not of others affected.

    - The factual identity: this implies that the facts prosecuted must be the
       themselves.


    - Causal identity: sanctioning measures cannot apply if
       They respond to the same nature.

Well, in our case, regarding the Identity of subjects, we can verify

as in Judgment No. XX/2022 of the Juvenile Court (...) (Exp. De Reforma No.
XXX/2020.- Prosecutor's Office No. XXX/2020) dated 01/25/22, appears as the author of the facts
prosecuted, the defendant, and in this disciplinary file (PS/107/2022),
appears as responsible, the same person, so we can indicate that there is, in
In this case, identity of subjects.


Regarding the identity of the facts, if we read the Ruling of Judgment No. XX/2022 of the
Juvenile Court (...) (Reform Case No. XXX/2020.- Prosecutor's Office No. XXX/2020) of
dated 01/25/22, as a socio-educational measure is imposed on the claimant for a
crime of conditional threats, which occur when the evil with which
threat carries with it a condition, which may or may not be fulfilled and the

imposed condition may be legal or illegal and it may consist of the
claim of an amount or any other circumstance, as established in the
Article 169.1 of the Penal Code:

       "Whoever threatens another with causing him, his family or other persons with

       which is closely linked to an evil that constitutes crimes of homicide,
       injuries, abortion, against freedom, torture and against moral integrity, the
       sexual freedom, privacy, honor, heritage and socioeconomic order,
       He will be punished:


       1st With a prison sentence of one to five years, if the
       threatens by demanding an amount or imposing any other condition,
       even if it is not illegal, and the culprit has achieved his purpose. Not


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/18








       achieve it, a prison sentence of six months to three years will be imposed. but
       this must be possible (…)”,


       While the present sanctioning procedure (PS/0107/2022), begins
       for an alleged illegal treatment (without consent) of the personal data of the
       girl, minor, contemplated in article 6.1 GDPR:

       "1. Processing will only be lawful if it meets at least one of the following
       conditions:


       a) the interested party gave his consent for the processing of his data
       personal for one or more specific purposes (…);

Therefore, in this case, as we could verify, there is no identity in the

facts to which the principle of "non bis in idem" obliges, since in criminal proceedings
sanctioned a conditional threat to the underage girl and in the present
sanctioning administrative procedure is sanctioning an illegal treatment of
the girl's personal information.

Lastly, the identity of the foundation occurs when the legal right protected

for the two (or more) infractions is the same, which brings us to the contest of laws and the
crime contest. Well, in our case, the legal right protected in a crime
of conditional threats, in criminal proceedings, we could define it as the right to
freedom of formation of the will of the threatened person, while the good
legal protection in administrative proceedings would be the protection of the person in relation to

with the processing of your personal data, in this case, the images of the girl.
Fundamental right protected by article 18.4 of the Spanish Constitution.

Therefore, after analyzing the elements that concur in the principle "non bis in
idem" we can determine that, in the present case, its application is not possible, since

identity in the facts or in the grounds, as required by article 31.1
LRJSP.

       About the non-existence of the publication of images or videos

On this point we must start by remembering that recital (26) GDPR

indicates that: "The principles of data protection must be applied to the entire
information relating to an identified or identifiable natural person (…)”.

Leaving the above established, article 4 GDPR, defines, among others, the following
concepts:


       1) As "personal data": "all information about a natural person
       identified or identifiable ("the data subject"); will be considered a natural person
       identifiable any person whose identity can be determined, directly or
       indirectly, in particular by means of an identifier, such as a

       name, an identification number, location data, an identifier in
       line or one or several elements proper to the physical, physiological,
       genetic, psychological, economic, cultural or social of said person;


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/18








       2) As "data processing": any operation or set of operations
       performed on personal data or sets of personal data, either by
       automated procedures or not, such as the collection, registration, organization,

       structuring, conservation, adaptation or modification, extraction, consultation,
       use, communication by transmission, diffusion or any other form of
       authorization of access, comparison or interconnection, limitation, deletion or
       destruction; (…)

       7) As "data controller": any natural or legal person,

       authority, service or other body which, alone or jointly with others, determines the
       purposes and means of processing (…)

       While in article 1 of the GDPR, it is established that:


       1. This Regulation establishes the rules relating to the protection of
       natural persons with regard to the processing of personal data and the
       rules relating to the free movement of such data.

       And article 2 GDPR:


       1. This Regulation applies to the processing in whole or in part
       automated processing of personal data, as well as the non-automated processing of
       personal data contained or intended to be included in a file.

Therefore, at no time is it established that, in order for the GDPR to be applied

it is necessary that the person responsible for the processing of personal data has
assigned to a third party.

For the GDPR to be fully applicable, it is therefore necessary that the
processing of personal data carried out by the person responsible for them, be it

Apart from communication by transmission, broadcast or any other form of
authorization of access, collation or interconnection, any other operation or set of
operations carried out on them, be it the collection, registration,
organization, their structuring, their conservation, their adaptation or
modification, its extraction, its consultation, its use, or its limitation, deletion or
destruction.


Therefore, in the case at hand, the mere collection, registration and conservation of
the images of the girl, a minor, made by the defendant (responsible for the
treatment) are sufficient cause for the application of the GDPR.


       On the consent of the minor and the illegitimate use by the
       social media minor,

Reference is made at this point to Royal Decree 1720/2001, of December 27, by
which approves the Regulations for the development of Organic Law 15/1999, of 13 December

December, protection of personal data.

Well then, as can be seen from the claim, the communications and the sending of
images of the girl, begin between both minors on 10/15/19 at 11:20 p.m.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/18








Instagram and WhatsApp. However, the last ones that are conserved made by
this last means are from 01/02/20.


According to article 99 of the GDPR, the entry into force and application of the new GDPR was,
“twenty days after its publication in the Official Journal of the European Union, the
05/25/16”, being mandatory as of May 25, 2018”. By
Therefore, as of this date (05/25/18), Organic Law 15/1999 was repealed,
(LOPD), applying mandatorily, from that date, the current RGPD.


Regarding Organic Law 3/2018, of December 5, on Data Protection
Personal Rights and Guarantee of Digital Rights (LOPDGDD), published on 12/06/18
It is indicated, upon its entry into force, in its sixteenth final provision that: "The
This organic law will enter into force the day after its publication in the
Official State Gazette" so from 12/07/18 it is mandatory.


For its part, the sole repeal provision of the LOPDGDD establishes:

       1. Without prejudice to the provisions of the fourteenth additional provision and the
       fourth transitory provision, the Organic Law 15/1999, of 13
       December, Protection of Personal Data.


       2. Royal Decree-Law 5/2018, of July 27, on measures
       urgent for the adaptation of Spanish Law to the regulations of the Union
       European Union on data protection.


       3. Likewise, any provisions of equal or lower rank are repealed
       contradict, oppose, or are incompatible with the provisions of the
       Regulation (EU) 2016/679 and in this organic law.

Therefore, in accordance with section 3 of the Sole Repealing Provision, the Royal Decree

1720/2007 was repealed as of 12/07/18 in those provisions that
"contradict, oppose, or are incompatible with the provisions of the Regulation
(UE) 2016/679 and in the LOPDGDD."

In the present case, for the processing of personal data to be carried out
legally, these must be processed with the consent of the interested party or on

some other legitimate basis established in accordance with Law, (Considering 40 GDPR),
Article 6.1 of the GDPR is therefore applicable and not RD 1720/2007
used by the defendant.

Thus, the aforementioned article 6.1 GDPR establishes that the processing of data

Personal information will only be lawful if it meets at least one of the following conditions:

       a) the interested party gave his consent for the processing of his data
       personal for one or more specific purposes;


       b) the processing is necessary for the performance of a contract in which the
       interested party or for the application at the request of this of measures
       pre-contractual;


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/18








       c) the processing is necessary for compliance with a legal obligation
       applicable to the data controller;


       d) the processing is necessary to protect vital interests of the data subject or
       of another natural person.

       e) the treatment is necessary for the fulfillment of a mission carried out in
       public interest or in the exercise of public powers conferred on the person responsible
       of the treatment;


       f) the processing is necessary for the satisfaction of legitimate interests
       pursued by the data controller or by a third party, provided that
       such interests are not overridden by the interests or the rights and freedoms
       of the interested party that require the protection of personal data,

       in particular when the interested party is a child. The provisions of letter f) of the
       first paragraph shall not apply to the treatment carried out by the
       authorities in the exercise of their functions.

But, what's more, since the interested party is a minor, as is the case in our case,
We must bear in mind the provisions of art. 7 LOPDGDD:


       "1. The processing of personal data of a minor only
       may be based on your consent when you are over fourteen years of age. I know
       Except for those cases in which the law requires the attendance of the holders of the
       parental authority or guardianship for the celebration of the legal act or business in which

       context the consent for the treatment is obtained.

       2. The treatment of the data of minors under fourteen years of age, based on the
       consent, it will only be lawful if that of the holder of parental authority or
       guardianship, with the scope determined by the holders of parental authority or

       guardianship." The minors whose data has been processed by the defendant are
       perfectly identifiable and that their identity can be determined, directly or
       indirectly.

Therefore, Articles 2, 13 and 14 of the Articles cannot be considered in the present case.
Royal Decree 1720/2001, of December 27, which approves the Regulation of

development of Organic Law 15/1999, of December 13, alleged by the party
claimed by being repealed by this LOPDGDD, and being applicable in this
case, articles 6 and 7 of the GDPR.

On the illegitimate use by the minor of social networks and

breach of parental obligations, it should be noted that, in the present
procedure is not assessing the degree of compliance of social networks
(WhatsApp or Instagram), in the parental control of the same. In this procedure
the degree of legality that has occurred in the treatment of the data has been assessed
of the girl, a minor, by the defendant.


       Regarding the scope of the psychological or moral damage suffered by the minor



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 15/18








On this point, just indicate that this Agency is not competent to assess
the degree of psychological or moral damage suffered by the people they have treated
your personal data without your consent.


       On the practice of proposed tests:
It is considered that the information and documentation provided to the procedure is sufficient

cient to be able to elucidate whether or not there is an infringement of the current regulations on
of data protection and this has been demonstrated throughout this proposal for
resolution, based on Judgment No. XX/02020 of the Juvenile Court (...).- Ex-
Reform request number XXX/2020 (Prosecutor's Office number XXX/2020), in the "Facts
Proven", in its "Fundamentals of Law" and in the "Failure" issued. This is so because-

that this administrative sanctioning procedure is initiated after having carried out
The AEPD has carried out intense previous work, which substitutes sufficient evidence for this instruction.
tion.

In this case, the information provided by the parties is assumed to be true. Nope
However, the foregoing, the already mentioned so many times, Article 24.2 of the EC, applicable
Also in this case, it recognizes the right of the claimed entity “to use all
the pertinent means of proof for his defense", leaving at his discretion to be able to present
take as many means of proof as it deems pertinent throughout the procedure.

Therefore, the testimonial evidence requested by the claimed party is considered to be
are not necessary in this case, in application of the principle of "procedural economy" to the

the attributable facts must already be sufficiently accredited, and, therefore, it must be re-
reject the request for the practice of evidence as unnecessary at this time, by
under the provisions of article 77.3 of the LPACAP.

                                           III.-
    Violation for the illegal treatment of the personal data of the minor.


In this case, according to the information and documentation presented in the
claim, the defendant, browsing the Instagram application, met the minor
of age (Claimant's daughter) aged 13 engaging in such a close relationship with her
confidence that the minor sent her videos and photos of an intimate nature, both by

the Instagram application as by WhatsApp.

After some time, the defendant demanded that the girl continue sending him photos and
videos, but since she refused, the defendant intimidated her by telling her that he would upload the
photos and videos that he already had on social networks, in the face of whose threats, the minor

Shipping (…).

As we have explained in the previous section, for data processing
personal information can be carried out lawfully, they must be treated with the
consent of the interested party or on some other legitimate basis established in accordance
a Law, (Recital 40 GDPR)


For its part, article 6.1 of the GDPR establishes that processing will only be lawful if
meets at least one of the following conditions:

       a) the interested party gave his consent for the processing of his data

       personal for one or more specific purposes;
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 16/18









       b) the processing is necessary for the performance of a contract in which the
       interested party or for the application at the request of this of measures

       pre-contractual;

       c) the processing is necessary for compliance with a legal obligation
       applicable to the data controller;

       d) the processing is necessary to protect vital interests of the data subject or

       of another physical person.

       e) the treatment is necessary for the fulfillment of a mission carried out in
       public interest or in the exercise of public powers conferred on the person responsible
       of the treatment;


       f) the processing is necessary for the satisfaction of legitimate interests
       pursued by the data controller or by a third party, provided that
       such interests are not overridden by the interests or the rights and freedoms
       of the interested party that require the protection of personal data,
       in particular when the interested party is a child. The provisions of letter f) of the

       first paragraph shall not apply to the treatment carried out by the
       authorities in the exercise of their functions.

But, what's more, since the interested party is a minor, as is the case in our case,
We must bear in mind the provisions of art. 7 LOPDGDD:


       "1. The processing of personal data of a minor only
       may be based on your consent when you are over fourteen years of age. I know
       Except for those cases in which the law requires the attendance of the holders of the
       parental authority or guardianship for the celebration of the legal act or business in which

       context the consent for the treatment is obtained.

       2. The treatment of the data of minors under fourteen years of age, based on the
       consent, it will only be lawful if that of the holder of parental authority or
       guardianship, with the scope determined by the holders of parental authority or
       guardianship." The minors whose data has been processed by the defendant are

       perfectly identifiable and that their identity can be determined, directly or
       indirectly.

Therefore, according to the available evidence, it is considered that
the facts exposed do not comply with the provisions of articles 6.1 of the GDPR, by

unlawful processing of the personal data of the minor girl.

It is considered appropriate to apply the following aggravating criteria established by the
Article 83.2 of the GDPR:


       a).- The scope or purpose of the data processing operation and the level of
       the damages and losses caused, since it has been confirmed through
       final court ruling that the defendant required the girl to follow him
       sending photos and videos, but since she refused, the defendant intimidated her

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 17/18








       telling him that he would upload the photos and videos that he already had to social networks and that
       the minor, fearful of her threats, sent (...) to the
       reclaimed. (section a).


       b).- The intent of the offense, by the defendant, by intimidating
       to the girl telling her that she would upload the photos and videos that she already had to the networks
       achieving with it (...) of the girl. (section b).

It is also considered that the following aggravating criteria should be applied, which

Article 76.2 of the LOPDGDD establishes:

       a).- The affectation of the rights of minors, since the victim is a girl
       minor at the time of the facts (section f).


Notwithstanding the foregoing, in the present case, it is worth considering what is stipulated in the
Article 83.1 of the GDPR which establishes that: "Each control authority
ensure that the imposition of administrative fines under this
article for the infringements of this Regulation indicated in sections 4, 5 and
6 are in each individual case effective, proportionate and dissuasive”.


Therefore, taking into account the principle of proportionality and the individualization of the
sanction chosen in such a way that it represents an adequate response to illegality
of the fact and the guilt of the author, in the present case, it is considered reasonable
attend to what was stated by the defendant when he alleges that, in court, the
processing of personal data of the minor girl had ceased to exist

for having deleted the videos from his mobile.

Pursuant to the foregoing, the Director of the Spanish Agency for
Data Protection,
                                     RESOLVES:


FIRST: IMPOSE D.A.A.A., a penalty of 5,000 euros (five thousand euros) for
the violation of article 6.1 of the GDPR, regarding the illegal processing of the
images of the girl, minor.

SECOND: ORDER D. A.A.A., the elimination of any personal data from the

girl that is in their power, as well as inform this Agency about the measures
adopted for it.

THIRD: NOTIFY this resolution to D. A.A.A.


FOURTH: Warn the penalized party that the sanction imposed must be made effective by
Once this resolution is enforceable, in accordance with the provisions of Article
Article 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, within the voluntary payment period indicated in the
Article 68 of the General Collection Regulations, approved by Royal Decree

939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17
December, by depositing it in the restricted account No. ES00 0000 0000 0000
0000 0000, opened in the name of the Spanish Data Protection Agency in the


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 18/18








Banco CAIXABANK, S.A. or otherwise, it will proceed to its collection in
executive period.


Once the notification has been received and once executed, if the execution date is
between the 1st and 15th of each month, both inclusive, the term to make the payment
voluntary will be until the 20th day of the following or immediately following business month, and if
between the 16th and the last day of each month, both inclusive, the payment term
It will be until the 5th of the second following or immediately following business month.


In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once the interested parties have been notified.

Against this resolution, which puts an end to the administrative process (article 48.6 of the
LOPDGDD), and in accordance with the provisions of articles 112 and 123 of the Law

39/2015, of October 1, of the Common Administrative Procedure of the
Public Administrations, interested parties may optionally file
appeal for reversal before the Director of the Spanish Agency for Data Protection
within a month from the day following notification of this
resolution or directly contentious-administrative appeal before the Chamber of
contentious-administrative of the National Court, in accordance with the provisions of the

article 25 and in section 5 of the fourth additional provision of Law 29/1998, of
July 13, regulating the Contentious-administrative Jurisdiction, within the period of
two months from the day following the notification of this act, according to what
provided for in article 46.1 of the aforementioned legal text.


Finally, it is noted that in accordance with the provisions of art. 90.3 a) of Law 39/2015,
of October 1, of the Common Administrative Procedure of the Administrations
Public, the firm resolution may be temporarily suspended in administrative proceedings if
The interested party declares his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through

writing addressed to the Spanish Data Protection Agency, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
web/], or through any of the other registries provided for in art. 16.4 of the
aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the
documentation proving the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal

contentious-administrative proceedings within a period of two months from the day following the
Notification of this resolution would terminate the precautionary suspension.

Mar Spain Marti
Director of the Spanish Data Protection Agency.












C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es