AEPD (Spain) - PS/00209/2021

AEPD (Spain) - PS/00209/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR Article 83(2)(b) GDPR Article 83(2)(g) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	09.08.2021
Fine:	5000 EUR
Parties:	CLUB GIMNASIA RÍTMICA SAN ANTONIO
National Case Number/Name:	PS/00209/2021
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish DPA fined a gymnastics club €5,000 for posting images of two children on its Instagram page, despite the express denial of consent by their mother.

English Summary

Facts

A rhythmic gymnastics club held an Instagram page called "RITMICASANANTONIO", in which images of children performing exercises were published. The mother of two minors had several times asked the club not to publish images of her daughters on the social networks and she has also made clear that she does not give the club the authorization to photograph and record her daughters, aged 10 and 12.

The club continued its conduct and posted another video in which the two girls appeared.

The mother then filed a complaint with the Spanish DPA (AEPD) in this regard.

Holding

The Spanish DPA deemed that the club had violated Article 6(1) GDPR, since it had published images of the complainant's daughters on Instagram, without having any legitimacy to do so. The club could not prove that it had the right to process the data of the complainant's minor daughters, since they did not have the mother's consent.

The Spanish DPA considered that the sanction to be imposed should be aggravated in accordance with the criteria established in Article 83(2)(b) GDPR: negligent character of the infringement, and Article 83(2)(g) GDPR: categories of personal data affected, in this case images of minors.

For these reasons, the AEPD fined the rhythmic gymnastics club €5,000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                 1/6








     Procedure No.: PS / 00209/2021

                RESOLUTION OF SANCTIONING PROCEDURE


Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following:

                                   BACKGROUND


FIRST: Mrs. A.A.A. (hereinafter, the claimant) dated February 7, 2021
filed a claim with the Spanish Data Protection Agency. The
claim is directed against CLUB GIMNASIA RÍTMICA SAN ANTONIO with NIF
G57922429 (hereinafter, the claimed one).


       The claimant, mother of two girls, aged 10 and 12, who do gymnastics
rhythm in the club against which the claim is directed states that on February 5
of 2021 asked the club to remove from their social networks all photos and videos in
those whose daughters appeared. He adds that he has no record of having given his
authorization, which was only given to the Federation, and in relation to competitions in

the girls to participate. And that, in any case, from that moment denied
expressly your permission to take pictures of the girls and to publish them in
Internet.

       It also points out that at dawn on February 6, the club published

a new video in which his daughters appear, having asked Instagram the
removal of your images.

       And, among other things, it provides the following documentation:

     Complaint dated February 7, 2021, before the offices of the Guard

        Civil of the P. Sant Antoni de Portmany Post (Illes Balears).
     Photo of the complaint before the social network Instagram.
     Annex 1 of the federative license of 2021, where the authorizations appear

        given by the claimant.

SECOND: In accordance with the provisions of article 65.4 of the LOPGDD, which
has provided a mechanism prior to the admission for processing of claims that are
formulated before the AEPD, consisting of transferring them to the Protection Delegates of
Data designated by those responsible or in charge of the treatment, for the purposes

provided for in article 37 of the aforementioned norm, or to these when there are no
designated, the claim was transferred to the claimed entity within the framework of the
File E / 01193/2021, so that it could proceed with its analysis and respond to the
complaining party and this Agency within one month.


THIRD: On February 9 and 22, 2021, the claimed person was requested through the
electronic notifications and postal mail service, which will provide this Agency
the next information:

       1. The decision taken regarding this claim.

       2. In the event of exercising the rights regulated in articles 15 to
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/6








           22 of the RGPD, accreditation of the response provided to the claimant.
       3. Report on the causes that have motivated the incident that has originated
           the claim.

       4. Report on the measures adopted to prevent the occurrence of
           similar incidents, implementation dates and controls carried out to
           check its effectiveness.
       5. Any other that you consider relevant.

       It is clear that the first of them was returned on February 20, 2021 for having

the delivery period had expired and the second was delivered to the requested by the service
Postcard on March 3, 2021.

       Once the period granted to the claimed person has elapsed without having responded to the
request for information, in accordance with the provisions of article 65.2 of the

LOPDGDD, the admission for processing agreement is signed on May 4, 2021
of this claim.

FOURTH: On June 18, 2020, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure against the CLUB
SAN ANTONIO RHYTHM GYMNASTICS with NIF G57922429 by virtue of the powers of attorney

established in art. 58.2 of the RGPD and in articles 47, 64.2 and 68.1 of the Organic Law
3/2018, of December 5, Protection of Personal Data and Guarantee of
Digital Rights (LOPDGDD), for the violation of article 6 of the RGPD, typified in
Article 83.5 b) of the RGPD and considered very serious in 72.1.a), for the purposes of
prescription, setting an initial penalty of 5,000 euros (five thousand euros).


FIFTH: The Agreement to Initiate Sanctioning Procedure, was notified to the defendant
electronically, the date of making available being June 18, 2021 and the
automatic rejection date on the 29th of the same month and year, as credited by the
certificate issued by the FNMT that is on file.


SIXTH: Formally notified of the initiation agreement, the one claimed at the time of the
This resolution has not submitted a brief of allegations, so it is
application of what is stated in article 64 of Law 39/2015, of October 1, of the
Common Administrative Procedure of Public Administrations, which in its
section f) establishes that in case of not making allegations within the established period

on the content of the initiation agreement, it may be considered a proposal for
resolution when it contains a precise pronouncement about the responsibility
imputed, for which a Resolution is issued.

       In view of all the actions, by the Spanish Protection Agency

of Data in this procedure the following are considered proven facts:

                                PROVEN FACTS

FIRST: It is established that the claimed has an Instagram page called

"RITMICASANANTONIO" in which images of minors are published
training.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/6








SECOND: That the claimant has stated to the defendant that she does not want
publish images of their daughters on social networks, which they have not given their
authorization to photograph and record their daughters.


THIRD: On June 18, 2021, this sanctioning procedure was initiated by the
violation of article 6 of the RGPD (legality of the treatment), being notified on the 29th
of the same month and year. Not having made any allegations, the defendant, to the agreement
Of start.


                            FOUNDATIONS OF LAW

                                             I

        By virtue of the powers that article 58.2 of the RGPD recognizes to each

control authority, and as established in articles 47 and 48 of the LOPDGDD,
the Director of the Spanish Data Protection Agency is competent to initiate
and to solve this procedure.

                                             II


        The defendant is charged with committing an offense for violation of the
Article 6 of the RGPD, "Legality of the treatment", which indicates in its section 1 the
cases in which the processing of third party data is considered lawful:

        "1. The treatment will only be lawful if at least one of the following is met

terms:
      a) the interested party gave their consent for the processing of their data
      personal for one or more specific purposes;

      b) the treatment is necessary for the performance of a contract in which the
      interested is part or for the application at the request of this of measures
      pre-contractual;

      (…) "
                                             III



        Sections b), d) and i) of article 58.2 of the RGPD provide the following:

        “2 Each supervisory authority shall have all the following powers
corrective measures listed below:

        (…)
        b) direct a warning to any person in charge or in charge of the treatment
when the processing operations have violated the provisions of this

Regulation;"
        (...)

        “D) order the person in charge of the treatment that the operations of
treatment comply with the provisions of this Regulation, where appropriate,

in a certain way and within a specified period; "

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/6








       “I) impose an administrative fine in accordance with article 83, in addition or in
place of the measures mentioned in this section, depending on the circumstances
of each particular case; "


       The offense is classified in Article 83.5 of the RGPD, which considers as such:


      "5. Violations of the following provisions will be sanctioned, in accordance with
with section 2, with administrative fines of a maximum of EUR 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for
the highest amount:


      a) The basic principles for the treatment, including the conditions for the
      consent in accordance with articles 5,6,7 and 9. "


       Organic Law 3/2018, on Protection of Personal Data and Guarantee of
Digital Rights (LOPDGDD) in its article 72, under the heading "Infractions

considered very serious ”provides:

      "1. Based on what is established in article 83.5 of the Regulation (E.U.)
2016/679 are considered very serious and will prescribe after three years the infractions that
suppose a substantial violation of the articles mentioned in that one and, in
in particular, the following:


        (…)
       a) The processing of personal data without the concurrence of any of the
           conditions of legality of the treatment established in article 6 of the
           Regulation (EU) 2016/679. "


                                           IV


      The documentation in the file provides evidence that the

claimed, has an Instagram page called "RITMICASANANTONIO" in which
images of minors performing exercises are published. That the claimant has
stated several times to the defendant, the last of them on February 5, 2021, that
does not want images of their daughters to be published on social networks and that they do not
They have the authorization to photograph and record their daughters.


      Well, the complainant has violated article 6.1 of the RGPD, since
published images on Instagram of the claimant's daughters, without having any
standing for it. It does not accredit the legitimacy for the treatment of the data of
the minor daughters, 10 and 12 years of age, of the claimant.


      It is noteworthy that information on these facts is required from the defendant, on 9
and on February 22, 2021, although it appears that the second of the
notifications by the postal service on March 3, 2021, has not
replied to this Agency.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/6








      Likewise, it is established that the Agreement to initiate this proceeding was
notified on June 29, 2021. However, the defendant has not carried out
allegations to it.


                                          V

      In accordance with the evidence available for the facts presented
constitute, by the claimed party, an infringement of the provisions of article 6.1 a)
of the GDPR.


       Likewise, it is considered that the sanction to be imposed should be adjusted according to
with the following criteria established in article 83.2 of the RGPD:

       As aggravating factors the following:


     In the present case we are facing serious negligent action (Article 83.2 b).

     Personal data is affected - the image, which makes them

       identifiable - of two minors, to whom the regulations of
       data protection protects in a special way (article 83.2g).


       Likewise, in accordance with the provisions of the aforementioned article 58.2.d) of the
RGPD, the claimed person is ordered, as the person responsible for the treatment, so that in the
within a month, take the necessary measures to remove the image of the
minors, in accordance with the provisions of article 6.1 a), as well as the
provision of means of proof accrediting compliance with the requirements.


       Therefore, in accordance with the applicable legislation and assessed the criteria of

graduation of the sanctions whose existence has been accredited, the Director of the
Spanish Agency for Data Protection RESOLVES:


FIRST: IMPOSE CLUB GIMNASIA RÍTMICA SAN ANTONIO, with NIF
G57922429, for a violation of Article 6 of the RGPD, typified in Article 83.5
of the RGPD, a fine of € 5,000 (five thousand euros).

SECOND: ORDER CLUB GIMNASIA RÍTMICA SAN ANTONIO, with NIF
G57922429 so that within a period of one month in accordance with the provisions of the
article 58.2.d) of the RGPD, adopt the necessary measures to remove the
Image of the two minors, in accordance with the provisions of article 6.1 a),
as well as the provision of means of proof accrediting compliance with the

required.

THIRD: NOTIFY this resolution to CLUB GIMNASIA RÍTMICA SAN
ANTONIO, with NIF G57922429.


FOURTH: Warn the sanctioned person that the sanction imposed by a
Once this resolution is enforceable, in accordance with the provisions of the
art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter LPACAP), within the payment period

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/6








voluntary established in art. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,
of December 17, by means of their entry, indicating the NIF of the sanctioned person and the number
procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Agency

Spanish Data Protection in the banking entity CAIXABANK, S.A .. In case
Otherwise, it will be collected in the executive period.

       Once the notification has been received and once it is executed, if the date of execution is
finds between the 1st and the 15th of each month, both inclusive, the deadline to carry out the
Voluntary payment will be until the 20th of the following or immediately subsequent business month, and if

is between the 16th and last days of each month, both inclusive, the term of the
payment will be up to the 5th of the second following or immediate business month.

       In accordance with the provisions of article 50 of the LOPDGDD, the
This Resolution will be made public once it has been notified to the interested parties.


       Against this resolution, which ends the administrative procedure in accordance with art.
48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the
LPACAP, the interested parties may file, optionally, an appeal for reversal
before the Director of the Spanish Agency for Data Protection within a period of
month from the day following notification of this resolution or directly

contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.


       Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the
LPACAP, the firm resolution may be suspended in an administrative way
If the interested party expresses his intention to file a contentious appeal-
administrative. If this is the case, the interested party must formally communicate this
made by writing to the Spanish Data Protection Agency,

Presenting it through the Electronic Registry of the Agency
[https://sedeagpd.gob.es/sede-electronica-web/], or through any of the rest
records provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. Too
must forward to the Agency the documentation that proves the effective filing
of the contentious-administrative appeal. If the Agency is not aware of the
filing of the contentious-administrative appeal within a period of two months from the

day after the notification of this resolution, I would terminate the
precautionary suspension.

Mar Spain Martí
Director of the Spanish Agency for Data Protection







C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es