Banner1.jpg

AEPD (Spain) - EXP202309208

From GDPRhub
Revision as of 07:36, 8 January 2025 by Ao (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=EXP202309208 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https://www.aepd.es/documento/reposicion-ps-00335-2023.pdf |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Lan...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
AEPD - EXP202309208
LogoES.jpg
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 5(1)(c) GDPR
Article 5(2) GDPR
Type: Complaint
Outcome: Upheld
Started: 09.09.2022
Decided: 13.12.2024
Published: 19.12.2024
Fine: 10,000 EUR
Parties: El León Espanol
National Case Number/Name: EXP202309208
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Spanish
Original Source: AEPD (in ES)
Initial Contributor: ao

The DPA fined a newspaper €10,000 for failing to make use of anonymization techniques in order minimise personal data published in an article.

English Summary

Facts

The data subject filed several complaints with the Spanish DPA (Agencia – AEPD) against specific users of Twitter as well as a newspaper, here the controller. The Twitter users had posted a video of the data subject in which the data subject is clearly recognisable. After its publication on Twitter, the video went viral.

The controller had published the video as part of an article on its website. The data subject stated that the video had been created for work purposes for the launch of a social media challenge.

On the 9 September 2022, the AEPD issued preliminary proceedings against the controller. In response, the controller submitted a statement showing that it had deleted the video from its website.

The controller argued that the focus of the article was to analyse the popularity and implications of the trend rather than assessing the data subject’s personal or private life. It further argued that in its role as a media provider it was required to inform on current relevant events. It also highlighted that other media outlets had also shared the video. In addition, the controller brought forward that it had merely included a nickname of the data subject in the article, which had been manifestly made public through the trend.

On the 15 April 2024, the AEPD found that the controller had breached the data minimisation principle under Article 5(1)(c) GDPR and for this issued a fine of €10,000. The AEPD stated that anonymization techniques should have been implemented which would have blurred the image or distorted the voice of the data subject.

In response to this, the controller again submitted that GDPR protections cannot reasonably be applied in this case due to press freedom. As the video of the data subject had gone viral before the controller published their article, the data subject was already a person in the public interest. The controller further submitted that the article could not be understood without showing the content of the video including the audio.

Holding

The AEPD rejected the argument that the data subject was a person of public interest. It set out that the video had gone viral due to the actions of third parties without the consent or involvement of the data subject.

The AEPD also rejected the argument that the disclosure of the video was necessary in order to prove why the article was newsworthy. It explained that this could still be understood with the appropriate anonymization techniques in place. The AEPD further analysed that although the loss of control experienced by the data subject occurred upon the popularisation of the video on Twitter, this did not preclude any wrongdoing by the controller.

The fact that the controller is a media provider, according to the AEPD, does not diminish the obligations set out by the GDPR. In fact, the AEPD highlights that as a media outlet, the controller should have taken proactive care in assessing the risk to the data subject in accordance with Article 5(2) GDPR. The AEPD clarified that the controller should have chosen not to disseminate the video when weighing up the public interest against the interest of the data subject.

In conclusion, the AEPD reiterated its assessment of the 15 April 2024 for a breach of Article 5(1)(c) GDPR including an administrative fine of €10,000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/29

 File No.: EXP202309208

RESOLUTION ON APPEAL FOR REPOSITION

Having examined the appeal for reconsideration filed by EL LEÓN DE EL ESPAÑOL
PUBLICACIONES, S.A. against the resolution issued by the Director of the Spanish Data
Protection Agency dated June 19, 2024, and based on the
following
FACTS

FIRST: On June 19, 2024, the Director of the Spanish Data
Protection Agency issued a resolution in file EXP202309208, by virtue of which

EL LEÓN DE EL ESPAÑOL PUBLICACIONES, S.A. (hereinafter
EL ESPAÑOL or the appellant) was fined the following:

. For a violation of article 5.1.c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter RGPD), classified in 83.5 of the aforementioned RGPD, and classified as very serious for the purposes of prescription in article 72.1.a) of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter,

LOPDGDD), a fine of 10,000 euros (ten thousand euros).

In the same resolution, it was agreed to elevate to definitive the order for the adoption of measures
agreed on 09/09/2022, during the preliminary investigation proceedings, and
confirmed in the agreement to open the present sanctioning procedure, which
had been attended to by the entity EL ESPAÑOL by definitively withdrawing the content

subject to the proceedings.

Said resolution, which was notified to the appellant on June 20, 2024,
was issued prior to the processing of the corresponding sanctioning procedure,
in accordance with the provisions of the LOPDGDD, and additionally in Law 39/2015,

of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), regarding the processing of sanctioning
procedures.

SECOND: As proven facts of the aforementioned sanctioning procedure,

PS/00335/2023, the following were recorded:

<<FIRST: On ***DATE.1, a user of the social network “Twitter” published on
his profile a video consisting of a montage of successive shots (…). The image and
voice of the complainant could be clearly seen in said recording.

SECOND: The complainant has declared that the publication of the video mentioned
in the First Proven Fact was carried out without his consent.

THIRD: On ***DATE.2, the entity EL ESPAÑOL published on its website

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/29

“elespanol.com” a news item about the dissemination on social networks of the video mentioned
in the First Proven Fact. This news, which was accessible through the
URL (“***URL.1”) included an image of the complaining party captured from that video

and the following text:

<<(photograph captured from the video, which corresponds to an image of the
complaining party, with the caption “(...))

“(...)”.

FOURTH: On 09/14/2022, in compliance with the provisional measure adopted
by the AEPD, EL ESPAÑOL withdrew the news item mentioned in the Third Proven Fact,
preventing its access both externally and through the newspaper's internal search engine.

FIFTH: The Inspection Services of the AEPD have confirmed that the video
reviewed in the First Proven Fact went viral after its publication on ***DATE.1
on Twitter. Due to this wide dissemination, it could be found on dozens of sites and
easily located with a search engine using tags such as "(...)" or
"(...)".>>

THIRD: On 07/19/2024, within the established period, EL ESPAÑOL filed
an appeal for reconsideration against the resolution described in the
First Background, dated 06/19/2024, in which it highlights the same
circumstances and considerations included in the allegations made during the

processing of the procedure that gave rise to the contested resolution and requests that the
annulment of the sanctioning resolution be determined or, alternatively, that the amount of the fine imposed be
reduced.

From the above in the appeal filed, the following statements should be highlighted:

1. Obligations of EL ESPAÑOL as the data controller.

The company does not deny the application of the personal data protection regulations to its activity, as demonstrated by the actions it has been carrying out with the aim of guaranteeing the rights of the interested parties, but it maintains that the principles contained in article 5 of the GDPR must be applied in a flexible manner, given the nature of its profession and the importance of the media for the development of a free and plural society. This often requires the publication of personal data that are necessary to provide complete, contextualized and public interest information, in proportion to the right to freedom of information.

In the event of a news event, the principles of data protection may be limited and weighed, making it advisable to distinguish the interpretation of the regulation when the exercise of constitutional rights comes into play as a core element of the conduct investigated versus when the entity acts as any other profit-making organization.

The constitutional definition of the right to freedom of information must be respected

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/29

and its legitimizing requirements, as reflected by the legislator by including in
Recitals 4 and 153, as well as Article 85, of the GDPR, the possibility of including
exceptions to the data protection regulations when processing is carried out

for exclusively journalistic purposes, since such activity entails greater
exposure to carrying out processing that may affect the rights of the
interested parties.

It is a common fact that freedom of expression and information reaches its
highest level when it is exercised by information professionals (STC

165/1987), while the sanctioning resolution qualifies the conduct in this case
as imprudent, demanding a higher degree of diligence by the professionalism of the subject, basing itself on a sentence of the National Court issued in a
case of inclusion of personal data in the Asnef file.

Therefore, EL ESPAÑOL understands that the analysis should be carried out by analysing whether
the legitimising requirements of the right exercised are met and not whether there is a
legal provision in the void to which to attach an infringement that ignores the
necessary weighing in light of the facts proven in the conduct of the
complainant, its informative relevance.

The imposition of a sanction may restrict the exercise of a constitutional right
when its legitimising requirements are met.

The court adds that the strict interpretation of the principle of data minimization subjects the
information activity to diffuse contours that would impose on the media obligations that are
impossible to execute.

It does not deny the necessary prior analysis of the news to be published, but considers
the performance of a risk analysis in the terms established in the data protection regulations to be
disproportionate, when the resolution issued does not include
the analysis of the requirements of relevance, public interest and veracity. Thus, it highlights
that the video is true, was disseminated for promotional purposes and went viral. Therefore,
it considers that the risk analysis must be carried out in compliance with the
constitutional requirements that authorize the right exercised and not as the
contested resolution maintains.

Furthermore, the measure set forth in the resolution is disproportionate in terms of
costs and, therefore, contrary to the provisions of article 32 of the RGPD.

“Clearly, all news is previously analyzed, in order to determine its public relevance and informative interest and this cannot be confused, as the AEPD seems to do, with a judgment in which, ignoring the former, the analysis is based on a regulation that, by decisively affecting a constitutional right, must be subject to the concurrence of its legitimizing requirements, and not the other way around.”

2. Relevance of the personal data published

The sanctioning resolution affirms, with respect to the criteria of public relevance,
general interest and veracity, that they are related to the right regulated by the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/29

Organic Law 1/1982, of May 5. However, these criteria have been
considered by the AEPD itself, as enabling the right invoked
(Resolution E/03409/2018).

A) The interested party's status as a public figure.

The viralization of the video in question, which had already occurred when the news was published,
eliminates the interested party's status as an "anonymous individual."

This is a situation that refers to the concept of supervening relevance, already
alluded to in the allegations to the proposed resolution, together with various judicial
resolutions that determine the existence of legitimacy for the publication of the
image of an anonymous person; both criteria are not mentioned in the
sanctioning resolution.

On the other hand, it insists on pointing out that it is not understood that the sanctioning resolution
maintains that it is not possible to prove the participation of the claimant in the
viralization of the video.

B) Need for the use and dissemination of the image and voice of the interested party

EL ESPAÑOL appreciates a change of criteria that supposes a constitutional breach
as it implies a control of informative content from the administrative sphere.

The precedent E/03409/2018, of resolution of archiving of proceedings, already cited in the

written allegations to the proposed resolution, already warns that the administrative
control over the contents of the information published by the media is incompatible with our constitutional system.

However, the contested resolution declares that the published information

did not require the use and dissemination of personal data and that keeping the image and voice
without anonymizing does not add any added value to the information.

The resolution thus makes assessments about the proportionality of the personal data published and its informative value, assessing that the news would have the same journalistic interest if this anonymization had been carried out. EL

ESPAÑOL considers that this is contrary to the principle of legality and to the provisions of the
archiving resolution cited.

Contrary to what is stated in the contested resolution, the process of anonymizing the
video would distort the content itself and its informative interest, preventing the reader

of EL ESPAÑOL from obtaining contextualized information. The news precisely describes the video itself and the reactions of the users, which would have
no value if the reader were not aware of the video (…).

It invokes article 3 of the Civil Code to indicate that the interpretation of the rule

must be carried out in relation to the moment in which it must be applied and the prevailing social
conditions.

In summary, in the opinion of EL ESPAÑOL, anonymization would limit the right to

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/29

freedom of information.

C) Accessoriness of images. Violation of article 32

Although related to the right to honor, privacy and one's own image, the concept of
accessoriness must be assessed when applying the data protection regulations, as it
implies a limitation of the right to image, of constitutional rank, which cannot
be ignored in the weighing of rights to be carried out.

It cites Supreme Court Ruling 241/2003, of March 14, to point out that
accessoriness protects that the images that accompany a news item have a direct
relationship with it or, in other words, that the personal data that illustrate the
information are necessary to describe in images the public conduct referred to.
Based on this, EL ESPAÑOL understands that there is an analogical relationship between

accessoriness and the minimization of data associated with the informative material.

The video in question meets this requirement, not because the person in question appears,
but because it is the video that was essentially the informative object, not being possible
to understand the news without the publication of the video.

In this regard, it refers to what is indicated in its written allegations, on the
relationship of the present case with the one analyzed in the Supreme Court Judgment
593/2022, of July 28, regarding the publication by a media outlet of a
video uploaded to YouTube with the consent of the actor, the images being necessary
to contextualize the reader.

In this case, the video was initially uploaded to social networks with the consent of the
complainant, where it was accessible to all users, and this video is the
central object of the news.

3. Determination of the amount of the sanction.

Regarding this issue, EL ESPAÑOL reiterates the following:

. It is not possible to accept the existence of negligence in the publication of personal data justified by the informative interest of the same, without which the news

would be meaningless and incomplete, and it must also be considered the activity carried out by a media outlet and that two fundamental rights are in conflict, the weighting of which is controversial.

. With the withdrawal of the news item, the purpose of the claim was achieved, insofar as it was to prevent further dissemination of a video that was already viral, so that the rights of the interested party have already been protected.

FUNDAMENTALS OF LAW

I
Jurisdiction

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/29

The Director of the Spanish Data Protection Agency is competent to resolve this appeal, in accordance with the provisions of article 123 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP) and article 48.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, LOPDGDD).

II

Response to the allegations presented

In relation to the statements made by the appellant, which
basically reproduce the allegations presented by it during the
processing of the sanctioning procedure, without adding any new arguments, it should

be noted that they were already analyzed and rejected in Legal Grounds II
to VII of the contested Resolution, dated 06/19/2024, in which it is considered that it
failed to comply with the provisions of article 5.1.c) of the GDPR and the assessment of the evidence that has made it possible to determine said
breach and the scope granted to it, as well as the circumstances taken into account
for the graduation of the sanction imposed, are sufficiently detailed. In said Legal Grounds

the following is indicated:
<<II
Response to the allegations to the proposed resolution

1. Obligations of a media outlet as data controller.

Requirements for the publication of personal data by the media.

EL ESPAÑOL begins its written submission to the proposed resolution by
emphasizing that the personal data protection regulations are limited

in relation to the exercise of journalism, due to the essential position that the right to freedom of expression and information
acquires for society, and that the jurisprudence grants information professionals
specific protection as they are subject to greater risks (STC 225/2009, of December 9).

It goes on to indicate that, on the contrary, the proposed resolution implies

that the obligations of EL ESPAÑOL as the data controller are
expanded from the moment that its activity is based on the exercise of
journalism, stating that it is especially obliged to consider the risks that
the dissemination of images and voice through a media outlet entails; or that
it should have been considered whether the purpose of the information required the dissemination of the

image and voice of the complaining party; or the obligation to carry out a risk analysis
prior to the publication of the news.

This Agency does not deny that the fundamental right to the protection of personal

data, like all rights, is limited by other fundamental rights, in this case by freedom of expression and

information. It is this circumstance that requires, in each specific case, to weigh or reconcile the rights in conflict.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/29

This is precisely what is stated in Recitals 4 and 153 and Article 85 of the GDPR
invoked by EL ESPAÑOL when they point out that the right to the protection of personal data is not an absolute right, but must maintain a balance with other

fundamental rights, such as freedom of expression and information, including journalistic
expression. To such an extent that Recital 153 and Article 85 of the
RGPD not only oblige Member States to reconcile the rules governing these
other rights with the right to the protection of personal data under the
RGPD, but also to adopt legislative measures establishing exceptions or
exemptions from certain provisions of said Regulation in relation to the

issues listed in these provisions, including the general principles, if this is required to reconcile such rights.

This Agency does, however, categorically deny that the right to freedom of
information limits the right to data protection in the sense intended by EL

ESPAÑOL, which amounts to stating that the rules on the protection of personal data
do not apply when data processing is carried out within the framework of
journalistic activity, due to the subject. It goes so far as to say that it does not consider
it necessary to carry out a prior analysis of all the news to be published.

The arguments defended in this act are considered appropriate and pertinent, and

reproduce those assessed in the resolution proposal, when it is stated that the
media must take into account the risks involved in the
processing of data that they carry out when disseminating news and that they are obliged to
pay special attention and to establish the necessary safeguards to
comply with the rules provided for respecting the right to the protection of

personal data.

Special consideration is given to the professionalism attributed to the media, recognized by our jurisprudence, in order to establish a higher level of diligence in compliance with the law. In this regard, the National Court's Judgment of 17/10/2007 (rec. 63/2006) declared that, based on the fact that these are entities whose activity involves continuous data processing, "...
the Supreme Court has understood that there is imprudence whenever a legal duty of care is ignored, that is, when the offender does not behave with the required diligence. And in assessing the degree of diligence, the professionalism or lack thereof of the subject must be
especially considered, and there is no doubt that, in the case

now examined, when the activity of the appellant is one of constant and
abundant handling of personal data, the rigor and exquisite care
in complying with the legal provisions in this regard must be insisted upon."

In any case, it is not the AEPD, as EL ESPAÑOL points out, that demands this

special responsibility, but rather it is the applicable rule itself that assesses
circumstances such as risk or professionalism, already indicated, the context or the
state of the art, among others.

Accepting the position of EL ESPAÑOL would be tantamount to emptying the right to data protection of content simply because the processing is carried out by an institutionalized media outlet or by an information professional, since there is no economic or human reason that motivates the non-application of the rule to an obliged subject, nor the lack of legal knowledge of these professionals

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/29

that can prevent their activity from being subject to the provisions of the RGPD and the
LOPDGDD. Nor can we speak of self-censorship as a consequence of the
application of the rule, but rather of compliance with a generally applicable rule, which

also obliges the media and their professionals.

Until such legislative measures are adopted that define the exceptions or
exemptions referred to in article 85 of the GDPR, the limits in the application of
this Regulation and the LOPDGDD, must be set taking into account the normative provisions and
interpretative criteria that are applicable in each case to

carry out the indicated weighing or reconciliation of the rights in conflict.

And among these criteria, those indicated by the entity complained of, such as the
public relevance of the interested party or his participation in the newsworthy event, the veracity of what is published or its informative interest. But without forgetting, as a
priority, the principles and rules to which the processing of personal data is subject according to its own regulatory standards.

This same act resorts to those interpretative criteria to analyze the case and
conclude the infringement, having considered, as will be explained later, that there was
no informative interest in the dissemination of the personal data of the
complainant and that this is an anonymous person. But, above all, it applies the
principle of data minimization regulated in article 5.1.c) of the GDPR and assesses the
context in which the data processing occurs, its purpose and proportionality
with respect to the purpose pursued, all in accordance with the rules that regulate the protection
of personal data.

The aforementioned criteria, which EL ESPAÑOL refers to as requirements for the
publication of personal data by the media, are more closely related
to the right to honour, personal and family privacy and one's own image, regulated by Organic Law 1/1982, of May 5, whose articles 7 and 8

establish the actions that are considered illegitimate intrusions into the scope of protection delimited by this law.

The analysis of this regulation responds to the criteria alleged by EL ESPAÑOL,
on which there is abundant jurisprudence, which can be used when dealing with aspects of interest to decide a question regarding data protection,
to the extent that both rights protect the intimacy and privacy of individuals, but always bearing in mind that these are criteria that serve to
guide and inform about the aspect in question and whose application must yield
to the principles included in the data protection regulations when a case related to this matter is
judged. In short, the circumstances alleged

by EL ESPAÑOL cannot be the only ones assessed, such that the
personal data protection regulations that are applicable are excluded.

On the other hand, having taken into account the general consideration above, as regards the “requirements”
mentioned by EL ESPAÑOL, the following should be noted on the contrary:

a) The complainant is an anonymous individual and this condition is not modified
by the fact that the audiovisual content published by EL ESPAÑOL had gone
viral on social networks, a consequence of the action of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/29

third parties without the accredited intervention of the complainant.

b) The veracity and timeliness of the published information do not influence, from the

point of view of data protection, the appropriate use and dissemination of the image of the
complainant. The respondent claims that the news would not be adequately understood without the video, but does not explain how the disclosure of this content would affect the news after having been subjected to an anonymization process, as defended in this act, nor why this anonymization would make it lose journalistic interest and collide with the right to freedom of information.

2. Regarding the determination of the amount of the proposed fine.

For the same reasons stated above, the request for a reduction in the amount of the fine requested by EL ESPAÑOL should be rejected based on the condition

of the offender, taking into account the protection of information professionals and
the social work carried out by the media outlet, and on the other hand, that the informative content of the news would have been void with the anonymization of the
video.

The Agency adds that the loss of control over personal data

had already occurred at the time of publication of the news, with the dissemination of the
video on social networks and its viralization. This circumstance does not exclude the
action of EL ESPAÑOL from having this effect and thus can be considered when assessing the
seriousness of the infringement.

Finally, the respondent party considers that the fact that the news was withdrawn as soon as it was requested by the AEPD is considered as an attenuating circumstance. It cites as an example
the resolution issued in file E/02643/2018, in which the archiving of the proceedings was resolved, considering that the purpose of the claim had been
satisfied.

This Agency understands that these are not comparable cases. In the present case, the
withdrawal of the content that is the subject of the complaint was ordered by this Agency as a
provisional measure, so that compliance with the respective requirement is not
considered an attenuating factor in the grading of the sanction.

3. The link that is the subject of the complaint has been completely removed, so that
it is not even accessible through EL ESPAÑOL's internal systems.

As indicated in the Grounds that follow, with the removal of the video EL
ESPAÑOL is simply complying with the regulations and complying with the resolutions of

this supervisory authority, which are mandatory, so that said removal
does not serve to modify its responsibility for the facts analyzed.

III
The image and voice as personal data and other preliminary issues

The physical image and voice of a person, according to article 4.1 of the GDPR, are
personal data as they make them identifiable, and their protection, therefore, is the subject of said
GDPR:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/29

“«personal data»: any information relating to an identified or
identifiable natural person («the data subject»); an identifiable natural person shall be considered to be any person
whose identity can be determined, directly or indirectly, in particular by
regarding an identifier such as a name, an identification number, location data, an online
identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person;”

Report 139/2017 of the Legal Office of this Agency states that “the image as well as the voice of a person is personal data, as is any information that allows determining, directly or indirectly, their identity (…)”

The physical image and voice of a person, according to article 4.1 of the GDPR, are personal data and their protection, therefore, is the subject of said Regulation.

Therefore, the processing of the image and voice of a person is subject to data protection regulations. Article 4.2 of the GDPR defines the concept of “processing” of personal data.

“any operation or set of operations performed on personal data or on
sets of personal data, whether or not by automated means, such as
collection, recording, organisation, structuring, storage, adaptation or
alteration, retrieval, consultation, use, disclosure by transmission, dissemination or
otherwise making available, alignment or combination, restriction,
deletion or destruction.”

The ECJ (Second Chamber) of 14 February 2019, in Case C 345/17, Sergejs Buivids, stated the following in this regard:

“The publication, on a video website where users can send, view and share videos, of an audio recording, such as the one at issue, containing personal data, may be considered to constitute fully or partially automated processing of those data, within the meaning of Articles 2(b) and 3(1) of Directive 95/46.”

Furthermore, it is important to note that individuals have the power to dispose of their personal data, as well as to disseminate them.

Thus, STC 292/2000, of 30 November, states that “the content of the fundamental right to data protection consists of a power of disposition and control over personal data that empowers the person to decide which of these data to provide to a third party, be it the State or an individual, or which this third party may collect, and which also allows the individual to know who possesses these personal data and for what purpose, being able to oppose such possession or use. These powers of disposition and control over personal data, which constitute part of the content of the fundamental right to data protection, are legally specified in the power to consent to the collection, obtaining and access to personal data, its subsequent storage and processing, as well as its use or possible uses, by a third party, be it the State or an individual. And this right to consent to the knowledge and processing, whether computerized or not, of personal data, requires, as essential complements,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/29

on the one hand, the ability to know at all times who has
that personal data and to what use it is being subjected, and, on the other hand, the power
to oppose that possession and uses.”

IV
Unfulfilled obligation

The inclusion of the image of a person or a video containing their image and their
voice in journalistic publications, in conditions such that it identifies them or makes them
identifiable (without applying any technique to them that prevents their

identification), in this case, in addition, together with their name, implies a processing of
personal data. Therefore, the entity that carries out this processing is obliged to
comply with the principles and obligations regarding data protection that are provided for the
data controller in the GDPR and the LOPDGDD.

These principles and obligations do not decline if we are dealing with a data controller that is a media outlet.

Furthermore, the responsible entity is especially obliged to consider that the
dissemination through a media outlet of the image and voice of the complaining party and their name, enabling their identification by third parties, implies a greater

risk for the interested party, making it very likely that they may suffer damage to their
rights and freedoms. Therefore, they must take extreme caution so that it cannot be concluded that said data processing is not proportional or necessary in relation
to the information purposes pursued.

Thus, in general, the principle of proactive responsibility established in article 5.2 of the GDPR, the assessment of risks and the
implementation of appropriate security measures must be taken into account. Obligations that are even
more relevant when the risk is particularly sensitive.

In this regard, and regardless of the legal basis legitimizing the
processing, all data controllers must respect the principles of
processing set out in article 5 of the GDPR. In what concerns the present case,
it is worth highlighting the principle of “data minimisation” set out in article 5.1.c) of the
GDPR, which establishes the following:

“1. Personal data shall be

c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are
processed («data minimisation»);”

It is understood that the processing of personal data must be limited to what is necessary
to achieve the objective, that is, when the purpose cannot be reasonably
achieved without the processing of such personal data.

It is thus related to the principle of limitation of the purpose of article 5.1.b) of

the GDPR, and only leads to precise results if the specific purpose is well
defined by the data controller and is linked to the proportionality and
necessity of such processing.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/29

The relevance of the data refers to its essentiality to obtain the result,
and the options offered to the controller must be reviewed to adapt to this
principle in each processing operation.

When the responsible entity is a media outlet, it must bear in mind the
cited principle of minimisation of personal data whenever it plans to
use personal data in a journalistic article.

The present procedure is initiated because the entity EL ESPAÑOL published, on the website

“elespanol.com”, a news item about the dissemination of videos on social networks, in
which the text referred to the name of the complainant (“(...)”) and was illustrated
with a photograph of the complainant, taken from a video that was
published and widely disseminated through the social network “Twitter”. The image of the
complainant was clearly visible in said photograph.

In the same article, links are inserted that lead to the video in question, in which
the image and voice of the complainant are also clearly shown, which
were not duly anonymized using any appropriate technique for this.

According to the First Proven Fact, the video consists of a

montage of successive shots (...).

The news item published by EL ESPAÑOL refers to this specific video. This is information published on ***DATE.2 on the website “elespanol.com” accompanied by the
repeated video and a screenshot taken from it (it includes a link to the

publication of the video on “Twitter”, in the profile corresponding to the user
“***USER.1”, “***USER.1”, with the text “(...)”, the indications “(...)”, and a
button to share the content).

In this article, EL ESPAÑOL reports on (i) the content of the video, highlighting

some of the dialogues that take place between the people who appear in it; (ii) its wide diffusion on social networks, which it considers to be produced by its
fun nature; and (iii) the thousands of comments to which it has given rise, some of which
are transcribed in the same article.

EL ESPAÑOL should have considered whether the purpose of the information required the

dissemination of the image and voice of the complainant contained in the video in question
without having applied any anonymization process to it, or whether the indication
of the name in the text of the published article was really necessary for the intended
purpose; or whether this purpose, on the contrary, was perfectly achievable without the
identification of the owner of the personal data.

This Agency understands that the information that EL ESPAÑOL intended to make available to the
general public did not require this use and dissemination of the personal data of the
complainant. Based on this, it appears that personal data has been processed
in clear violation of the principle of data minimization.

This conclusion is not shared by EL ESPAÑOL. This entity, in its
allegations at the opening of this procedure, does not dispute the processing of
personal data carried out, but it does dispute the fact that this may be considered

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/29

constituting an infringement and, therefore, subject to sanction.

Firstly, the respondent entity points out that the video in question was disseminated

a month earlier (…), which was also the subject of journalistic attention in other media.

EL ESPAÑOL implies that the dissemination of this content through the Internet was
intentional and that with this dissemination the complainant achieved “the apparent
desired purpose”.

Likewise, it highlights that the video, in which the complainant himself refers to his

name or nickname “(...)”, became a trend on different platforms and social networks with
massive following (Twitter, Youtube, Tik Tok), being commented and
shared by thousands of users, and continues to be visible through thousands of links that can be accessed
through a search engine with the indicated nickname
as a criterion. Based on this, it considers that the loss of disposition and control of the
personal data of the interested party took place prior to the publication that has
given rise to the present proceedings and not as a consequence of it, an issue
that EL ESPAÑOL considers essential to determine its responsibility. In this
regard, it points out that the viralization of content is a joint result of the
actions and reactions of online users, so it cannot be attributed
directly or exclusively to EL ESPAÑOL.

Furthermore, in relation to the principle of data minimisation and its
consideration in the present case, EL ESPAÑOL claims that the data used in the
published news item were manifestly public and that no technical means were used
to prevent the recognition of the image, because the video in question was not

originally uploaded or hosted by that party, but rather the technique of
transclusion was used, which refers to the inclusion of a video or document from another website
by inserting the corresponding code on the EL ESPAÑOL website.

However, these circumstances, even if they were all taken as true, do

not modify EL ESPAÑOL's responsibility for the facts analysed, since
none of them excuses compliance with the data protection regulations by
that entity from the moment it decides to collect and
use the data in question. Nor does the fact that there may be possible
responsibilities of other third parties, other sanctionable conduct, exempt that entity from
responsibility.

The existence of possible previous breaches by third parties does not exempt the media from
the obligation to carry out a risk analysis prior to the publication of the
news. EL ESPAÑOL, as a media outlet and as the data controller,
decide what and how to publish. It could decide to publish the video as is,

choose not to publish it or decide to distort the image and voice of the complaining party
in order to prevent it from being recognizable by third parties.

Any processing operation carried out within the scope of the complained party
(in this case the dissemination of personal data on the occasion of the news) must

be attributed solely to it, regardless of the processing operations that have been previously
carried out by other subjects and which, in no case, exempt it from its
responsibility. The media, as those responsible for the processing of
the various data that they become aware of in the course of their journalistic work, must

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/29

know and comply with the regulations on data protection, applying, among
them, the principle of data minimisation enshrined in article 5.1.c) of the GDPR.

It should also be noted that EL ESPAÑOL was not certain that the video
had been intentionally disseminated by the complainant itself, given that it was taken
from an unidentified user of the social network “Twitter”.

Even if such intentional dissemination had occurred, it cannot be interpreted
in the sense intended by EL ESPAÑOL in its allegations. In cases such as

this, it is only the interested party who must decide on the use of his or her personal data,
as has been explained, and this does not change because the personal data
is accessible through the Internet, regardless of its origin.

In Judgment No. 91/2017, dated 15/02/2017, the Supreme Court
has ruled on a case in which the defendant (media outlet) used a photograph taken from the plaintiff's Facebook
profile to illustrate a news item published in the paper edition of a newspaper. In this
Judgment, it is considered that the right to information legitimizes the action of the
media outlet, which provides truthful information about facts or

people of public relevance, relevance that is attributed to information about facts of criminal
significance. However, regarding the use of that photograph,
it states the following

“The fact that the owner of the profile has

“uploaded” a photograph of himself in the account opened on a social network on the Internet, which is accessible to the general public, does not authorize a
third party to reproduce it in a media outlet without the consent of the owner,
because such action cannot be considered a natural consequence of the accessible nature of the data and images in a public profile of a social network on the Internet.
The purpose of an account opened on a social network on the Internet is the communication of

its owner with third parties and the possibility that these third parties may have access to the
content of that account and interact with its owner, but not that the image of the account owner may be published in a media outlet.

The consent of the owner of the image for the general public, or a certain number of people, to view his or her photograph on a blog or an account opened on a social network website does not imply authorization to use that photograph and publish or disseminate it in a different way…”

“The requirement to protect the right to information cannot mean that the fundamental rights of those affected by the exercise of that right are left empty of content, which should only be sacrificed to the extent necessary to ensure free information in a democratic society, as established in
art. 10.2 of the European Convention on Human Rights (SSTC 171/1990, of November 12, FJ 5, and 121/2002, of May 20, FJ 4). And the public interest that the violent event aroused and that justified the defendant's newspaper reporting on it,

even with identification of those affected by the event, did not require or
justify the publication of the image of the victim of the event, obtained from his profile on a social network,
without his express consent."

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 15/29

Likewise, the technique used to capture or distribute the video is not influential.

In this regard, EL ESPAÑOL has stated that the video in question was not
originally uploaded or hosted by that party, but rather the technique of

transclusion was used, which refers to the inclusion of a video or document from another website
by inserting the corresponding code on the EL ESPAÑOL website.

On this issue, it should be noted, on the one hand, that the published news item not only included
the link that allowed access to the video on another website, but the news item was illustrated
with a photograph of the complaining party taken from said video. On the other hand, it is

necessary to bear in mind that the inclusion of these links constitutes a processing of
personal data, in accordance with the definition of processing established in article 4
of the GDPR, which considers as such any operation or set of operations
carried out on personal data such as “communication by transmission, diffusion or
any other form of enabling access, comparison or interconnection”.

Regarding the use of this transclusion technique, EL ESPAÑOL also points out that
the content is not transferred to a new public nor is it disclosed through a specific
technique different from the original communication, as interpreted by the Court of Justice of the
European Union in the Judgment of 13/02/2014, issued in case C-
466/12 (known as the Svensson Case).

However, this Judgment addresses issues relating to intellectual
property, so that the interpretations it makes, regarding the consequences that arise from the
inclusion in an Internet site of links that lead to
content protected by rights of that nature hosted on other sites, are not

transferable to the present case. In any case, from what is stated in this
Judgment in relation to the use of these links, it is interesting to
highlight the following:

“20. It follows from the above that, in circumstances such as those of the main proceedings, the

fact of providing clickable links leading to protected works must be classified as "making available" and, consequently, as an "act of
communication" within the meaning of the aforementioned provision."

In another order, the respondent entity indicates in its allegations that it has demonstrated its
proactivity by immediately complying with the provisional measure ordered by this

AEPD, eliminating the video and all the content of the publication. However, this
action, with which EL ESPAÑOL simply complies with the regulations and
observes the resolutions of this supervisory authority, which are mandatory,
cannot serve to modify its responsibility for the facts analyzed.

V
Fundamental right to freedom of information

EL ESPAÑOL, in its allegations, states that the popularization of the video
became a topic of public and journalistic interest, as a cultural

phenomenon and for its social impact, motivating its sole intention to inform readers,
without compromising the privacy or dignity of the complainant and without
delving into his personal life or sensitive personal aspects and without making any
type of value judgment.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 16/29

It adds that the focus of the published article was centered on the popularity and
social implications of that trend on networks, providing readers with
current and relevant information, in compliance with the work of the media
media.

Proof of this, according to EL ESPAÑOL, is the fact that other media also
echoed the same trend.

It also considers that the image and name of the complaining party are
central elements of the newsworthy event, in the context of the information that is

intended to be disseminated, without this implying an overstepping of the right to
freedom of information.

On the other hand, it is noteworthy that the jurisprudence cited by this Agency to support a
data processing that may be considered excessive has focused on

image reproductions in criminal contexts, in which the courts have
held that the images in question lack relevance to the information to be
transmitted.

However, in the present case, as we will explain, the processing carried
out by EL ESPAÑOL within the framework of freedom of information has been excessive, as

there is no public information interest in the dissemination of the image and voice of the
complainant, with indication of his name. Keeping said image and voice without
anonymizing (without blurring the image and without distorting the voice, for example) does
not provide any added value to the information, under which pretext it seems that those data have been
disclosed, which make the person clearly identifiable, even more so if the name is
specified.

When weighing up the conflicting interests and taking into account the circumstances of this case, that is, the particularly sensitive nature of personal data and the impact on the privacy of the person (the complainant), the interest of the holder of the right to the protection of his or her personal data and to not have it disclosed deserves greater protection compared to the alleged public interest in its disclosure.

It is true that we are dealing with a fundamental right, that of the protection of personal data, which is not absolute, since if necessary it may give way to the prevalence of other rights and freedoms that are also constitutionally recognized and protected, such as, for example, the fundamental right to freedom of information, which must be weighed on a case-by-case basis.

In the conflict between the fundamental rights to freedom of information in relation to the fundamental right to the protection of personal data, even when
an equal degree of protection of both constitutional rights is recognized,
ordinarily the former is usually given precedence by our courts, after

assessing and weighing up all the elements at stake.

However, precedence does not mean precedence when, taking into account all the
circumstances concurrent in a specific case, the limits set by law and
jurisprudence are exceeded.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 17/29

In this regard, the Article 29 Working Party in its Opinion 06/2014 on the
concept of legitimate interest of the data controller under

Article 7 of Directive 95/46/EC, when examining the legal basis of the legitimate interest of
Article 7.1.f) of Directive 95/46/EC, fully transferable to the current art. 6.1.f) of the
RGPD, includes the right to freedom of expression or information as one of the
cases in which the question of legitimate interest may arise, asserting that “without
prejudice to whether the interests of the data controller will ultimately
prevail over the interests and rights of the data subjects when the
balancing test is carried out”.

Limits to the Fundamental Right to Freedom of Information.

Having said that, the fundamental right to freedom of information is not

absolute either. We can observe very clear limits established by the courts in the
civil sphere, in relation to the right to honour, personal and family privacy and
one's own image.

Thus, we will cite, for all, the STC 27/2020, of February 24, 2020 (appeal for protection 1369-2017) which provides, in relation to the image of a person, and

based on the undisputed fact that it makes it identifiable, that “…the question
in debate is reduced to considering whether the non-consensual reproduction of the image of an
anonymous person, that is, of someone who is not a public figure, but who
suddenly and involuntarily acquires a role in the newsworthy event, in this case as
a victim of the failed attempt at murder by his brother and the subsequent suicide

of the latter, constituted an illegitimate intrusion into his fundamental right to his own
image (art. 18.1 CE).

[…]

…that criminal events are newsworthy events, even
regardless of the private subject status of the person affected by the news. However, the limit is the individualization, direct or indirect, of the victim, since
this information is not of public interest because it lacks relevance to the information
that is allowed to be transmitted (STC 20/1992, of February 20; 219/1992, of December 3; 232/1993, of July 12; 52/2002, of February 25; 121/2002, of May 20, and 127/2003, of June 30). This is currently recognised by Law 4/2015, of 27 April, on the status of victims of crime, in force since 28 October 2015,
when it warns of the need "from the public authorities [to offer] the broadest possible response, not only legal but also social, to victims,
not only repairing the damage in the framework of a criminal process, but also

minimising other traumatic effects on the moral level that their condition may generate, all this regardless of their procedural situation. Therefore, this
Statute, in line with European regulations on the matter and with the demands that
our society raises, aims, based on the recognition of the dignity of the
victims, to defend their material and moral assets and, with it, those of

society as a whole". In cases such as those raised in this appeal, this Court must
give importance to the prevalence of the right to the image of the victim of the crime
over the freedom of information, since the graphic information became unnecessary or
superfluous because the photograph of the victim lacked real interest for the transmission of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 18/29

the information, in this case the apparent commission of a homicide and subsequent
suicide” (emphasis added).

We will add the STS, of its First Civil Chamber, 272/2011 of April 11, 2011
(rec. 1747/2008), in which, regarding the data necessary to provide information and the limits of the public interest, it states that “b) Trivial information is not
protected (ATC 75/2006), but the fact of providing data that is not necessary in a case of
rape (the full name, the initials of the surnames, the door of the street where the
victim lived) that is not relevant to the community, does not respect confidentiality, only

seeks to satisfy curiosity, causes disturbances or annoyances and unnecessarily reveals aspects of personal and private life, allowing neighbors,
close people and family members to fully identify the victim and to know
in great detail a fact that seriously violates her dignity (STC
185/2002) or about an illness that is not of public interest and affects the victim
in a serious way (STC 185/2002) or about an illness that is not of public interest and affects the victim
in a serious way (STC 185/2002).

directly into the irreducible sphere of privacy and which is revealed for the purpose of a pure
joke or prank (STC 232/1993);”.

Likewise, the STS, of its First Civil Chamber, Judgment 661/2016 of 10 November 2016 (rec. 3318/2014), in relation to the capture and disclosure in court of the image of a victim of gender violence, provided that “1.ª) The

interest of the information in question is not disputed, nor is the right of the defendant television network
to broadcast recorded images during the oral trial of the criminal case, since there is no record of any limitation in this regard agreed by the judicial body.

2.ª) The only controversial point is, therefore, whether the identification of the plaintiff

as a victim of the crimes prosecuted in said criminal case, through close-ups of her face and the mention of her first name and place of residence on 31/03/2022, was also included in the fundamental right of the defendant television channel to transmit truthful information or, on the contrary, was limited by the plaintiff's fundamental rights to her personal privacy and her

own image. 3.ª) Regarding this issue, the jurisprudence has recognized the general interest and
public relevance of information on criminal cases (judgment 547/2011, of 20 July), which is accentuated in cases of physical and psychological abuse (judgments
128/2011, of 1 March, and 547/2011, of 20 July), but it has also pointed out,

as regards the identification of the persons involved in the trial, that the
accused and the victim are not on an equal footing, since as regards
the former, a complete identification is possible, and not only by their initials, due to the
nature and social significance of the crimes of abuse (judgment 547/2011,
of 20 July).

[…]

6.ª) In short, the defendant television channel should have acted with the prudence of a diligent
professional and avoided broadcasting images that represented the
appellant in close-up, either by abstaining from broadcasting the corresponding shots,
or by using technical procedures to blur her features and prevent her
recognition (judgment 311/2013, of May 8). Likewise, he should have also avoided mentioning her first name, because this information, insufficient on its own to

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 19/29

constitute an illegitimate interference, became relevant when it was spoken on screen
simultaneously with the image of the plaintiff and the mention of her place of residence was added, all of which are unnecessary for the essence of the content

of the information, as shown by the news about the same trial published the following day in other media. 7.) The identification of the applicant through her image and the personal data indicated and her direct connection with an episode of gender violence and other serious crimes, when the simultaneous or subsequent disclosure of data referring to how the victim and her aggressor met and the way in which the criminal acts occurred was foreseeable, means that the loss of anonymity violated both the applicant's right to her own image, due to the
disclosure of her physical features, and her personal and family privacy, insofar as confidential data, belonging to her private life (that she used the Internet
to start a relationship or the intimate content of some of her chats), lacking offensive significance in a situation of anonymity, became so from the moment

that any person who saw these news programmes and who lived in the victim's locality could know who they referred to, so that the psychological
damage inherent to her status as a victim of the crimes was added the moral damage
consisting of the fact that details of his private life that he had not consented to
be made public became known.” (emphasis added).

As we can see, there is a clear reference to the excessive processing of
personal data (some of which are not of an intimate nature) to provide the
information, considering them unnecessary at all points in view of the
current circumstances. Sometimes the courts refer to intimate data,
but sometimes they are personal data that are not intimate, such as,

for example, the image of a physical person obtained from a photograph published on a
social network or the name and surname.

. Balance between the fundamental right to freedom of information and the
fundamental right to the protection of personal data.

In the specific case examined, as we have indicated, the entity EL ESPAÑOL
published, on the website referred to in the facts, the image of the complainant to
illustrate a news item about social networks, in which, in addition, his name is mentioned,
inserting links that led to the video that is the subject of the claim that has motivated the
present sanctioning procedure.

Thus, it is not a question, as in other cases examined by jurisprudence, of giving
prevalence to one fundamental right over another, having to choose which has more
weight in a specific case, but rather, of finding a balance between
both to achieve the purpose of the first without distorting the second.

The reconciliation of both rights is nothing new, since the European legislator
mandates such reconciliation in article 85 of the GDPR.

As we have seen previously, the fundamental right to freedom of information
is not unlimited, since the jurisprudential interpretation when comparing it with other

rights and freedoms does not allow in all cases and with all amplitude the same, but,
nevertheless, the prevalence that the courts usually give it can be limited by
other fundamental rights that must also be respected. This is how its limitation is observed when the personal data provided were unnecessary for the essence

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 20/29

of the content of the information.

In this case, the image of the claimant and his voice, as well as his name, without
restricting the provision of information, must be made compatible with the principle of
data minimization, applicable to the form, the medium in which the information is provided and

disseminated due to the immediate impact on personal data and the identification

of the person.

Precisely because the public interest in information is not denied in this
specific case, it is not a question of undermining the fundamental right to freedom of

information due to the prevalence of the fundamental right to the protection of personal

data, but of making them fully compatible so that both are
absolutely guaranteed. That is, the freedom of information of the media is not called into question, but rather the balance with the right to data protection based on the proportionality and necessity of publishing the specific personal data of the image or the name of the person. Such a situation could have been resolved by using technical procedures to prevent the recognition of the image and voice, both security measures applied, depending on the case, in a normal manner by the media, and by not indicating the name of the complaining party.

Furthermore, we must point out that the claimant is an anonymous person and

our Constitutional Court, in accordance with STC 58/2018 of June 4, states that
public authorities, public officials and public figures or those engaged
in activities that involve public notoriety "voluntarily accept the risk that their subjective rights of personality may be affected by adverse criticism, opinions
or revelations and, therefore, the right to information reaches, in relation to
them, its maximum level of legitimizing effectiveness, since their life and moral

conduct participate in the general interest with greater intensity than that of those
private persons who, without a vocation for public projection, are
circumstantially involved in matters of public importance, to whom
therefore, a higher scope of privacy must be recognized, which prevents
granting general importance to facts or conduct that would have it if they were referred
to public figures."

The ECJ (Second Chamber) of 14 February 2019, in Case C 345/17, Sergejs Buivids, refers to various criteria for weighing up the right to respect for privacy and the right to freedom of expression, including “the contribution to a debate of general interest, the notoriety of the person concerned, the subject matter of the report, the previous behaviour of the person concerned, the content, form and impact of the publication, the manner and circumstances in which the information was obtained and its veracity (see, to this effect, the judgment of the ECHR of 27 June 2017, Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland, CE:ECHR:2017:0627JUD000093113, paragraph 165)”.

Thus, a matter may be considered of general interest, of public relevance, not
only by the person involved, but also by the subject matter to which it refers.
Both requirements must be met.

In the present case, (i) the complainant is not a public person; rather, on the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 21/29

the contrary, it is in the interest that it not be recognized by third parties, so that
its fundamental rights are fully guaranteed; That is to say, we are not dealing with a
personality of public relevance, in the sense that such relevance is sufficient to

understand that it implies, ex lege, a dispossession of his fundamental right to the
protection of his personal data, and (ii) although we are dealing with facts “of public
relevance”, in the sense that they are revealed as “necessary” for the exposition of ideas or opinions of public interest, this need does not extend to providing data
that identify the claimant.

Therefore, and as the Supreme Court states in its (civil) judgment 697/2019, of 19
December 2019, the formation of a free public opinion does not require, nor justify,
that the fundamental right to one's own image [in this case to the protection
of personal data] be affected with such gravity and in a way that does not have the necessary
connection with the identification of the person who is the object of the information.

VI
Classification and qualification of the infringement for the purposes of prescription

In accordance with the evidence presented, in the present case, it is considered that
EL ESPAÑOL has processed data that was excessive as it was not necessary for the

purpose for which it was processed.

Thus, the facts established constitute an infringement, attributable to EL
ESPAÑOL, of article 5.1.c) of the GDPR, with the scope expressed in the previous Legal Basis, which implies the commission of the infringement

specified in article 83.5, section a) of the GDPR, which under the heading "General conditions for the imposition of administrative fines" provides that:

"Infringements of the following provisions shall be punishable, in accordance with
section 2, by administrative fines of a maximum of EUR 20,000,000 or,

in the case of a company, an amount equivalent to a maximum of 4% of the total annual global turnover of the previous financial year, whichever is higher:

a) the basic principles for processing, including the conditions for consent pursuant to articles 5, 6, 7 and 9;

In this regard, the LOPDGDD, in its article 71 establishes that “The acts and conduct referred to in sections 4, 5 and 6 of article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this organic law, constitute infringements”.

For the purposes of the limitation period, article 72 of the LOPDGDD indicates:

Article 72. Infringements considered very serious.

“1. Pursuant to the provisions of Article 83.5 of Regulation (EU) 2016/679, infringements that constitute a substantial violation of the articles mentioned therein and, in particular, the following are considered to be very serious and will be subject to a three-year statute of limitations:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 22/29

a) The processing of personal data in violation of the principles and guarantees established in Article 5 of Regulation (EU) 2016/679”.

VII
Sanction

In order to determine the administrative fine to be imposed, the provisions of Articles 83.1 and 83.2 of the GDPR must be observed, which state:

“1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article for infringements of this Regulation referred to in paragraphs 4, 9 and 6 are in each individual case
effective, proportionate and dissuasive.

2. Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or as an alternative to the measures referred to in
Article 58(2)(a) to (h) and (j). When deciding on the imposition of an administrative fine and its amount in each individual case, due account shall be taken of:

(a) the nature, gravity and duration of the infringement, taking into account the

nature, scope or purpose of the processing operation concerned as well as the number of data subjects affected and the level of damage suffered by them;

(b) the intentionality or negligence of the infringement; (c) any measures taken by the controller or processor to

mitigate the damage suffered by data subjects;
(d) the degree of responsibility of the controller or processor,
taking into account any technical or organisational measures they have implemented pursuant
to Articles 25 and 32;
(e) any previous infringement committed by the controller or processor;

(f) the extent of cooperation with the supervisory authority in order to remedy the
breach and mitigate any adverse effects of the infringement;
(g) the categories of personal data affected by the infringement;
(h) the manner in which the supervisory authority became aware of the infringement, in
particular whether and, if so, to what extent the controller or processor notified the infringement;

(i) where measures referred to in Article 58(2) have been previously ordered
against the controller or processor concerned in relation to the same matter, compliance with those measures;
(j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42, and

(k) any other aggravating or mitigating factors applicable to the circumstances of the case,
such as financial benefits obtained or losses avoided, directly or
indirectly, through the infringement.”

With regard to section k) of article 83.2 of the GDPR, the LOPDGDD, article 76,

“Sanctions and corrective measures”, provides:

“1. The sanctions provided for in sections 4, 5 and 6 of article 83 of Regulation

(EU) 2016/679 shall be applied taking into account the grading criteria

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 23/29

established in section 2 of the aforementioned article.

2. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679,

the following may also be taken into account:

a) The continued nature of the infringement.

b) The connection between the offender's activity and the processing of personal data.
c) The benefits obtained as a consequence of the commission of the infringement.

d) The possibility that the conduct of the affected party could have led to the commission of the infringement.

e) The existence of a merger process by absorption after the commission of the infringement, which cannot be attributed to the absorbing entity.
f) The impact on the rights of minors.

g) Having, when not mandatory, a data protection officer.
h) The submission by the responsible party or person in charge, on a voluntary basis, to
alternative dispute resolution mechanisms, in those cases in which
there are disputes between them and any interested party.

In this case, considering the seriousness of the infringement found, taking into account

especially the consequences that its commission causes in the claimant,
the imposition of a fine is appropriate, in addition to the adoption of measures.

The fine imposed must be, in each individual case, effective, proportionate
and dissuasive, in accordance with the provisions of article 83.1 of the GDPR. Thus, the status of medium-sized company and the volume of
business of the party being sued are considered, as a preliminary matter (…).

In accordance with the provisions indicated, for the purposes of setting the amount of the fine to be imposed in the present case, it is considered that it should be graded in accordance with

the following criteria established by the transcribed provisions:

- Article 83.2.a) of the GDPR:

Nature, seriousness and duration of the infringement: the Agency considers that the
nature of the infringement is very serious since it causes the person to lose

control over personal data, as they are disseminated through the Internet without restrictions.

- Article 83.2.b) of the GDPR.

Intention or negligence in the infringement: although the Agency considers that there was no intention on the part of the media, it is concluded that it was negligent in not ensuring a procedure that guaranteed the protection of personal data in such sensitive circumstances.

- Article 83.2.g) of the GDPR.

Categories of personal data affected by the infringement: although no “Special categories of personal data” have been
affected, as defined by the GDPR in Article 9, the personal data to which the actions refer (image and voice of the
complainant) is of a particularly sensitive nature, since it allows for the prompt identification of the person and increases the risks to their privacy.

Considering the factors set out above, the value of the fine for the

infringement of article 5.1.c) of the GDPR is 10,000 euros (ten thousand euros)>>.

In its appeal, the appellant merely reproduces the arguments
set out in the written pleadings submitted during the processing of the
procedure that gave rise to the contested resolution, without considering the
established facts and the grounds that serve as the basis for the agreement adopted, in which,
in addition, the circumstances brought to light by said party are
extensively analysed and the reasons that led to its dismissal are set out.

Therefore, the arguments contained in the appeal are amply refuted by

the transcribed arguments, which are considered valid and sufficient to reject the
nullity of the requested sanctioning resolution, since the rights and freedoms susceptible to constitutional protection are not violated.

The appeal now examined is based, once again, on the principles and
jurisprudential criteria that are assessed for the weighing of the rights to honor,

privacy and self-image against the freedoms of information and expression, which, although they may be guiding, are not transferable to the present case in the
form intended by EL ESPAÑOL and do not replace or displace the principles that
inform the normative order in terms of personal data protection, which are
directly applicable and whose violation may be subject to sanction.

With this approach, the AEPD does not deny, as it rightly reasons in its resolution, that the
principles of personal data protection may be limited by the freedoms of
expression and information, according to the weighing of these rights that must be carried out, in each case, when such rights collide. Thus, we agree with the
statement made by EL ESPAÑOL regarding the possibility of a media outlet publishing personal data when it is necessary to

provide the information in question.

This is precisely the issue assessed to determine the infringement
sanctioned in the contested resolution, which concludes after analysing
the specific circumstances of the case, as set out in the transcribed grounds, that the processing of the image and voice of the interested party was not necessary for

the informative purpose intended with the publication of the news item that is the subject of the
actions.

In contrast to the above, EL ESPAÑOL maintains the approach adopted in its
written allegations to the opening of the procedure and proposed resolution

formalised in the contested procedure. Thus, EL ESPAÑOL considers that the analysis of the case must be carried out taking into account only what it calls the "legitimizing requirements" of the right to freedom of information, namely, the relevance, public interest and veracity of the news, to which it believes the data protection regulations must be subject. It goes so far as to affirm that imposing a sanction restricts that freedom and

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 25/29

that the principle of data minimization, considering the obligations it entails,
cannot be fulfilled by a communication medium.

In support of this approach, EL ESPAÑOL resorts to the possibility of establishing
exceptions to the personal data protection regulations when the processing
is carried out for journalistic purposes or by information professionals, reflected in
Recitals 4 and 153 and article 85 of the GDPR.

If heeded, this approach would in practice mean the non-application of the

personal data protection regulations to the exercise of journalism and could lead to the
indiscriminate publication of personal data without any type of limitation.

All of this was answered in the opposite way in Legal Basis II of the
contested resolution, which includes the AEPD's response to the allegations to the
proposed resolution formulated by EL ESPAÑOL, to which it is now appropriate to refer.

However, it is considered appropriate to reiterate and emphasize again, first of all, that
the AEPD does not understand the reasons that prevent a media outlet
from complying with the principles relating to the processing of personal data, regulated in
Article 5 of the GDPR, which includes, for what is of interest here, the principle of

data minimization, which requires reducing the processing to those data that
are adequate, pertinent and limited to what is necessary in relation to the purposes
for which they are processed. It should be clarified that EL ESPAÑOL does not express in its appeal
any reason for not applying this principle to the processing of personal data
involved in the exercise of its activity as a means of communication,
unlike what was expressed in its previous allegations, in which
simple economic or human reasons were adduced, such as the lack of knowledge of the
norm by the professionals of the medium, which are not mentioned now in its appeal
writing, which were not considered sufficient, obviously, to accept the approach
defended by the appellant entity.

On the other hand, it is pertinent to add that the provisions included in the GDPR in
Recitals 4 and 153 and in its article 85 of the GDPR, on the possibility that the
Member States establish exceptions and exemptions from the provisions of this
rule for processing carried out for journalistic purposes, are motivated by the
establishment of a specific regulation to balance and reconcile the right to the
protection of personal data with freedom of expression and information. This mandate, that of the need to reconcile these rights, has been respected in the
resolution that gives rise to this appeal, without renouncing the analysis of the "legitimizing
requirements" of the right to freedom of information mentioned by EL
ESPAÑOL, which have been taken into account in this case, as can clearly

be seen in the Grounds of the resolution, and in others of a similar nature,
having found on occasions that the right to freedom of information took precedence
over the right to data protection, according to the circumstances concurrent in
each case individually considered. It cannot therefore be said, as EL
ESPAÑOL does in its appeal, that the resolution in question represents a

change of criteria with respect to previous actions.

The contested decision also answers other questions reiterated in
the appeal, such as the one regarding the professionalism attributed to a means of communication

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 26/29

and the effect that this has on the level of regulatory compliance that
can be required of it in the matter we are dealing with. On this issue, EL
ESPAÑOL considers that the AEPD requires a higher degree of diligence and that it does so on the basis

of a judgment issued in a case of inclusion of data in a credit information file, which is true. However, the factual situation that gave rise to the
judgment of the National Court invoked in the decision does not detract from the validity
of the general declaration that it makes when it states that “in the assessment
of the degree of diligence, the professionalism or lack of professionalism of the subject must be specially considered”.

This assessment made by the resolution does not imply imposing on a media outlet requirements that are not equally applied to another entity with the same level of professionalism, belonging to any other sector of activity. In any case, as already indicated in the contested resolution, “it is not the AEPD, as EL

ESPAÑOL points out, that demands this special responsibility, but rather it is the applicable rule itself that assesses circumstances such as risk or professionalism, already indicated, the context or the state of the art, among others.”

On the other hand, EL ESPAÑOL defends in its appeal the relevance of the data processed in light of the interested party's status as a public figure and the

need to use and disseminate his image and voice, as well as the accessory nature of the images that illustrated the published information.

EL ESPAÑOL claims that the interested party's status as an "anonymous individual" is
lost with the viralization of the video that had already occurred when its

news was published on the website "elespañol.com", in reference to the concept of "supervening
relevance".

This AEPD does not agree that the viralization of the video in question causes the
interested party to lose his status as an anonymous private person and turns him into a

person of public relevance. In any case, even if this were the case, the publication of
said video without subjecting it to a process of anonymization of the personal data of the
interested party is not justified, since the images shown belong strictly to the
scope of his privacy. It is already known that for the publication of images it is not enough
for the interested party to be a person of public relevance, but it is also necessary
that the image shows an act related to the public activity of the
person or related to a public event.

EL ESPAÑOL also insists on pointing out that it is not understood that the sanctioning resolution maintains that it is not possible to prove the participation of the complainant in the viralization of the video. However, there is no evidence in the proceedings that proves the intention of the complainant in the dissemination of the video, which was uploaded to a social network by a third party without anything showing that the complainant participated in this act.

Furthermore, even if the complainant had disseminated it on his own social network profiles, this dissemination does not legitimize the subsequent use by a means of communication without having the prior consent of the interested party for this use of his personal data, disclosing them in a different way, as is clear from what was declared by the Supreme Court in Judgment No. 91/2017, dated 02/15/2017,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 27/29

already cited in the resolution that motivates the appeal.

In the Supreme Court Judgment 593/2022, of July 28, regarding the
publication by a media outlet of a video uploaded to YouTube with the
consent of the actor, cited by the appellant, the issue regarding the role

that social networks play on the Internet and their impact on fundamental rights is
addressed. It cites STC 27/2020, of February 24, as follows:

“The aforementioned STC 27/2020, of February 24, refers to this new
panorama, with respect to platforms such as Facebook, Twitter, Instagram or
Tuenti. From its reading, the following constitutional doctrine can be obtained, in summary:

(i) Users of social networks continue to be holders of fundamental rights
and their content remains the same as in the analog era.
(ii) The fact that private data circulate through social networks on the Internet does
not mean that what is private has become public, since the digital environment is not
comparable to the concept of "public place" referred to in Organic Law 1/1982,
nor can it be said that citizens of the digital society have
lost or renounced the rights protected in art. 18 CE.
(iii) The constitutional recognition of the fundamental rights
included in art. 18 CE, entails the power of the person to control the
data that circulate in the social network and that concern him. (iv) Unless there is an unequivocal authorization for the capture, reproduction or publication of the image by its owner, interference with the fundamental right to one's own image must necessarily be justified by the overriding public interest in having access to it and in disseminating it.

(v) The owner of the fundamental right must authorize the specific act of using his image and the purposes for which he grants it. The consent given, for example, for the capture of the image does not extend to other subsequent acts, such as its publication or dissemination. In the same way, it must be understood that the authorization of a specific publication does not extend to other publications, whether they have the same or different purpose as the original one. Nor does the permission for use granted to a specific person extend to other possible recipients. In short, it must be understood that consent that was initially given for a specific occasion or purpose cannot be considered as indefinite and binding.

Nor does this Agency dispute the dissemination of the video together with the published news. It is
simply a matter of demanding the establishment of adequate guarantees for the
protection of personal data subject to processing with the use of said
audiovisual content, with its publication; guarantees that, in this case, do not

denaturalize the informative interest of the news. With this, the AEPD exercises the
powers that the law attributes to it as a control authority in the matter of
personal data protection, which do not in any way imply the performance of
any type of control over the content of the information published by
the media.

As for the accessory nature of the images alleged by EL ESPAÑOL, this is also a concept related to the right to honour, privacy and one's own image, as recognised by the appellant itself, which has been interpreted by
our jurisprudence, allowing the publication of anonymous images of people to accompany a news item provided that the privacy of the person is not affected and this person does not constitute the main object of the information, the
contrary to what occurs in the case at hand.

Finally, as regards the amount of the fine imposed, which the appellant
considers disproportionate, the appeal makes no mention of the factors and
criteria of grading assessed in the resolution, nor of the reasons that
led to the dismissal of that alleged lack of proportionality, which is now
raised again based on the same circumstances rejected in the

resolution, some of which are more related to the substantive issues
that have determined the infringement than to the circumstances that led to the
determination of the amount of the fine.

III

Conclusion

Consequently, in the present appeal for reconsideration, the appellant has
not provided new facts or legal arguments that allow the validity of the
contested resolution to be reconsidered.

IV
Late resolution

Due to reasons of operation of the administrative body, therefore not attributable
to the appealing party, to date the mandatory

statement of this Agency regarding this appeal has not been issued.

In accordance with the provisions of art. 24 of Law 39/2015, of October 1, of the
Common Administrative Procedure of Public Administrations (LPACAP), the
meaning of administrative silence in the procedures for challenging acts and

provisions is dismissive.

However, and despite the time elapsed, the Administration is obliged to issue
an express resolution and to notify it in all procedures, regardless of their
form of initiation, as provided for in art. 21.1 of the aforementioned LPACAP.

Therefore, it is appropriate to issue the resolution that ends the procedure of the appeal for reconsideration filed.

In view of the above provisions and other provisions of general application,
the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: TO DISMISS the appeal for reconsideration filed by EL LEÓN DE EL
ESPAÑOL PUBLICACIONES, S.A. against the resolution of this Spanish Data Protection Agency issued on June 19, 2024, in file
EXP202309208.

SECOND: TO NOTIFY this resolution to EL LEÓN DE EL ESPAÑOL
PUBLICACIONES, S.A.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 29/29

THIRD: To warn the sanctioned party that the sanction imposed must be paid
once this resolution is notified, in accordance with the provisions of
article 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure

of Public Administrations, within the voluntary payment period indicated in
article 68 of the General Collection Regulations, approved by Royal Decree
939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17 December, by paying it into the restricted account number ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Data Protection Agency at the Bank
CAIXABANK, S.A. or, otherwise, it will be collected during the executive period.

If the date of notification is between the 1st and 15th of each month, both
inclusive, the deadline for making the voluntary payment will be until the 20th of the following month or the next business day thereafter, and if it is between the 16th and the last day of

each month, both inclusive, the payment deadline will be until the 5th of the second following month or the next business day thereafter.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of Law 39/2015, of 1 October, on the Common Administrative Procedure of Public Administrations
(LPACAP), interested parties may file an administrative appeal before
the Administrative Litigation Division of the National Court, in accordance with the provisions of

article 25 and section 5 of the fourth additional provision of Law 29/1998, of 13 July, regulating the Administrative Litigation Jurisdiction,
within two months from the day following the notification of this act,
as provided for in article 46.1 of the aforementioned Law.

Finally, it is noted that in accordance with the provisions of art. 90.3 a) LPACAP, the final resolution may be provisionally suspended by administrative means if the interested party
states his intention to lodge an administrative appeal. If this is the
case, the interested party must formally communicate this fact by means of a letter
addressed to the Spanish Data Protection Agency, presenting it through the
Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or

through one of the other registries provided for in art. 16.4 of the aforementioned
LPACAP. The interested party must also transfer to the Agency the documentation that proves the
effective filing of the administrative appeal. If the Agency is not
aware of the filing of the administrative appeal within two months from the day following notification of this resolution, it will

consider the provisional suspension terminated. 180-21112023
Mar España Martí
Director of the Spanish Data Protection Agency

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es