AEPD (Spain) - PS/00278/2020

AEPD - PS-00278/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(a) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	13.11.2020
Published:	27.11.2020
Fine:	1200 EUR
Parties:	n/a
National Case Number/Name:	PS-00278/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish DPA (AEPD) imposed a fine of €1200 on the defendant for illicit use of personal data in violation of Article 5(1)(a) GDPR.

English Summary

Facts

The defendant has impersonated the claimant in the social network Tinder, using the claimant's pictures to create a profile. The images of the claimant have been taken from the claimant's social networks profiles without his permission. The defendant also used the same pictures to impersonate the claimant on WhatsApp.

Dispute

Is impersonating someone else on social media, through the unauthorized appropriation of personal images, in violation of Article 5(1)(a) GDPR?

Holding

The Spanish DPA (AEPD) found that the defendant's conduct violated Article 5(1)(a) GDPR, as a broader principle to which Article 6(1) GDPR is linked, and imposed a fine of €2000 relying on Article 58(2) GDPR.

The defendant ultimately paid €1200 for the breach, by applying two reductions offered under Spanish law, for the voluntary payment of the fine and for recognising their responsibility in the breach.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                              1/13








     Procedure Nº: PS / 00278/2020


RESOLUTION R / 00565/2020 OF TERMINATION OF THE PROCEDURE FOR PAYMENT
                                   VOLUNTARY

In the sanctioning procedure PS / 00278/2020, instructed by the Spanish Agency for

Data Protection to A.A.A., considering the complaint presented by B.B.B., and based on
the following,

                                  BACKGROUND


FIRST: On October 19, 2020, the Director of the Spanish Agency for
Data Protection agreed to initiate sanctioning proceedings against A.A.A. (onwards,
the claimed), through the Agreement that is transcribed:


<<





Procedure Nº: PS / 00278/2020

935-200320



              AGREEMENT TO INITIATE THE SANCTIONING PROCEDURE




       Of the actions carried out by the Spanish Agency for Data Protection and in
based on the following




                                         ACTS




FIRST: B.B.B. (hereinafter, the claimant) on 12/20/2019 filed a claim
before the Spanish Agency for Data Protection. The claim is against A.A.A.

with NIF *** NIF.1 (hereinafter, the claimed one). The reasons on which you base the claim are:



- On 10/26/2019, a person (C.C.C.) contacted through the social network

INSTAGRAM, informing him by message that a third party has impersonated him, with the
name D.D.D. in the social network TINDER, using their photos to create a profile on the network
social TINDER, and that by communicating with her "he had used her photos as" profile photos

WhatsApp with the phone number *** TELEPHONE.1. "

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/13








       In the message, C.C.C. he tells her that he "tried to flirt with her", and "sent her through
WhatsApp several photos of me claiming that it was the "" photos stolen from the social network

INSTAGRAM, from FACEBOOK ", and" three photos in particular that I don't know where he got them from,
since they are photos that I have not had in any social network, even two of them that
they belong to me but I do appear ”.




       It indicates that, later, to collect more information «I decide to use a profile
my truth in the social network TINDER as B.B.B. putting November 17 in my

description, that I am looking for information about my photos since they have been stolen ”, and
that “Several girls contact me through said network and pass me information to
through WhatsApp as well as photos shared by the individual, and sexual conversations

with such women. In these conversations they alter photos of me with half-naked photos of
other people that I don't know where you got them from. This appears done from the

WhatsApp line phone number *** PHONE. 1. "



- It states that “The defendant is supposedly the owner of the line *** TELEPHONE.1 that
"After an anonymous call, it is allegedly the person claimed" whom he identifies as

name and surname, and that on 11/27/2019 he filed a complaint at the Police Station
Nacional de las Palmas de Gran Canaria, attestation number XXXXX / 19, does not provide a copy

Of the same.



       Along with the claim, it provides:




1) (folios 7 to 36/141 "conversation denounced with E.E.E.")

Includes WhatsApp screen impressions, only the date is seen in the first
08/20/2019 screen and another at 11:22 p.m.


       At the top is the line *** TELEPHONE. 1, parts of the conversation
indicated, it would be that the conversation is started by the girl with "Hello D.D.D.", and answer. In
the E.E.E. mentions the location of *** LOCALIDAD.2, and How is it that I

puts the app that you are 4 km away ?, the girl indicates that she is a teacher and the "I am also a teacher" /
Didn't you say you were a pilot ?, teacher of what, / answering flight instructor in test and
combat-In addition to military controller-I have several positions, the girl says that “I am in

*** LOCALIDAD.2 -I will return to *** LOCALIDAD.3 tonight, ”indicating D.D.D. "You are going to
*** LOCALIDAD.4 ?, responding “No because in September I will

*** LOCALITY. 5 "

       E.E.E .: You stay here until Sep

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/13








        D.D.D .: no, I'm staying in *** LOCALIDAD.1

        E.E.E .: but are you the one in the photo?


        E.E.E. (23 23) Everything seems strange to me. And you don't inspire me with confidence. The app continues
giving me at 6 km you will tell me I do not know who you are if you have a partner or I do not know.

        E.E.E. 23 30 There is nothing to show that you are where you say you are, or that you are the

Of the photos .



        Photographs, the first one where you see a person with a beard, helmet on his head

with the caption of the photo that appears in all those contributed by E.E.E., “D.D.D .. Pilot of the
Air forces. At 4Km away ”In the rest of the photos you can see your image clearly

being clearly recognizable, thus, figure one in the case of an individual dressed in a suit
green, military with a background image of a hangar with an airplane (photo H hereinafter),
three different ones, up close inside a vehicle dressed for the street, and one appears in

a jet ski “shares the profile of D.D.D. Touch to send it to your friends ”,
being able to see the image of the photo H.




- It is followed as attached documentation (folios 37/141 to 48/141, which is called the
claimant in the claim document “Profile E.E.E. and my conversation ”or“ E.E.E.

compressed ”in the input pdf record, appearing in it as highlighted:



        On folio 36/141 there is a photo of “E.E.E. Professor at Junta de Galicia and in the part

top, the URL printing of two web address references, one in TINDER, one in
facebook.com E.E.E.




        -E.E.E .: “all this sounds strange / answer: Yes it is, if you can help me
appreciate)."




        -E.E.E. : I still have the conversation and the phone number



        -E.E.E.-Can you prove that you are B.B.B. , answer Well look for B.B.B. that I am

I.




C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/13








       E.E.E .: Are you a flight instructor? Answer: “It was, Now I work in Iberia. I know that
the very unfortunate has a phone number with my photo. "


       E.E.E., a question, ... they don't have his profile on Tinder anymore, right? Answer, no
no this. You can tell TINDER that you had a conversation with me between 21 and 22/08




       E.E.E .: The conversation seemed false to me and I deleted it.



       On folio 55/141 the claimant shows the DNI in an image, in the conversation

that he maintains with E.E.E., although the data is not clearly seen, if the photo, being able
correspond to the same as those of the pilot.




       1) Conversation of the accused (…) through copies of impressions of
WhatsApp screens dated 08/27/2019.




       Photo H is seen at the top, the name with which it appears is D.D.D., which
initiates the conversation, stating D.D.D. who was in the village, had dinner with old men

friends. Indicates the girl who was in the carnivals of *** LOCALIDAD.6, and D.D.D. what
when he was a teenager there was no such thing as that, then at the age of 18 he moved to
*** LOCALIDAD.7, the girl asks, then don't you live around here?

*** LOCALIDAD.1 and I'm here on vacation ”I have the base in *** LOCALIDAD.4” ”but
now I'm going to stay for a month at the *** LOCALIDAD.5 seaplane base ”,

"I will continue to live in *** LOCALIDAD.1", just one month.



       The conversation continues on another day, but does not put the date, it is indicated “we did not return to

talking since summer I thought we would continue talking about our things "and he asks
are you in *** LOCALIDAD.5? and he answers that he is in *** LOCALIDAD.2 for a matter of
heritage. The girl asks that I send her a photo, and after sending one in which she sees a

male torso, attached another where you see and recognize three people next to an airplane,
around 10:22 p.m., the pilot in the center may be the pilot. Later, D.D.D. he says no

send photos of body with face ”.



       3) Profile C.C.C. and my conversation (folio 89/141) with the following conversation

providing screen printing, date 10/26:



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/13








       - "Hello, sorry I'm writing to you without knowing you but there was a person doing it.

stop by you in TINDER. Use your photographs, as for some reason I did not trust I have done
an image search and that's why I found you. I have already reported the profile of this
person, he has not provided me with any social network but he has provided a few photographs that now

I see in your profile. " . Attach photos with the military outfit in the background of a hangar with an airplane.




       -The answer is and where is it if you can find out?



       -I live in *** LOCALIDAD.3 this boy tells me that he lives near *** LOCALIDAD.2

when he is here on vacation and usually lives in *** LOCALIDAD. 4 but of course
I see that it is all ball.

       -Can you send me a conversation please if it's not too inconvenient?




       -I deleted it from TINDER. But I have more photos of your profile waiting. Send you

various photographs, almost all coincide with those of point 1.

       -And any other information?

       -I have your mobile number


       -It has a lot of photos from long ago from Instagram that I already removed, so take
long time.




       -In the last photo you have your phone WhatsApp photos and everything. I believe that it does not live
where it said for the location, surely you live in the area of *** LOCALIDAD. 8, very close
of *** LOCALIDAD.3, that's why the truth was a bit fly.







SECOND: On 01/20/2020, the CNMC registry is consulted reflects that the
Current operator of line *** TELEPHONE.1 is XFERA.




THIRD: The claim is admitted for processing on 02/04/2020.





C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/13








FOURTH: Within the previous inspection actions E / 01242/2020, the

following events:



1) To the operator, XFERA MÓVILES, S.A. that is assigned the number

*** TELEPHONE. 1, the data of its owner is requested.



        On 06/22/2020 a response was received informing:




            “The telephone number *** TELEFONO.1 in prepaid mode, was activated with

            date 07/02/2019 by:

        F.F.F. " indicating your NIF.

        "This card was activated with an initial credit of 5 euros, of which no

        use, since the line does not register consumption. This line did not have recharges.

        Due to the lack of use, in October 2019 a text message was sent informing
        of the suspension of the service due to inactivity, finally blocking the numbering

        dated 11/18/2019. "




1) The State Tax Administration Agency is requested to provide the tax address of the
claimed, and dated 07/06/2020, a response was received, joining the procedure.






                               FOUNDATIONS OF LAW




                                                 I



        By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of

control, and as established in articles 47 and 48 of the LOPDGDD, the Director of the
Spanish Data Protection Agency is competent to initiate and resolve this

process.




C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/13








                                                 II




        Presumably, the defendant creates a profile, adding images that are not his own.
ownership, exposes them and is made known to the users of the network in which they are shared,

this image is also appreciated in WhatsApp conversations, so it is
They would be treating the personal data of the owner, claimant, by the claimed party.




        The legal bases of data processing detailed in article 6.1 RGPD
are related to the broader principle of legality of article 5.1.a) of the RGPD, which
concept that provides that personal data will be treated in a “lawful, loyal and transparent manner.
rent in relation to the interested party ”.

        The facts revealed in the claim could imply on the part of the
claimed the alleged infringement of the aforementioned article 5.1.a) of the RGPD.





                                                 III
        Article 58 of the RGPD indicates:


"2. Each supervisory authority shall have all the following corrective powers indicated-
two below:


  i) impose an administrative fine in accordance with article 83, in addition to or instead of the
measures mentioned in this section, according to the circumstances of each case
particular;"


        Article 83.5 of the RGPD indicates:

  5. Violations of the following provisions will be sanctioned, in accordance with the
paragraph 2, with administrative fines of a maximum of EUR 20,000,000 or, in the case of

a company, of an amount equivalent to a maximum of 4% of the total turnover
annual global of the previous financial year, opting for the highest amount:


  a) the basic principles for the treatment, including the conditions for the
consent in accordance with articles 5, 6, 7 and 9; "

        Regarding the amount of the administrative fine that would be imposed,

The provisions of articles 83.1 and 83.2 of the RGPD must be followed, precepts that
point out:

        "Each supervisory authority will guarantee that the imposition of fines
administrative regulations pursuant to this article for infractions of this Regulation



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/13








indicated in sections 4, 5 and 6 are in each individual case effective, proportionate and
deterrents. "

        "Administrative fines will be imposed, depending on the circumstances of each

individual case, as an additional or substitute for the measures referred to in article 58,
section 2, letters a) to h) and j). When deciding the imposition of an administrative fine and its
amount in each individual case will be duly taken into account:

        a) the nature, severity and duration of the offense, taking into account the

nature, scope or purpose of the processing operation in question as well as the
number of interested parties affected and the level of damages they have suffered;

        b) intentionality or negligence in the infringement;

        c) any measure taken by the controller or processor to
mitigate the damages suffered by the interested parties;

        d) the degree of responsibility of the controller or processor,
taking into account the technical or organizational measures that have been applied by virtue of the

articles 25 and 32;

        e) any previous infringement committed by the person in charge or the person in charge of the
treatment;

        f) the degree of cooperation with the supervisory authority in order to remedy
the violation and mitigate the possible adverse effects of the violation;

        g) the categories of personal data affected by the infringement;

        h) the way in which the supervisory authority learned of the infringement, in
particular if the person in charge or the person in charge notified the infringement and, if so, in what
measure;

        i) when the measures indicated in article 58, paragraph 2, have been ordered
previously against the person in charge or the person in charge in relation to the same
subject, compliance with said measures;

        j) adherence to codes of conduct under article 40 or to mechanisms of
certification approved in accordance with Article 42, and

        k) any other aggravating or mitigating factor applicable to the circumstances of the case,
such as financial benefits obtained or losses avoided, directly or indirectly,
through the offense. "

        In relation to section k) of article 83.2 of the RGPD, the LOPDGDD, article 76,
"Sanctions and corrective measures", provides:

        "2. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679
The following may also be taken into account:

        a) The continuing nature of the offense.

        b) The linking of the offender's activity with the performance of treatment of
personal information.

        c) The benefits obtained as a result of the commission of the offense.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/13








       d) The possibility that the affected person's conduct could have led to the commission of
sion of the offense.

       e) The existence of a process of merger by absorption after the commission of the
infringement, which cannot be attributed to the absorbing entity.

       f) Affecting the rights of minors.

       g) Have, when not mandatory, a data protection officer.

       h) The submission by the person in charge or in charge, on a voluntary basis, to
alternative conflict resolution mechanisms, in those cases in which there are
such controversies between those and any interested party. "

       The alleged infringement of the RGPD for which the complainant is held responsible must
to consider:

       The deliberate attitude in picking up the image of which it is not the owner, which is used with
some deception purposes, supposes that an administrative sanction has to be resorted to, and the use of

the data on at least two occasions and the context of use to interact with other people
You are making the claimant's image as your own 83.2.a) RGPD.

       -The patent intention in such use, 83.2.b) RGPD.



               Without prejudice to what results from the instruction of this procedure,
       quantifies the amount of the alleged infringement at 2,000 euros.



               Therefore, based on the foregoing,




               By the Director of the Spanish Agency for Data Protection,




       HE REMEMBERS:



FIRST: INITIATE SANCTIONING PROCEDURE against A.A.A., with NIF *** NIF.1, by the

alleged infringement of article 5.1.a) of the RGPD, in accordance with article 83.5.a) of the
RGPD.




SECOND: APPOINT R.R.R. and, as secretary to S.S.S., indicating that
any of them may be challenged, where appropriate, in accordance with the provisions of the
Articles 23 and 24 of Law 40/2015, of 1/10, on the Legal Regime of the Public Sector

(LRJSP).


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/13










THIRD: INCORPORATE to the sanctioning file, for evidentiary purposes, the claim

filed by the claimant and his documentation, the documents obtained and generated
by the General Sub-Directorate of Data Inspection during the investigation phase, as well as

as the report of previous Inspection actions.



FOURTH: THAT for the purposes provided for in art. 64.2 b) of Law 39/2015, of 1/10, of the
Common Administrative Procedure of Public Administrations, (hereinafter,

LPACAP), the corresponding sanction would be an administrative fine of 2,000
euros.




FIFTH: NOTIFY this agreement to A.A.A., with NIF *** NIF.1, giving it a deadline
of hearing of ten business days to formulate the allegations and present the evidence

that you consider convenient. In your statement of allegations you must provide your NIF and the
procedure number at the top of this document.




       If within the stipulated period it does not make allegations to this initiation agreement, the same
It may be considered a resolution proposal, as established in article 64.2.f) of
the LPACAP.




       In accordance with the provisions of article 85 of the LPACAP, in the event that the
penalty to be imposed would be a fine, you may recognize your responsibility within the term

granted for the formulation of allegations to this initiation agreement; what it will take
coupled with a reduction of 20% of the penalty to be imposed in the present

process. With the application of this reduction, the sanction would be established in
1,600 euros, resolving the procedure with the imposition of this penalty.




       In the same way, you may, at any time prior to the resolution of this
procedure, carry out the voluntary payment of the proposed penalty, which will entail the
reduction of 20% of its amount. With the application of this reduction, the sanction

it would be set at 1,600 euros and its payment will imply the termination of the procedure.



       The reduction for the voluntary payment of the penalty is cumulative to that

corresponds to apply for the recognition of responsibility, provided that this
acknowledgment of responsibility is made manifest within the period granted

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/13








to formulate allegations at the opening of the procedure. Voluntary payment of the amount
referred to in the preceding paragraph may be done at any time prior to the resolution.

In this case, if both reductions should be applied, the amount of the penalty would be
set at 1,200 euros.




       In any case, the effectiveness of either of the two mentioned reductions
It will be conditioned to the withdrawal or resignation of any action or remedy in progress.

administrative against the sanction.



In case you choose to proceed to the voluntary payment of any of the amounts

indicated above 1,600 euros or 1,200 euros, you must make it effective through your
deposit in account number ES00 0000 0000 0000 0000 0000 opened in the name of the Agency
Spanish Data Protection in the banking entity CAIXABANK, S.A., indicating in the

concept the reference number of the procedure that appears in the heading of
this document and the cause for the reduction of the amount to which it applies.




       Likewise, you must send proof of admission to the Subdirectorate General of
Inspection to continue with the procedure in accordance with the amount entered.




       The procedure will have a maximum duration of nine months from the date of
date of the initiation agreement or, where appropriate, the draft initiation agreement. Elapsed

that period will expire and, consequently, the file of actions; from
in accordance with the provisions of article 64 of the LOPDGDD.




       Finally, it is pointed out that in accordance with the provisions of article 112.1 of the
LPACAP, against this act there is no administrative appeal.




Mar Spain Martí

Director of the Spanish Agency for Data Protection




>>

SECOND: On November 3, 2020, the defendant has proceeded to pay
the sanction in the amount of 1200 euros making use of the two planned reductions

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/13








in the Initiation Agreement transcribed above, which implies the recognition of the
responsibility.


THIRD: The payment made, within the period granted to formulate allegations to
the opening of the procedure, entails the waiver of any action or appeal in the process
administrative against the sanction and the recognition of responsibility in relation to
the facts to which the Initiation Agreement refers.

                            FOUNDATIONS OF LAW


                                             I

By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in art. 47 of Organic Law 3/2018, of 5

December, Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection
is competent to sanction the infractions that are committed against said
Regulation; infractions of article 48 of Law 9/2014, of May 9, General
of Telecommunications (hereinafter LGT), in accordance with the provisions of the
article 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and

38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of the
information and electronic commerce (hereinafter LSSI), as provided in article
43.1 of said Law.

                                             II


Article 85 of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter, LPACAP), under the rubric
"Termination of sanctioning procedures" provides the following:
"1. Initiated a sanctioning procedure, if the offender acknowledges his responsibility,

the procedure may be resolved with the imposition of the appropriate sanction.

2. When the sanction is solely of a pecuniary nature or it is possible to impose a
pecuniary sanction and other non-pecuniary sanction, but the
inadmissibility of the second, the voluntary payment by the presumed responsible, in
any time prior to the resolution, will imply the termination of the procedure,

except in relation to the replacement of the altered situation or the determination of the
compensation for damages caused by the commission of the offense.

3. In both cases, when the sanction is solely of a pecuniary nature, the
competent body to resolve the procedure will apply reductions of, at least,

20% of the amount of the proposed penalty, these being cumulative among themselves.
The aforementioned reductions must be determined in the notice of initiation
of the procedure and its effectiveness will be conditioned to the withdrawal or resignation of
any action or appeal in administrative proceedings against the sanction.


The percentage of reduction foreseen in this section may be increased
regulations.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/13









In accordance with the above, the Director of the Spanish Agency for the Protection of
Data RESOLVES:

FIRST: DECLARE the termination of procedure PS / 00278/2020, of

in accordance with the provisions of article 85 of the LPACAP.

SECOND: NOTIFY this resolution to A.A.A. ..


In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure as prescribed by

the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, interested parties may file an appeal
administrative litigation before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of

the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-Administrative Jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.



                                                                                   936-031219
Mar Spain Martí
Director of the Spanish Agency for Data Protection

































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es