AEPD (Spain) - EXP202403915

AEPD - EXP202403915
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR Article 9(1) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	05.07.2024
Published:
Fine:	10,000 EUR
Parties:	n/a
National Case Number/Name:	EXP202403915
European Case Law Identifier:	n/a
Appeal:	Appealed - Confirmed AEPD (Spain) REPOSICION-PS-00130-2024
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	fb

The DPA fined a plastic surgery clinic €10,000 after it unlawfully shared before and after pictures of a data subject on its social media account. The DPA highlighted that the pictures contained health data under Article 9(1) GDPR.

English Summary

Facts

The data subject underwent plastic surgery in a private clinic (the controller).

The data subject consented to take pictures and record the surgery for medical, scientific or educational purposes.

After that, the controller published on its social media pictures of the data subject comparing her physical appearance before and after the surgery was performed in order to promote the clinic.

Therefore, the data subject filed a complaint with the DPA.

The controller pointed out that the data subject had consented to the processing of her images.

Holding

First, the DPA noted that the data subject consented to the taking of photographs and/or recording.

However, the DPA pointed out that the data subject had never given her consent for her pictures to be shared online. On the contrary, the data subject had consented to record her surgery only for medical, scientific or educational purposes.

Therefore, the DPA held that the controller shared this data without a legal basis and found a violation of Article 6(1) GDPR.

Moreover, it noted that the pictures had already been deleted from the websites and, thus, no corrective measures were needed.

Secondly, the DPA noted that the processing involved data concerning health, therefore falling under Article 9 GDPR. The DPA found a violation of this article.

On these grounds, the DPA issued a fine of €10,000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/22

 File No.: EXP202403915

SANCTIONING PROCEDURE RESOLUTION

From the procedure instructed by the Spanish Data Protection Agency and based
on the following

BACKGROUND

FIRST: On December 28, 2022, A.A.A. (hereinafter, the
complainant) filed a claim with the Spanish Data Protection Agency.

The claim is directed against B.B.B., with NIF ***NIF.1, (hereinafter, the

respondent).

The reasons on which the claim is based are that Dr. C.C.C. (hereinafter, Ms.
C.C.C.), who performed plastic surgery on the complainant, provided B.B.B. (hereinafter, Mr. B.B.B.), before and after photos of the claimant's intervention.

These photos have been published by the respondent party to promote his private plastic surgery clinic on the social networks Facebook and Instagram.

He provides a Notarial Record, dated July 5, 2022, of the advertising and use

of his medical data without his consent.

Relevant documentation provided by the claimant:

- Copy of the Notarial Record, dated July 5, 2022, of the advertising and
use of his medical data without his consent.

- Copy of the Complaint and claim filed on 07/18/2022 before the Hospital
***HOSPITAL.1 for the same facts that appear in the claim filed before
the AEPD.

- Copy of the response from the Hospital ***HOSPITAL.1 dated 08/02/2022.

- Copy of the medical discharge report of the complainant dated 01/11/2017, issued
by Ms. C.C.C..

SECOND: In accordance with article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), said claim was forwarded to Ms. C.C.C. and the respondent party on 02/14/2023, so that they could proceed with its analysis and inform this
Agency within one month of the actions taken to comply with the
requirements provided for in the data protection regulations.

Both transfers, which were carried out in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), were collected on February 15, 2023, as stated in the acknowledgment of receipt in the file. On April 29, 2023, a written response to the transfer was received from the AEPD, where the respondent party states the following:

- On January 30, 2020, Ms. C.C.C. and he reached a commercial agreement in which Ms. C.C.C., could use the facilities of the Clinic of the respondent party
in Cuenca, (trade name (...)), for the performance of its sanitary work of consultation and follow-up of its clients/patients, as a plastic surgeon, without performing any operation in its facilities.

- On the other hand, and taking advantage of the visibility that the respondent party has on
social networks, an agreement was reached that he would publish some of the work of Ms. C.C.C., as long as she indicated it. Publishing the work
means publishing the before and after through photographic images, of the

surgical work that Ms. C.C.C. performs.

- He states that he does not process personal data of Ms. C.C.C.'s patients, unless it is the publication of this data, being he, in charge of
the treatment of Ms. C.C.C..

- He also wishes to state that he works as a cosmetic doctor in
Cuenca capital, and cannot perform plastic surgery operations, which means that he
does not need any publicity about the results of operations of this type to increase his
clients or benefit from treatments, which as a professional, he cannot perform.

- There is no direct relationship between the complainant and him. All relationship is
established through Ms. C.C.C..

- On 01/30/2020, the respondent party and Ms. C.C.C. signed the contract of
Data Processor, as established in article 28.3 of the
General Data Protection Regulation, where Ms. C.C.C. authorized the

respondent party to process personal data (ANNEX 1 contract).

- In said contract the purposes were:
o “Processing of data of patients/clients treated in the facilities of the Clinic of the data processor by the

data controller.

o Processing of personal data of patients/clients for advertising in facilities, media and social networks of the activities of the security officer, provided that the

controller so indicates in some communication”.

- On 12/12/2021, after a telephone conversation with Ms. C.C.C., in which the respondent party was
instructed to proceed to publish on social networks some images of the result of one of her operations, Ms. C.C.C. sent the respondent party an email with the photos. Completely unaware of the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/22

complainant, nor her name, only that the doctor had performed the
operation in Albacete.

- He acknowledges that the publication of the images was made without the
claimant's prior consent to him, but since the respondent party was in
charge of treating Ms. C.C.C., he should have obtained the
claimant's consent.

- At the time of receiving the claim, from the claimant whom he did
not know, and when he was told which photos they were, the photos were
immediately deleted from the social networks Instagram and Facebook, keeping

only the email of Ms. C.C.C., for evidence purposes and which will also be
deleted upon completion of the claim.

- He was carrying out the work entrusted to him, as the person in
charge of processing Ms. C.C.C.'s personal data. C.C.C., the latter being the

data controller, as a result of the existing commercial relationship
between the two.

- It has not carried out any improper processing or illegitimate
processing of the claimant's data, since it only acted in accordance
with the purposes entrusted by Ms. C.C.C., the latter being the party responsible
for said processing and for obtaining the informed consent of its client, the
claimant.

The relevant documentation provided by the respondent party is the following:

- Copy of the Data Processor Contract signed between Mr. B.B.B. and Ms.

C.C.C.. In the second stipulation of said contract under the heading "Purpose
of the processing" it is established that: "The purpose of the processing will be:

o Data of patients/clients treated at the Clinic facilities
of the data processor by the data controller.

o Advertising in facilities, media and social networks
of the activities of the security officer, provided that the
officer so indicates in a communication”.

- Copy of the email sent by Ms. C.C.C. on 12/12/2021, in which the subject

appears: “more photos of (...) doubles” and in which 4 files are attached,
two containing photos of the claimant and two others that appear hidden.

On 05/22/2023, a letter was received from Ms. C.C.C. in which, among other aspects,
she states that:

- Regarding the decision taken regarding this claim, firstly, it must be made clear that she was aware of the
publication of the images on the social networks of the Clinic (...), a commercial name used
by Mr. B.B.B. (the respondent party) following the complaint that the complainant filed with the Hospital's Customer Service

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/22

***HOSPITAL.1. After receiving said complaint, the complainant immediately contacted
the Clinic (...), a commercial name used by D. B.B.B. (the respondent party)
which proceeded to delete the aforementioned images.

- The purpose for which the images were taken was "for the purposes of

advances in medical education (...) for medical, scientific or
educational purposes"; as stated in document n.1 attached to
this document and which consists of the consent document for surgery
signed by the complainant; unaware of the publication on the social media
profiles of the Clinic (...), a commercial name used by D. B.B.B. (the
respondent party) until the time of receiving the claim from the complainant.

- I was unaware of the publication of the images until the time of the
claim to the Hospital's Customer Service Department.
***HOSPITAL.1.

- It should be emphasized that the publication of the images was made on the social networks of the Clinic (...), a commercial name used by Mr.
B.B.B. (the respondent party) and not on his own.

- He is aware that the Clinic deleted the images immediately as soon as he informed them of the complaint he had received through ***HOSPITAL.1.

- That as of the date of this writing the photographs are not available nor is there any possible way to locate them.

- He attaches as Annex I a Report on the causes that have motivated the incident that has given rise to the complaint. In said Report, among other aspects, he indicates:

o That on January 10, 2017, Ms. C.C.C. performed a cosmetic surgery on the complainant
the intervention was carried out at the current Clinic ***HOSPITAL.1.

o On the same day, the claimant signed the consent document for the intervention, section 6 of which expressly states the
consent for photographing or filming the operation for medical, scientific or educational purposes.

o That on January 11, 2017, the claimant was discharged.

o That on July 18, 2022, the claimant filed a claim
with the patient care service of ***HOSPITAL.1.

o That after receiving the claim, she contacted directly the
Clinic (...), a commercial name used by D. B.B.B., (the respondent party) who proceeded to immediately delete the images from
its social media profiles.

o That on February 15, 2023, she received notification of the

previous transfer of the claim and request for a report. C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/22

o That in relation to the reasons motivating the claim, it appears that the Clinic (...), a commercial name used by Mr. B.B.B. (the respondent party) published the images taken before and after the claimant's operation on its Facebook and Instagram profiles without her consent.

o That he was unaware of said publication, so when he received the claimant's claim, he immediately contacted the Clinic (...), a commercial name used by Mr. B.B.B., (the respondent party), who in turn deleted the images from their social media profiles.

o That as of the date of this writing, the images are still not

available and there is no possibility of them being accessible on the Internet

- Attached as Annex II Report on the measures adopted to prevent similar

incidents from occurring, implementation dates and controls carried out to verify their

effectiveness, as set out in the following table:

Measure Implementation date Control

Update and improvement of the consent document May 2023 Annual review of the document in order to
verify its suitability and adapt it, if necessary, to possible new situations.

Global review of the level of May-June 2023 Annual review to verify compliance with the GDPR and compliance with the regulations, detect new
LOPDGDD in the professional activity. treatments and adopt the necessary measures.

Relevant documentation provided by Ms. C.C.C.:

- Annex I Report on the causes that have motivated the incident that has
originated the claim.

- Annex II Report on the measures adopted to prevent similar incidents from occurring

dates of implementation and controls carried out to verify their effectiveness.

- Document No. 1 Copy of the document “CONSENT FOR

SURGERY/PROCEDURE OR TREATMENT” signed by the claimant, authorizing Ms. C.C.C. to perform the procedure or
treatment: (...). And in section 6 it states that: “For the purposes of advancement
in medical education, I give consent for the entry of

observers into the operating room and the photographing or filming of the
operation(s) or procedure(s) to be performed, for medical,
scientific or educational purposes since my identity will not be revealed in the

images”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/22

THIRD: On March 28, 2023, in accordance with article 65 of the
LOPDGDD, the claim submitted by the claimant was admitted for processing.

FOURTH: The General Subdirectorate for Data Inspection proceeded to carry out preliminary investigation actions to clarify the facts in question, pursuant to the functions assigned to the control authorities in Article 57.1 and the powers granted in Article 58.1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR), and in accordance with the provisions of Title VII, Chapter I, Section Two, of the LOPDGDD, having knowledge of the following:

Regarding the facts contained in the complaint, as well as the documents together with it submitted by the complaining party and the response to the transfer and the accompanying documents, made by Mr. B.B.B. (the respondent party) and by Ms. C.C.C., it is not disputed by the parties that Mr. B.B.B. published on the social media profiles (Facebook and Instagram) of the Clinic (...), which it uses as its
trade name, photographs of before and after the operation of (...) that Ms.

C.C.C. performed on the complainant in January 2017. And that said publication was
made without the consent of the complainant.

It has also been proven that there has never been any type of contractual
relationship between the complainant and Mr. B.B.B. (the respondent), or the Clinic (...),
which it uses as its trade name, as acknowledged by the complainant in its
complaint and by Mr. B.B.B. (the respondent) in its response to the

transfer.

It has been proven that the complainant underwent an operation of (...),
performed by Ms. C.C.C. and gave her consent for her to carry out the
“photographing or filming of the operation(s) or procedure(s) to be

performed, for medical, scientific or educational purposes since my identity will not be

revealed in the images” although only for “purposes of advancement in medical

education”, not for commercial advertising purposes of the activity of Ms. C.C.C. or of
third parties with whom she collaborates. And that the published photographs were taken by
Ms. C.C.C. when she performed the aforementioned operation in January 2017.

The photographs were sent from the email ***EMAIL.1 to the email ***EMAIL.2 on
12/12/2021, said email addresses being those of Ms. C.C.C. and the
respondent respectively.

These photographs were not published on the aforementioned profiles

(Instagram and Facebook) of the Clinic (...), commercial name used by Mr. B.B.B., on
10/02/2023, according to the evidence collected by the AEPD for this purpose.

According to statements by Ms. C.C.C. and Mr. B.B.B., these photographs would have been
removed from social networks after the claim filed by the complainant

to the Hospital ***HOSPITAL.1, in July 2022, and they are still not available and there is
no possibility that they will be accessible on the Internet.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/22

The contractual relationship between Ms. C.C.C. and Mr. B.B.B., in the existing contract for data processing between them dated 01/30/2020, the purposes of said contract are listed as follows: The processing of the “data of

patients/clients treated at the facilities of the Clinic of the data processor by the data controller”. As well as the “advertising in
facilities, media and social networks of the activities of the security officer, provided that the controller so indicates in a
communication”

Mr. B.B.B. has provided a communication (email) from Ms. C.C.C. in which
he sends the photos published by him on the social media profiles of the Clinic (...),
trade name used by Mr. B.B.B..

FIFTH: On March 18, 2024, the Director of the Spanish Data Protection Agency

agreed to initiate sanctioning proceedings against the respondent party,
in accordance with the provisions of articles 63 and 64 of Law 39/2015, of October 1,
on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged violation of Article 6.1 of the GDPR and Article 9
of the GDPR, classified in Article 83.5 of the GDPR.

SIXTH: Having notified the aforementioned initiation agreement in accordance with the rules established in
Law 39/2015, of October 1, on the Common Administrative Procedure of
Public Administrations (hereinafter, LPACAP), the respondent party submitted a written statement
in which it stated the following:

“The facts reported do not correspond to the factual reality, since it is assumed
that the photographs published on social networks were for my own
benefit, which is totally contrary to reason, since I was only in charge
of data processing, as has been justified in the submission of the documents previously
provided to the file.

The reality is that Ms. C.C.C. has a clinic rented in the premises that I own, and
that the advertisement is for surgical treatments, having nothing to do with my
activity since I only perform aesthetic treatments without surgical interventions, so I can hardly benefit from the publication of these photographs.

I have to say that I have not incurred in any infringing conduct and that therefore the
sanction that has been imposed on me must be null, first of all and in accordance with article
6.1 of the GDPR

In accordance with what I have previously reported and with what is in the

file, as you transcribe, I am only the person in charge of data processing, the plastic surgeon being Ms. C.C.C. who has to obtain the
consent of the patient to whom he takes the photos before and after the
intervention, and who, as I have demonstrated and is already in the file,
sent me said photos and had the consent of the patient, as also stated

in the file, not knowing since I was not there at the time when he obtained it
whether it was for one purpose or for several as required by article 6.1 RGDP.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/22

Therefore, not being responsible for obtaining this consent, since I did not
participate in the intervention nor do I know the claimant at all, I could not act
negligently as indicated.”

SEVENTH: On May 7, 2024, the instructor of the procedure agreed to
reproduce for evidentiary purposes the claim filed by A.A.A. and its
documentation, the documents obtained and generated during the admission phase for processing of the
claim, and the report of prior investigation actions that are part of procedure AI/00146/2023.

Likewise, the allegations to the agreement to initiate the referenced sanctioning procedure, presented by B.B.B., and the
documentation that accompanies them, are reproduced for evidentiary purposes.

EIGHTH: On May 8, 2024, a resolution proposal is issued
proposing the following:

That the Director of the Spanish Data Protection Agency sanction
B.B.B., with NIF ***NIF.1, for an infringement of Article 6.1 of the GDPR and Article 9 of the
RGPD, classified in Article 83.5 of the GDPR, with a fine of 5,000 euros for the

infringement of Article 6.1 of the GDPR, and a second fine of 5,000 euros for the
infringement of Article 9 of the GDPR, which amounts to a total of €10,000 (ten thousand
euros),

That the Director of the Spanish Data Protection Agency order

B.B.B., with NIF ***NIF.1, that pursuant to Article 58.2.d) of the GDPR, within the term Within one month from the notification of the resolution of this sanctioning procedure,
documentarily prove to the AEPD that it has complied with the
adoption of measures taken consisting of preventing photographs of patients from this or another clinic from being disseminated on social networks without having

the necessary legitimacy to do so. NINTH: On June 3, 2024, the statements made by the respondent party in response to the resolution proposal are recorded, indicating
the following:

“The AEPD on page 9 of its resolution proposal assumes that I am a plastic surgeon, but this is not true, this premise being very important for the
proposed administrative sanction since I repeat again that I have not profited from the
publication of these photographs, I am only the owner of the property in which the
Doctor, who is a plastic surgeon, has a consultation room for rent, so

neither was the surgery performed in my establishment nor do I know this person at all, only
as a data processing agent I did what the person responsible for the processing of
this data indicated to me, understanding at all times that the consent that the doctor
has is valid for said publication, although this is something that I do not obtain,
since I am concerned with obtaining the consent of the patients who

authorize me to do so in my office. activity regarding the aesthetic treatments that I perform.

The claimant states that B.B.B. published on the social networks Facebook and
Instagram the before and after photos of the plastic surgery intervention,
performed by Ms. C.C.C., to the claimant A.A.A.. B.B.B. acted as the person in
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/22

charge of treatment for Dr. C.C.C., responsible for obtaining informed consent from his
patient, and adapting this to the current regulations LOPDGDD 3/2018, of 5
December. (The surgical intervention and consequently her consent, as

the claimant points out, was carried out prior to the entry into force of the Law, a fact that was
totally unknown to B.B.B.).

It has also become clear that the complainant did not contact me
directly to request that I remove the photographs, but even so, at the moment
that the Doctor indicated it to me, I removed them from my networks.

As for indicating that it has been done in order to prevent this from happening again
the images have been manually deleted both on Instagram
and on Facebook of Clínica (...). (trade name and identifier of the aesthetic medicine activity of B.B.B.).

A sweep has also been carried out on the Google search engine to evaluate the removal
of the images and videos from the Facebook and Instagram pages, the links to which
we attach for verification.

***URL.1 and ***URL.2

That is why the images of Mrs. A.A.A. and links to the content on the social networks Facebook and Instagram have been removed from all of them.

Furthermore, the same procedure has been followed with images or videos with identifiable data of any other person or they have been pixelated, despite having
informed consent from the persons, clients/patients of B.B.B. that appear
in ***URL.1 and ***URL.2”

From the actions carried out in the present procedure and the documentation

in the file, the following have been proven:

PROVEN FACTS

FIRST: Dissemination on the social networks Facebook and Instagram of photos of the

complainant without his consent, to advertise the private plastic surgery clinic of the respondent.

BASIS OF LAW

I

Competence

In accordance with the powers granted to each supervisory authority by article 58.2 of the GDPR and as established in articles 47, 48.1, 64.2 and 68.1 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and resolve this procedure.

Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Data Protection Agency shall be governed by the provisions

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/22

of Regulation (EU) 2016/679, by this organic law, by the regulatory provisions issued in its development and, insofar as they do not contradict them, in a subsidiary
character, by the general rules on administrative procedures."

II

Preliminary issues

In the present case, it is alleged that the respondent party, owner of the Clinic (…),

has disseminated on social networks photos of the before and after of the surgical intervention that the complainant underwent, in order to advertise the clinic of the respondent party, without the consent of the complainant.

These photos have been published by the respondent party to promote his private plastic surgery clinic

on the social networks Facebook and Instagram.

The AEPD, after carrying out the investigation actions indicated in the
background, makes the following considerations:

1.- It has been proven that Ms. C.C.C. performed a treatment/operation of (...) on

the appellant in 2017.

2.- During said operation/treatment, Ms. C.C.C. took photographs of the before and
after of said treatment, with the consent of the complainant party
for the photograph for medical, scientific or educational purposes. There is no record that the

complainant party gave her consent to the photograph for the purposes of commercial
advertising of the activity of Ms. C.C.C. or of third parties with whom she collaborated.

3º.- The photographs of the aforementioned treatment/operation were sent from the email ***EMAIL.1 to the email ***EMAIL.2 on 12/12/2021 and published on the

social media profiles of the Clinic (...), a commercial name used by Mr. B.B.B., without
the consent of the complaining party.

4º.- There is a data processing contract, dated 01/30/2020, between Ms.
C.C.C. and Mr. B.B.B., with the following purposes appearing in said contract:
The processing of “data of patients/clients treated at the facilities of the

Clinic of the data processor by the data controller”. As well as the
“advertising in facilities, media and social networks of the
activities of the security officer, as long as the officer so indicates
in some communication”

5th.- In the evidence collected by the AEPD on 02/10/2023, the photographs
subject to the claim were not published on the social media profiles (Instagram and Facebook) of the Clinic (...), the commercial name used by Mr.
B.B.B..

III
Response to the allegations presented

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/22

The respondent party in response to the start agreement, sends a letter dated April 3,
2024, where he states that he is not responsible for the facts imputed to him since he did not
participate in the surgical intervention of the claimant, nor does he know the claimant, and the

dissemination of such photographs does not bring him any benefit since he only performs
aesthetic treatments without surgical interventions, so he is
exempt from all responsibility since he is only in charge of the treatment and not the
responsible party.

The respondent party in response to the resolution proposal, sends a letter dated June 3,

2024, stating that he is not a plastic surgeon, but the owner of the property
in which surgeon C.C.C. practices his profession, and that the consent that the doctor has is valid for the publication of the photographs of the complainant.

The respondent has also stated that, as he is not a surgeon, he did not participate in the

intervention performed on the complainant, and that the publication of the
images does not provide him with any benefit, since he is not the surgeon who operated on the
complainant, but rather the owner of the Clinic (…), and that the consent given by the
complainant to be operated on by C.C.C., is valid for the publication of the
photographs of the before and after the operation performed on the complainant.

Likewise, the respondent points out that the complainant did not contact him
to request that he remove the photographs, but even so at the time that surgeon
C.C.C. He was informed that he manually removed the images from both Instagram and
Facebook of Clínica (...), and the same procedure has been followed with the images or
videos with identifiable data of any other person.

In response to such statements, it must be indicated that it has been established that the
cosmetic operation that the complainant underwent was performed in a center
different from the clinic of the respondent, since the complainant was operated on at the
Clínica ***HOSPITAL.1, on January 10, 2017, and the clinic advertised by the
respondent is the Clínica (...), so it is an established fact that the respondent, whether
or not a surgeon, did not participate in the intervention performed on the complainant, there
being no contract that binds him to the complainant, and therefore he would have been
authorized to process the before and after photographs of the
operation performed by C.C.C., on the complainant. Therefore, using these photographs to advertise the Clinic that he owns implies the search for a

profit or benefit. Furthermore, the photos of the complainant were taken before and after the cosmetic surgery performed by the respondent on the complainant in 2017, that is, years before the formalization of the contract for the processing of data

between the complainant and C.C.C..

Therefore, the AEPD must indicate that we are not talking about a withdrawal of
consent, nor any other cause of legitimacy that entitles it to process the personal data of the respondent, in this case her image, so the complainant is not

required to exercise its right to cancellation, nor any of the other rights recognized in the GDPR, for the processing of said photographs to cease

by the respondent entity, since this would only be appropriate if the complainant had ever granted to the respondent party for its authorization for such
processing.

Ultimately, the respondent party is the sole party responsible for the dissemination of the
before and after photos of the operation performed on the complainant party, on social
networks.

IV
Article 6.1 of the GDPR

The physical image of a person, according to article 4.1 of the GDPR, is personal
data and its protection, therefore, is the subject of said Regulation. Article 4.2
of the GDPR defines the concept of “processing” of personal data

Article 6.1 of the GDPR establishes the assumptions that allow the processing of personal data to be considered lawful, indicating the following:

“1. The processing will only be lawful if at least one of the following
conditions is met:

a) the interested party gave his consent for the processing of his personal data
for one or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

(d) processing is necessary to protect the vital interests of the data subject or of another natural person;

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Point (f) of the first paragraph shall not apply to processing carried out by public authorities in the performance of their tasks.

Regarding the processing for video surveillance purposes, article 22 of the LOPDGDD
establishes that natural or legal persons, public or private, may carry out

the processing of images through camera or video camera systems
in order to preserve the security of people and property, as well as their
facilities.”

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/22

It is considered that the facts set forth, that is, that the respondent party, has
used photos of before and after the intervention of C.C.C., without having the
express consent of the respondent party, or any other cause of legitimacy,

owner of the image of the photographs in dispute, for the purpose of publishing them
on social networks and advertising his clinic, could constitute an illegal processing
of personal data, which would constitute a violation of article 6 of the RGPD.

The respondent claims that in 2017, the complainant signed her
consent authorizing the intervention itself and the taking of photographs and/or

recording, but not the communication of these photos to third parties.

Likewise, Dr. C.C.C. and the respondent party indicate that the before and after photos of the operation used to advertise the respondent party's clinic were obtained with the respondent party's consent, since it was

produced in the B.B.B.o of a treatment order contract entered into in 2020.

In response to such allegations from the respondent party, the AEPD considers that it cannot
be considered that the publication of the before and after photos of the claimant's cosmetic surgery can be covered by the contract entered into in 2020 by the respondent party and C.C.C., and therefore understand that the claimant's consent is available, for the following reasons:

Firstly, the cosmetic surgery that the claimant underwent was
performed in a centre other than the respondent party's clinic, since the claimant

was operated on at the ***HOSPITAL.1 Clinic, on January 10, 2017, and the clinic
advertised by the respondent is the Clinic (...).

Secondly, the photos of the complainant were taken before and after
the cosmetic surgery performed by the respondent on the complainant in

2017, that is, years before the formalization of the contract for the
treatment between the complainant and C.C.C..

Therefore, the respondent would be the exclusive party responsible for the dissemination of
the before and after photos of the operation performed on the complainant, on
social networks.

Thus, it must be taken into account that the present procedure focuses on the
alleged responsibility of the respondent for the dissemination of the before and
after photos of the operation performed by C.C.C. on the complainant.

V

Classification of Article 6.1 of the GDPR

The known facts could constitute an infringement, attributable to the respondent party, classified in Article 6.1 of the GDPR, indicated above, in legal basis II, and could therefore constitute the commission of an infringement classified in Article 83.5 of the GDPR, which provides as follows:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/22

“Infringements of the following provisions shall be punishable, in accordance with
paragraph 2, by administrative fines of up to EUR 20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the

total global annual turnover of the previous financial year, whichever is higher:

a) the basic principles for the processing, including the conditions for consent pursuant to Articles 5, 6, 7 and 9; “

For the purposes of the limitation period for infringements, the infringement referred to in the
previous paragraph is considered very serious pursuant to Article 72.1 of the LOPDGDD,
which establishes that:

“In accordance with the provisions of Article 83.5 of Regulation (EU) 2016/679, infringements that constitute
a substantial violation of the articles mentioned therein and, in particular, the
following are considered very serious and shall be subject to a three-year limitation period:

b) The processing of personal data without any of the conditions for the
lawfulness of the processing established in Article 6 of Regulation (EU) 2016/679 being met. (…)

VI

Proposal for a sanction for infringement of Article 6.1 of the GDPR

In order to determine the administrative fine to be imposed, the provisions of Articles 83.1 and 83.2 of the GDPR must be observed, which state:

“Each supervisory authority shall ensure that the imposition of administrative fines
in accordance with this Article for infringements of this Regulation

referred to in paragraphs 4, 9 and 6 are effective,
proportionate and dissuasive in each individual case.”

Administrative fines shall be imposed, depending on the circumstances of each individual case, as an addition to or as a substitute for the measures provided for in
Article 58, paragraph 2, points (a) to (h) and (j).

When deciding whether to impose an administrative fine and its amount in each individual case, due account shall be taken of:

a) the nature, seriousness and duration of the infringement, taking into account the

nature, scope or purpose of the processing operation in question, as well as the number of data subjects affected and the level of damage suffered by them;

b) the intentionality or negligence of the infringement;

c) any measures taken by the controller or processor to mitigate the damage suffered by the data subjects;

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 15/22

d) the degree of responsibility of the controller or processor, taking into account any technical or organisational measures they have implemented pursuant to

Articles 25 and 32;

e) any previous infringement committed by the controller or processor;

(f) the degree of cooperation with the supervisory authority in order to remedy the

breach and mitigate any adverse effects of the breach;

(g) the categories of personal data affected by the breach;

(h) the manner in which the supervisory authority became aware of the breach, in

particular whether and, if so, to what extent the controller or processor notified the
breach;

(i) where measures referred to in Article 58(2) have been previously ordered
against the controller or processor concerned in relation to the same

matter, compliance with those measures;

(j) adherence to codes of conduct pursuant to Article 40 or to certification
mechanisms approved pursuant to Article 42; and

(k) any other aggravating or mitigating factors applicable to the circumstances of the case,
such as financial benefits obtained or losses avoided, directly or
indirectly, through the breach.”

Regarding section k) of article 83.2 of the GDPR, the LOPDGDD, article 76,

“Sanctions and corrective measures”, provides:

“2. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679,
the following may also be taken into account:

a) The continued nature of the infringement.

b) The link between the offender's activity and the processing of personal data.

c) The benefits obtained as a result of the commission of the infringement.

d) The possibility that the conduct of the affected party could have led to the commission of the infringement.

e) The existence of a merger process by absorption subsequent to the commission of the infringement, which cannot be attributed to the absorbing entity.

f) The impact on the rights of minors.

g) Have, when not mandatory, a data protection officer”

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 16/22

In accordance with the transcribed provisions, for the purposes of setting the amount of the fine to be imposed in this case on the respondent as responsible for an infringement classified in article 83.5.a) of the GDPR, in an initial assessment, the following aggravating factors are considered to be concurrent:

- Intentionality/ Negligence in the infringement (section b): the notorious negligence observed in the commission of the infringement, to the extent that the respondent party has
disseminated on social networks photographs of the complainant, provided by C.C.C., without
having the consent or any other cause of legitimacy of the complainant.

The sanction to be imposed on the respondent must be graduated and set at €5,000
in accordance with article 58.2 of the GDPR

VII

Adoption of measures for the infringement of article 6.1 of the GDPR

If the infringement is confirmed, it may be agreed to impose on the person responsible the adoption of
appropriate measures to adjust its performance to the regulations mentioned in this

act, in accordance with the provisions of the aforementioned article 58.2 d) of the GDPR, which
provides the following:

“Each supervisory authority shall have all of the following corrective powers
indicated below:

d) order the person responsible or in charge of the treatment that the treatment operations comply with the provisions of this Regulation, where appropriate,
in a certain manner and within a specified period.

In this specific case, the respondent party and C.C.C. The latter is the person who
provided the photos to the respondent party, they have stated that as soon as they
became aware of the complaint filed, on 18/07/2022, the complainant's
photographs were removed.

In addition, in response to the resolution proposal, the respondent party has proven

that measures have been taken so that the data of its clients cannot be processed again
without having the legitimacy required by the data protection regulations
for which it has carried out a search on Google to evaluate the elimination of
the images and videos from the Facebook and Instagram pages whose links it attaches
for verification.

***URL.1 and ***URL.2

Therefore, it is noted that all the images of the complainant and
links to the content on the social networks Facebook and Instagram were deleted.

In addition, the same procedure has been followed with the images or videos with identifiable
data of any other person, whether they are clients or patients of B.B.B. which
appear in ***URL.1 and ***URL.2

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 17/22

VIII

Article 9 of the GDPR

Article 9 of the GDPR establishes the following:

1. The processing of personal data that reveal ethnic or racial origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data aimed at uniquely identifying a natural person, data relating to health or data relating to the sexual life or sexual orientations of a natural person is prohibited.

2. Paragraph 1 shall not apply where one of the following

conditions applies:

a) the data subject has given explicit consent to the processing of those personal

data for one or more of the specified purposes, except where Union or Member State law provides that the

prohibition referred to in paragraph 1 cannot be lifted by the data subject;

b) the processing is necessary for the performance of obligations and the exercise of
specific rights of the controller or of the data subject in the field of

labour law and social security and protection, insofar as this is authorised by Union law of the Member States or by a collective agreement
in accordance with Member State law providing for appropriate safeguards for the

respect of the fundamental rights and interests of the data subject;

c) the processing is necessary in order to protect the vital interests of the data subject or of another
natural person, where the data subject is not physically or legally capable of giving consent;

(d) the processing is carried out, within the scope of its legitimate activities and with appropriate
guarantees, by a foundation, association or any other non-profit-making
body, the purpose of which is political, philosophical, religious or
trade union, provided that the processing concerns only current or former members of
such bodies or persons who maintain regular contact with them in relation to their
purposes and provided that the personal data are not disclosed outside them without
the consent of the data subjects;

(e) the processing concerns personal data which the data subject has
manifestly made public;

(f) the processing is necessary for the establishment, exercise or defence of
claims or when the courts act in their judicial capacity;

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 18/22

g) the processing is necessary for reasons of essential public interest, on the basis of Union or Member State law, which must be proportionate to the objective pursued, substantially respect the right to data protection and provide for appropriate and specific measures to protect the interests and fundamental rights of the data subject;

h) the processing is necessary for the purposes of preventive or occupational medicine, assessment of the worker's work capacity, medical diagnosis, the provision of health care or treatment or the management of health care and social care systems and services, on the basis of Union or Member State law or under contract with a health care professional and without prejudice to the conditions and guarantees referred to in paragraph 3;

(i) the processing is necessary for reasons of public interest in the field of public health,

such as protecting against serious cross-border threats to health, or
to ensure high standards of quality and safety of healthcare and
medicines or medical devices, on the basis of Union or
Member State law which provides for appropriate and specific measures to
protect the rights and freedoms of the data subject, in particular professional secrecy,

(j) the processing is necessary for archiving purposes in the public interest, scientific or
historical research purposes or statistical purposes in accordance with Article

89(1), on the basis of Union or Member State law, which must be proportionate to the
aim pursued, substantially respect the right to data protection and provide for appropriate and specific measures to
protect the interests and fundamental rights of the data subject.

3. The personal data referred to in paragraph 1 may be processed for the purposes
referred to in paragraph 2(h) when the processing is carried out by a
professional subject to an obligation of professional secrecy, or under his responsibility,

in accordance with Union or Member State law or with rules established by competent national bodies, or by any other
person also subject to an obligation of secrecy in accordance with Union or Member State law or rules established by competent national bodies.

4. Member States may maintain or introduce additional conditions,
including limitations, with regard to the processing of genetic data, biometric data or data
relating to health.

In the present case, the dissemination on social networks by the respondent party of the
before and after photos of the cosmetic surgery carried out by Dr. C.C.C. to the
complainant, would violate article 9.1 of the GDPR, since health data has been disseminated, which are especially protected in article 9.1 of the GDPR.

It should also be noted that we are not in any of the situations where
exceptionally, by virtue of article 9.2 of the GDPR, it is possible to overcome the
prohibition of processing these data, so we would be faced with an alleged
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 19/22

violation of article 9 of the GDPR, indicated above.

IX

Classification of Article 9 of the GDPR

The infringement of Article 9 of the GDPR, for which the respondent is held responsible, is
provided for in Article 83.5 of the GDPR, which establishes that:

“Infringements of the following provisions shall be punishable, in accordance with
section 2, by administrative fines of a maximum of 20,000,000 Euros or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total global annual turnover of the previous financial year, whichever is greater:
a) The basic principles for processing, including the conditions for
consent pursuant to Articles 5, 6, 7 and 9.”

In turn, the LOPDGDD in its article 72.1.e) classifies as a very serious infringement, for the purposes of prescription, "The processing of personal data of the categories referred to in article 9 of Regulation (EU) 2016/679 without any of the circumstances provided for in said provision and in the article of this Organic Law."

X
Proposed Penalty for infringement of article 9 of the GDPR

In order to determine the administrative fines to be imposed, the provisions of articles 83.1 and 83.2 of the GDPR must be observed, provisions already indicated in

ground VI.

In accordance with these provisions, for the purposes of setting the amount of the fine to be imposed on the respondent party as responsible for an infringement classified in Article 83.5.a) of the GDPR, the following factors are considered to be concurrent in the present case, as
aggravating factors:

- Intentionality/Negligence in the infringement (section b): the notorious negligence
appreciated in the commission of the infringement, to the extent that the respondent party,
responsible for the processing of health data, data especially protected by the

data protection regulations, has disseminated on social networks to publicize
its clinic, photographs of the complainant that were provided to it by C.C.C., despite not
being in any of the exceptional cases that allow its processing according to Article 9.2 of the GDPR.

The sanction to be imposed on the respondent must be graduated and set at €5,000
in accordance with article 58.2 of the GDPR

XI

Adoption of measures for the infringement of article 9 of the GDPR
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 20/22

It is agreed to impose on the controller the adoption of appropriate measures to adjust
its actions to the regulations mentioned in this act, in accordance with the provisions

of the aforementioned article 58.2 d) of the GDPR, which provides the following:

“Each supervisory authority shall have all of the following corrective powers
indicated below:

d) order the controller or processor to comply with the provisions of

this Regulation, where appropriate,
in a certain manner and within a specified period;

In this specific case, the respondent party and C.C.C., the surgeon who provided the photos of the complainant, have stated that as soon as they became aware of the

complaint filed, on 18/07/2022, the photographs of the complainant were
removed.

In addition, in response to the resolution proposal, the respondent party has proven
that measures have been taken to ensure that the data of its clients cannot be processed again
without having the legitimacy required by data protection regulations

for which it has carried out a search on Google to evaluate the elimination of
the images and videos from the Facebook and Instagram pages whose links it attaches
for verification.

***URL.1 and ***URL.2

Therefore, it is noted that all the images of the complainant and
links to the content on the social networks Facebook and Instagram were deleted.

In addition, the same procedure has been followed with images or videos containing identifiable

data of any other person, whether they are B.B.B. customers or patients. which
appear in ***URL.1 and ***URL.2

Therefore, in accordance with the applicable legislation and having assessed the criteria for
graduating the sanctions whose existence has been proven,

the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: TO IMPOSE on B.B.B., with NIF ***NIF.1, for an infringement of Article 6.1
of the GDPR and Article 9 of the GDPR, classified in Article 83.5 of the GDPR, a
fine of 5,000 euros for the infringement of Article 6.1 of the GDPR, and a second fine

of 5,000 euros for the infringement of Article 9 of the GDPR, which amounts to a total of
€10,000 (ten thousand euros),

SECOND: TO NOTIFY this resolution to B.B.B.

THIRD: This resolution will be enforceable once the deadline for filing the optional appeal for reconsideration ends (one month from the day following the notification of this resolution) without the interested party having made use of this faculty.
The sanctioned party is warned that he must pay the imposed sanction once

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 21/22

this resolution becomes enforceable, in accordance with the provisions of art. 98.1.b)
of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), within the voluntary payment period

established in art. 68 of the General Collection Regulations, approved by Royal
Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17 December, by depositing it, indicating the NIF of the sanctioned party and the procedure number that appears in the heading of this document, in the restricted account nº IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code:
CAIXESBBXXX), opened in the name of the Spanish Data Protection Agency in

the banking entity CAIXABANK, S.A. Otherwise, it will be collected during the enforcement period.

Once the notification has been received and is enforceable, if the date of enforceability is between the 1st and 15th of each month, both inclusive, the deadline for making the voluntary payment will be until the 20th of the following month or the next business day thereafter, and if it is between the 16th and last day of each month, both inclusive, the payment deadline will be until the 5th of the second following month or the next business day thereafter.

In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, interested parties may, at their discretion, lodge an appeal for reconsideration before the Director of the Spanish Data Protection Agency within one month from the day following notification of this resolution or directly lodge an administrative appeal before the Administrative Litigation Division of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of 13 July, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this act, as provided for in article 46.1 of the aforementioned Law.

Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP, the final resolution may be provisionally suspended by administrative means if the interested party
expresses his intention to lodge an administrative appeal.

If this is the case, the interested party must formally communicate this fact by means of a
written document addressed to the Spanish Data Protection Agency, presenting it through
the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
web/], or through one of the other registries provided for in art. 16.4 of
the aforementioned Law 39/2015, of October 1. He must also transfer to the Agency the

documentation that proves the effective filing of the administrative appeal. If the Agency is not aware of the filing of the administrative appeal
within two months from the day following the notification of this resolution, it will terminate the provisional suspension.

938-16012024
Mar España Martí

Director of the Spanish Data Protection Agency

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 22/22

C/ Jorge Juan, 6 www.aepd.es

28001 – Madrid sedeagpd.gob.es