AEPD (Spain) - EXP202309208
AEPD - EXP202309208 | |
---|---|
Authority: | AEPD (Spain) |
Jurisdiction: | Spain |
Relevant Law: | Article 5(1)(c) GDPR Article 5(2) GDPR |
Type: | Complaint |
Outcome: | Upheld |
Started: | 09.09.2022 |
Decided: | 13.12.2024 |
Published: | 19.12.2024 |
Fine: | 10,000 EUR |
Parties: | El León Espanol |
National Case Number/Name: | EXP202309208 |
European Case Law Identifier: | n/a |
Appeal: | n/a |
Original Language(s): | Spanish |
Original Source: | AEPD (in ES) |
Initial Contributor: | ao |
The DPA fined a newspaper €10,000 for failing to make use of anonymization techniques in order to minimise the personal data shown in a video that was part of an online article.
English Summary
Facts
A data subject filed several complaints with the Spanish DPA (Agencia – AEPD) against specific users of Twitter as well as a newspaper, the controller. The Twitter users had posted a video in which the data subject is clearly recognisable. After its publication on Twitter, the video went viral.
The controller had published the video as part of an article on its website. The data subject stated that the video had been created for work purposes for the launch of a social media challenge.
On the 9 September 2022, the AEPD started preliminary proceedings against the controller. In response, the controller submitted a statement showing that it had deleted the video from its website.
The controller argued that the focus of the article was to analyse the popularity and implications of the trend rather than assessing the data subject’s personal or private life. It further argued that in its role as a media provider it was required to inform on current relevant events. It also highlighted that other media outlets had also shared the video. In addition, the controller brought forward that it had merely included a nickname of the data subject in the article, which had been manifestly made public through the trend.
On the 15 April 2024, the AEPD in its preliminary findings found that the controller had breached the data minimisation principle under Article 5(1)(c) GDPR and for this issued a fine of €10,000. The AEPD stated that anonymization techniques should have been implemented which would have blurred the image or distorted the voice of the data subject.
In response to this, the controller again submitted that GDPR protections cannot reasonably be applied in this case due to press freedom. As the video of the data subject had gone viral before the controller published their article, the data subject was already a person in the public interest. The controller further submitted that the article could not be understood without showing the content of the video including the audio.
Holding
The AEPD rejected the argument that the data subject was a person of public interest. It set out that the video had gone viral due to the actions of third parties without the consent or involvement of the data subject.
The AEPD also rejected the argument that the disclosure of the video was necessary in order to prove why the article was newsworthy. It explained that this could still be understood with the appropriate anonymization techniques in place.
The AEPD further analysed that although the loss of control experienced by the data subject occurred upon the popularisation of the video on Twitter, this did not preclude any wrongdoing by the controller.
The fact that the controller is a media provider, according to the AEPD, does not diminish the obligations set out by the GDPR. In fact, the AEPD highlights that as a media outlet, the controller should have taken proactive care in assessing the risk to the data subject in accordance with Article 5(2) GDPR. The AEPD clarified that the controller should have chosen not to disseminate the video when weighing up the public interest against the interest of the data subject.
In conclusion, the AEPD reiterated its assessment of the 15 April 2024 for a breach of Article 5(1)(c) GDPR including an administrative fine of €10,000 and concluded the sanctioning procedure.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/29 File No.: EXP202309208 RESOLUTION ON APPEAL FOR REPOSITION Having examined the appeal for reconsideration filed by EL LEÓN DE EL ESPAÑOL PUBLICACIONES, S.A. against the resolution issued by the Director of the Spanish Data Protection Agency dated June 19, 2024, and based on the following FACTS FIRST: On June 19, 2024, the Director of the Spanish Data Protection Agency issued a resolution in file EXP202309208, by virtue of which EL LEÓN DE EL ESPAÑOL PUBLICACIONES, S.A. (hereinafter EL ESPAÑOL or the appellant) was fined the following: . For a violation of article 5.1.c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter RGPD), classified in 83.5 of the aforementioned RGPD, and classified as very serious for the purposes of prescription in article 72.1.a) of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, LOPDGDD), a fine of 10,000 euros (ten thousand euros). In the same resolution, it was agreed to elevate to definitive the order for the adoption of measures agreed on 09/09/2022, during the preliminary investigation proceedings, and confirmed in the agreement to open the present sanctioning procedure, which had been attended to by the entity EL ESPAÑOL by definitively withdrawing the content subject to the proceedings. Said resolution, which was notified to the appellant on June 20, 2024, was issued prior to the processing of the corresponding sanctioning procedure, in accordance with the provisions of the LOPDGDD, and additionally in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), regarding the processing of sanctioning procedures. SECOND: As proven facts of the aforementioned sanctioning procedure, PS/00335/2023, the following were recorded: <<FIRST: On ***DATE.1, a user of the social network “Twitter” published on his profile a video consisting of a montage of successive shots (…). The image and voice of the complainant could be clearly seen in said recording. SECOND: The complainant has declared that the publication of the video mentioned in the First Proven Fact was carried out without his consent. THIRD: On ***DATE.2, the entity EL ESPAÑOL published on its website C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 2/29 “elespanol.com” a news item about the dissemination on social networks of the video mentioned in the First Proven Fact. This news, which was accessible through the URL (“***URL.1”) included an image of the complaining party captured from that video and the following text: <<(photograph captured from the video, which corresponds to an image of the complaining party, with the caption “(...)) “(...)”. FOURTH: On 09/14/2022, in compliance with the provisional measure adopted by the AEPD, EL ESPAÑOL withdrew the news item mentioned in the Third Proven Fact, preventing its access both externally and through the newspaper's internal search engine. FIFTH: The Inspection Services of the AEPD have confirmed that the video reviewed in the First Proven Fact went viral after its publication on ***DATE.1 on Twitter. Due to this wide dissemination, it could be found on dozens of sites and easily located with a search engine using tags such as "(...)" or "(...)".>> THIRD: On 07/19/2024, within the established period, EL ESPAÑOL filed an appeal for reconsideration against the resolution described in the First Background, dated 06/19/2024, in which it highlights the same circumstances and considerations included in the allegations made during the processing of the procedure that gave rise to the contested resolution and requests that the annulment of the sanctioning resolution be determined or, alternatively, that the amount of the fine imposed be reduced. From the above in the appeal filed, the following statements should be highlighted: 1. Obligations of EL ESPAÑOL as the data controller. The company does not deny the application of the personal data protection regulations to its activity, as demonstrated by the actions it has been carrying out with the aim of guaranteeing the rights of the interested parties, but it maintains that the principles contained in article 5 of the GDPR must be applied in a flexible manner, given the nature of its profession and the importance of the media for the development of a free and plural society. This often requires the publication of personal data that are necessary to provide complete, contextualized and public interest information, in proportion to the right to freedom of information. In the event of a news event, the principles of data protection may be limited and weighed, making it advisable to distinguish the interpretation of the regulation when the exercise of constitutional rights comes into play as a core element of the conduct investigated versus when the entity acts as any other profit-making organization. The constitutional definition of the right to freedom of information must be respected C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 3/29 and its legitimizing requirements, as reflected by the legislator by including in Recitals 4 and 153, as well as Article 85, of the GDPR, the possibility of including exceptions to the data protection regulations when processing is carried out for exclusively journalistic purposes, since such activity entails greater exposure to carrying out processing that may affect the rights of the interested parties. It is a common fact that freedom of expression and information reaches its highest level when it is exercised by information professionals (STC 165/1987), while the sanctioning resolution qualifies the conduct in this case as imprudent, demanding a higher degree of diligence by the professionalism of the subject, basing itself on a sentence of the National Court issued in a case of inclusion of personal data in the Asnef file. Therefore, EL ESPAÑOL understands that the analysis should be carried out by analysing whether the legitimising requirements of the right exercised are met and not whether there is a legal provision in the void to which to attach an infringement that ignores the necessary weighing in light of the facts proven in the conduct of the complainant, its informative relevance. The imposition of a sanction may restrict the exercise of a constitutional right when its legitimising requirements are met. The court adds that the strict interpretation of the principle of data minimization subjects the information activity to diffuse contours that would impose on the media obligations that are impossible to execute. It does not deny the necessary prior analysis of the news to be published, but considers the performance of a risk analysis in the terms established in the data protection regulations to be disproportionate, when the resolution issued does not include the analysis of the requirements of relevance, public interest and veracity. Thus, it highlights that the video is true, was disseminated for promotional purposes and went viral. Therefore, it considers that the risk analysis must be carried out in compliance with the constitutional requirements that authorize the right exercised and not as the contested resolution maintains. Furthermore, the measure set forth in the resolution is disproportionate in terms of costs and, therefore, contrary to the provisions of article 32 of the RGPD. “Clearly, all news is previously analyzed, in order to determine its public relevance and informative interest and this cannot be confused, as the AEPD seems to do, with a judgment in which, ignoring the former, the analysis is based on a regulation that, by decisively affecting a constitutional right, must be subject to the concurrence of its legitimizing requirements, and not the other way around.” 2. Relevance of the personal data published The sanctioning resolution affirms, with respect to the criteria of public relevance, general interest and veracity, that they are related to the right regulated by the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 4/29 Organic Law 1/1982, of May 5. However, these criteria have been considered by the AEPD itself, as enabling the right invoked (Resolution E/03409/2018). A) The interested party's status as a public figure. The viralization of the video in question, which had already occurred when the news was published, eliminates the interested party's status as an "anonymous individual." This is a situation that refers to the concept of supervening relevance, already alluded to in the allegations to the proposed resolution, together with various judicial resolutions that determine the existence of legitimacy for the publication of the image of an anonymous person; both criteria are not mentioned in the sanctioning resolution. On the other hand, it insists on pointing out that it is not understood that the sanctioning resolution maintains that it is not possible to prove the participation of the claimant in the viralization of the video. B) Need for the use and dissemination of the image and voice of the interested party EL ESPAÑOL appreciates a change of criteria that supposes a constitutional breach as it implies a control of informative content from the administrative sphere. The precedent E/03409/2018, of resolution of archiving of proceedings, already cited in the written allegations to the proposed resolution, already warns that the administrative control over the contents of the information published by the media is incompatible with our constitutional system. However, the contested resolution declares that the published information did not require the use and dissemination of personal data and that keeping the image and voice without anonymizing does not add any added value to the information. The resolution thus makes assessments about the proportionality of the personal data published and its informative value, assessing that the news would have the same journalistic interest if this anonymization had been carried out. EL ESPAÑOL considers that this is contrary to the principle of legality and to the provisions of the archiving resolution cited. Contrary to what is stated in the contested resolution, the process of anonymizing the video would distort the content itself and its informative interest, preventing the reader of EL ESPAÑOL from obtaining contextualized information. The news precisely describes the video itself and the reactions of the users, which would have no value if the reader were not aware of the video (…). It invokes article 3 of the Civil Code to indicate that the interpretation of the rule must be carried out in relation to the moment in which it must be applied and the prevailing social conditions. In summary, in the opinion of EL ESPAÑOL, anonymization would limit the right to C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 5/29 freedom of information. C) Accessoriness of images. Violation of article 32 Although related to the right to honor, privacy and one's own image, the concept of accessoriness must be assessed when applying the data protection regulations, as it implies a limitation of the right to image, of constitutional rank, which cannot be ignored in the weighing of rights to be carried out. It cites Supreme Court Ruling 241/2003, of March 14, to point out that accessoriness protects that the images that accompany a news item have a direct relationship with it or, in other words, that the personal data that illustrate the information are necessary to describe in images the public conduct referred to. Based on this, EL ESPAÑOL understands that there is an analogical relationship between accessoriness and the minimization of data associated with the informative material. The video in question meets this requirement, not because the person in question appears, but because it is the video that was essentially the informative object, not being possible to understand the news without the publication of the video. In this regard, it refers to what is indicated in its written allegations, on the relationship of the present case with the one analyzed in the Supreme Court Judgment 593/2022, of July 28, regarding the publication by a media outlet of a video uploaded to YouTube with the consent of the actor, the images being necessary to contextualize the reader. In this case, the video was initially uploaded to social networks with the consent of the complainant, where it was accessible to all users, and this video is the central object of the news. 3. Determination of the amount of the sanction. Regarding this issue, EL ESPAÑOL reiterates the following: . It is not possible to accept the existence of negligence in the publication of personal data justified by the informative interest of the same, without which the news would be meaningless and incomplete, and it must also be considered the activity carried out by a media outlet and that two fundamental rights are in conflict, the weighting of which is controversial. . With the withdrawal of the news item, the purpose of the claim was achieved, insofar as it was to prevent further dissemination of a video that was already viral, so that the rights of the interested party have already been protected. FUNDAMENTALS OF LAW I Jurisdiction C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 6/29 The Director of the Spanish Data Protection Agency is competent to resolve this appeal, in accordance with the provisions of article 123 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP) and article 48.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, LOPDGDD). II Response to the allegations presented In relation to the statements made by the appellant, which basically reproduce the allegations presented by it during the processing of the sanctioning procedure, without adding any new arguments, it should be noted that they were already analyzed and rejected in Legal Grounds II to VII of the contested Resolution, dated 06/19/2024, in which it is considered that it failed to comply with the provisions of article 5.1.c) of the GDPR and the assessment of the evidence that has made it possible to determine said breach and the scope granted to it, as well as the circumstances taken into account for the graduation of the sanction imposed, are sufficiently detailed. In said Legal Grounds the following is indicated: <<II Response to the allegations to the proposed resolution 1. Obligations of a media outlet as data controller. Requirements for the publication of personal data by the media. EL ESPAÑOL begins its written submission to the proposed resolution by emphasizing that the personal data protection regulations are limited in relation to the exercise of journalism, due to the essential position that the right to freedom of expression and information acquires for society, and that the jurisprudence grants information professionals specific protection as they are subject to greater risks (STC 225/2009, of December 9). It goes on to indicate that, on the contrary, the proposed resolution implies that the obligations of EL ESPAÑOL as the data controller are expanded from the moment that its activity is based on the exercise of journalism, stating that it is especially obliged to consider the risks that the dissemination of images and voice through a media outlet entails; or that it should have been considered whether the purpose of the information required the dissemination of the image and voice of the complaining party; or the obligation to carry out a risk analysis prior to the publication of the news. This Agency does not deny that the fundamental right to the protection of personal data, like all rights, is limited by other fundamental rights, in this case by freedom of expression and information. It is this circumstance that requires, in each specific case, to weigh or reconcile the rights in conflict. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 7/29 This is precisely what is stated in Recitals 4 and 153 and Article 85 of the GDPR invoked by EL ESPAÑOL when they point out that the right to the protection of personal data is not an absolute right, but must maintain a balance with other fundamental rights, such as freedom of expression and information, including journalistic expression. To such an extent that Recital 153 and Article 85 of the RGPD not only oblige Member States to reconcile the rules governing these other rights with the right to the protection of personal data under the RGPD, but also to adopt legislative measures establishing exceptions or exemptions from certain provisions of said Regulation in relation to the issues listed in these provisions, including the general principles, if this is required to reconcile such rights. This Agency does, however, categorically deny that the right to freedom of information limits the right to data protection in the sense intended by EL ESPAÑOL, which amounts to stating that the rules on the protection of personal data do not apply when data processing is carried out within the framework of journalistic activity, due to the subject. It goes so far as to say that it does not consider it necessary to carry out a prior analysis of all the news to be published. The arguments defended in this act are considered appropriate and pertinent, and reproduce those assessed in the resolution proposal, when it is stated that the media must take into account the risks involved in the processing of data that they carry out when disseminating news and that they are obliged to pay special attention and to establish the necessary safeguards to comply with the rules provided for respecting the right to the protection of personal data. Special consideration is given to the professionalism attributed to the media, recognized by our jurisprudence, in order to establish a higher level of diligence in compliance with the law. In this regard, the National Court's Judgment of 17/10/2007 (rec. 63/2006) declared that, based on the fact that these are entities whose activity involves continuous data processing, "... the Supreme Court has understood that there is imprudence whenever a legal duty of care is ignored, that is, when the offender does not behave with the required diligence. And in assessing the degree of diligence, the professionalism or lack thereof of the subject must be especially considered, and there is no doubt that, in the case now examined, when the activity of the appellant is one of constant and abundant handling of personal data, the rigor and exquisite care in complying with the legal provisions in this regard must be insisted upon." In any case, it is not the AEPD, as EL ESPAÑOL points out, that demands this special responsibility, but rather it is the applicable rule itself that assesses circumstances such as risk or professionalism, already indicated, the context or the state of the art, among others. Accepting the position of EL ESPAÑOL would be tantamount to emptying the right to data protection of content simply because the processing is carried out by an institutionalized media outlet or by an information professional, since there is no economic or human reason that motivates the non-application of the rule to an obliged subject, nor the lack of legal knowledge of these professionals C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 8/29 that can prevent their activity from being subject to the provisions of the RGPD and the LOPDGDD. Nor can we speak of self-censorship as a consequence of the application of the rule, but rather of compliance with a generally applicable rule, which also obliges the media and their professionals. Until such legislative measures are adopted that define the exceptions or exemptions referred to in article 85 of the GDPR, the limits in the application of this Regulation and the LOPDGDD, must be set taking into account the normative provisions and interpretative criteria that are applicable in each case to carry out the indicated weighing or reconciliation of the rights in conflict. And among these criteria, those indicated by the entity complained of, such as the public relevance of the interested party or his participation in the newsworthy event, the veracity of what is published or its informative interest. But without forgetting, as a priority, the principles and rules to which the processing of personal data is subject according to its own regulatory standards. This same act resorts to those interpretative criteria to analyze the case and conclude the infringement, having considered, as will be explained later, that there was no informative interest in the dissemination of the personal data of the complainant and that this is an anonymous person. But, above all, it applies the principle of data minimization regulated in article 5.1.c) of the GDPR and assesses the context in which the data processing occurs, its purpose and proportionality with respect to the purpose pursued, all in accordance with the rules that regulate the protection of personal data. The aforementioned criteria, which EL ESPAÑOL refers to as requirements for the publication of personal data by the media, are more closely related to the right to honour, personal and family privacy and one's own image, regulated by Organic Law 1/1982, of May 5, whose articles 7 and 8 establish the actions that are considered illegitimate intrusions into the scope of protection delimited by this law. The analysis of this regulation responds to the criteria alleged by EL ESPAÑOL, on which there is abundant jurisprudence, which can be used when dealing with aspects of interest to decide a question regarding data protection, to the extent that both rights protect the intimacy and privacy of individuals, but always bearing in mind that these are criteria that serve to guide and inform about the aspect in question and whose application must yield to the principles included in the data protection regulations when a case related to this matter is judged. In short, the circumstances alleged by EL ESPAÑOL cannot be the only ones assessed, such that the personal data protection regulations that are applicable are excluded. On the other hand, having taken into account the general consideration above, as regards the “requirements” mentioned by EL ESPAÑOL, the following should be noted on the contrary: a) The complainant is an anonymous individual and this condition is not modified by the fact that the audiovisual content published by EL ESPAÑOL had gone viral on social networks, a consequence of the action of C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 9/29 third parties without the accredited intervention of the complainant. b) The veracity and timeliness of the published information do not influence, from the point of view of data protection, the appropriate use and dissemination of the image of the complainant. The respondent claims that the news would not be adequately understood without the video, but does not explain how the disclosure of this content would affect the news after having been subjected to an anonymization process, as defended in this act, nor why this anonymization would make it lose journalistic interest and collide with the right to freedom of information. 2. Regarding the determination of the amount of the proposed fine. For the same reasons stated above, the request for a reduction in the amount of the fine requested by EL ESPAÑOL should be rejected based on the condition of the offender, taking into account the protection of information professionals and the social work carried out by the media outlet, and on the other hand, that the informative content of the news would have been void with the anonymization of the video. The Agency adds that the loss of control over personal data had already occurred at the time of publication of the news, with the dissemination of the video on social networks and its viralization. This circumstance does not exclude the action of EL ESPAÑOL from having this effect and thus can be considered when assessing the seriousness of the infringement. Finally, the respondent party considers that the fact that the news was withdrawn as soon as it was requested by the AEPD is considered as an attenuating circumstance. It cites as an example the resolution issued in file E/02643/2018, in which the archiving of the proceedings was resolved, considering that the purpose of the claim had been satisfied. This Agency understands that these are not comparable cases. In the present case, the withdrawal of the content that is the subject of the complaint was ordered by this Agency as a provisional measure, so that compliance with the respective requirement is not considered an attenuating factor in the grading of the sanction. 3. The link that is the subject of the complaint has been completely removed, so that it is not even accessible through EL ESPAÑOL's internal systems. As indicated in the Grounds that follow, with the removal of the video EL ESPAÑOL is simply complying with the regulations and complying with the resolutions of this supervisory authority, which are mandatory, so that said removal does not serve to modify its responsibility for the facts analyzed. III The image and voice as personal data and other preliminary issues The physical image and voice of a person, according to article 4.1 of the GDPR, are personal data as they make them identifiable, and their protection, therefore, is the subject of said GDPR: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 10/29 “«personal data»: any information relating to an identified or identifiable natural person («the data subject»); an identifiable natural person shall be considered to be any person whose identity can be determined, directly or indirectly, in particular by regarding an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person;” Report 139/2017 of the Legal Office of this Agency states that “the image as well as the voice of a person is personal data, as is any information that allows determining, directly or indirectly, their identity (…)” The physical image and voice of a person, according to article 4.1 of the GDPR, are personal data and their protection, therefore, is the subject of said Regulation. Therefore, the processing of the image and voice of a person is subject to data protection regulations. Article 4.2 of the GDPR defines the concept of “processing” of personal data. “any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, deletion or destruction.” The ECJ (Second Chamber) of 14 February 2019, in Case C 345/17, Sergejs Buivids, stated the following in this regard: “The publication, on a video website where users can send, view and share videos, of an audio recording, such as the one at issue, containing personal data, may be considered to constitute fully or partially automated processing of those data, within the meaning of Articles 2(b) and 3(1) of Directive 95/46.” Furthermore, it is important to note that individuals have the power to dispose of their personal data, as well as to disseminate them. Thus, STC 292/2000, of 30 November, states that “the content of the fundamental right to data protection consists of a power of disposition and control over personal data that empowers the person to decide which of these data to provide to a third party, be it the State or an individual, or which this third party may collect, and which also allows the individual to know who possesses these personal data and for what purpose, being able to oppose such possession or use. These powers of disposition and control over personal data, which constitute part of the content of the fundamental right to data protection, are legally specified in the power to consent to the collection, obtaining and access to personal data, its subsequent storage and processing, as well as its use or possible uses, by a third party, be it the State or an individual. And this right to consent to the knowledge and processing, whether computerized or not, of personal data, requires, as essential complements, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 11/29 on the one hand, the ability to know at all times who has that personal data and to what use it is being subjected, and, on the other hand, the power to oppose that possession and uses.” IV Unfulfilled obligation The inclusion of the image of a person or a video containing their image and their voice in journalistic publications, in conditions such that it identifies them or makes them identifiable (without applying any technique to them that prevents their identification), in this case, in addition, together with their name, implies a processing of personal data. Therefore, the entity that carries out this processing is obliged to comply with the principles and obligations regarding data protection that are provided for the data controller in the GDPR and the LOPDGDD. These principles and obligations do not decline if we are dealing with a data controller that is a media outlet. Furthermore, the responsible entity is especially obliged to consider that the dissemination through a media outlet of the image and voice of the complaining party and their name, enabling their identification by third parties, implies a greater risk for the interested party, making it very likely that they may suffer damage to their rights and freedoms. Therefore, they must take extreme caution so that it cannot be concluded that said data processing is not proportional or necessary in relation to the information purposes pursued. Thus, in general, the principle of proactive responsibility established in article 5.2 of the GDPR, the assessment of risks and the implementation of appropriate security measures must be taken into account. Obligations that are even more relevant when the risk is particularly sensitive. In this regard, and regardless of the legal basis legitimizing the processing, all data controllers must respect the principles of processing set out in article 5 of the GDPR. In what concerns the present case, it is worth highlighting the principle of “data minimisation” set out in article 5.1.c) of the GDPR, which establishes the following: “1. Personal data shall be c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed («data minimisation»);” It is understood that the processing of personal data must be limited to what is necessary to achieve the objective, that is, when the purpose cannot be reasonably achieved without the processing of such personal data. It is thus related to the principle of limitation of the purpose of article 5.1.b) of the GDPR, and only leads to precise results if the specific purpose is well defined by the data controller and is linked to the proportionality and necessity of such processing. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 12/29 The relevance of the data refers to its essentiality to obtain the result, and the options offered to the controller must be reviewed to adapt to this principle in each processing operation. When the responsible entity is a media outlet, it must bear in mind the cited principle of minimisation of personal data whenever it plans to use personal data in a journalistic article. The present procedure is initiated because the entity EL ESPAÑOL published, on the website “elespanol.com”, a news item about the dissemination of videos on social networks, in which the text referred to the name of the complainant (“(...)”) and was illustrated with a photograph of the complainant, taken from a video that was published and widely disseminated through the social network “Twitter”. The image of the complainant was clearly visible in said photograph. In the same article, links are inserted that lead to the video in question, in which the image and voice of the complainant are also clearly shown, which were not duly anonymized using any appropriate technique for this. According to the First Proven Fact, the video consists of a montage of successive shots (...). The news item published by EL ESPAÑOL refers to this specific video. This is information published on ***DATE.2 on the website “elespanol.com” accompanied by the repeated video and a screenshot taken from it (it includes a link to the publication of the video on “Twitter”, in the profile corresponding to the user “***USER.1”, “***USER.1”, with the text “(...)”, the indications “(...)”, and a button to share the content). In this article, EL ESPAÑOL reports on (i) the content of the video, highlighting some of the dialogues that take place between the people who appear in it; (ii) its wide diffusion on social networks, which it considers to be produced by its fun nature; and (iii) the thousands of comments to which it has given rise, some of which are transcribed in the same article. EL ESPAÑOL should have considered whether the purpose of the information required the dissemination of the image and voice of the complainant contained in the video in question without having applied any anonymization process to it, or whether the indication of the name in the text of the published article was really necessary for the intended purpose; or whether this purpose, on the contrary, was perfectly achievable without the identification of the owner of the personal data. This Agency understands that the information that EL ESPAÑOL intended to make available to the general public did not require this use and dissemination of the personal data of the complainant. Based on this, it appears that personal data has been processed in clear violation of the principle of data minimization. This conclusion is not shared by EL ESPAÑOL. This entity, in its allegations at the opening of this procedure, does not dispute the processing of personal data carried out, but it does dispute the fact that this may be considered C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 13/29 constituting an infringement and, therefore, subject to sanction. Firstly, the respondent entity points out that the video in question was disseminated a month earlier (…), which was also the subject of journalistic attention in other media. EL ESPAÑOL implies that the dissemination of this content through the Internet was intentional and that with this dissemination the complainant achieved “the apparent desired purpose”. Likewise, it highlights that the video, in which the complainant himself refers to his name or nickname “(...)”, became a trend on different platforms and social networks with massive following (Twitter, Youtube, Tik Tok), being commented and shared by thousands of users, and continues to be visible through thousands of links that can be accessed through a search engine with the indicated nickname as a criterion. Based on this, it considers that the loss of disposition and control of the personal data of the interested party took place prior to the publication that has given rise to the present proceedings and not as a consequence of it, an issue that EL ESPAÑOL considers essential to determine its responsibility. In this regard, it points out that the viralization of content is a joint result of the actions and reactions of online users, so it cannot be attributed directly or exclusively to EL ESPAÑOL. Furthermore, in relation to the principle of data minimisation and its consideration in the present case, EL ESPAÑOL claims that the data used in the published news item were manifestly public and that no technical means were used to prevent the recognition of the image, because the video in question was not originally uploaded or hosted by that party, but rather the technique of transclusion was used, which refers to the inclusion of a video or document from another website by inserting the corresponding code on the EL ESPAÑOL website. However, these circumstances, even if they were all taken as true, do not modify EL ESPAÑOL's responsibility for the facts analysed, since none of them excuses compliance with the data protection regulations by that entity from the moment it decides to collect and use the data in question. Nor does the fact that there may be possible responsibilities of other third parties, other sanctionable conduct, exempt that entity from responsibility. The existence of possible previous breaches by third parties does not exempt the media from the obligation to carry out a risk analysis prior to the publication of the news. EL ESPAÑOL, as a media outlet and as the data controller, decide what and how to publish. It could decide to publish the video as is, choose not to publish it or decide to distort the image and voice of the complaining party in order to prevent it from being recognizable by third parties. Any processing operation carried out within the scope of the complained party (in this case the dissemination of personal data on the occasion of the news) must be attributed solely to it, regardless of the processing operations that have been previously carried out by other subjects and which, in no case, exempt it from its responsibility. The media, as those responsible for the processing of the various data that they become aware of in the course of their journalistic work, must C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 14/29 know and comply with the regulations on data protection, applying, among them, the principle of data minimisation enshrined in article 5.1.c) of the GDPR. It should also be noted that EL ESPAÑOL was not certain that the video had been intentionally disseminated by the complainant itself, given that it was taken from an unidentified user of the social network “Twitter”. Even if such intentional dissemination had occurred, it cannot be interpreted in the sense intended by EL ESPAÑOL in its allegations. In cases such as this, it is only the interested party who must decide on the use of his or her personal data, as has been explained, and this does not change because the personal data is accessible through the Internet, regardless of its origin. In Judgment No. 91/2017, dated 15/02/2017, the Supreme Court has ruled on a case in which the defendant (media outlet) used a photograph taken from the plaintiff's Facebook profile to illustrate a news item published in the paper edition of a newspaper. In this Judgment, it is considered that the right to information legitimizes the action of the media outlet, which provides truthful information about facts or people of public relevance, relevance that is attributed to information about facts of criminal significance. However, regarding the use of that photograph, it states the following “The fact that the owner of the profile has “uploaded” a photograph of himself in the account opened on a social network on the Internet, which is accessible to the general public, does not authorize a third party to reproduce it in a media outlet without the consent of the owner, because such action cannot be considered a natural consequence of the accessible nature of the data and images in a public profile of a social network on the Internet. The purpose of an account opened on a social network on the Internet is the communication of its owner with third parties and the possibility that these third parties may have access to the content of that account and interact with its owner, but not that the image of the account owner may be published in a media outlet. The consent of the owner of the image for the general public, or a certain number of people, to view his or her photograph on a blog or an account opened on a social network website does not imply authorization to use that photograph and publish or disseminate it in a different way…” “The requirement to protect the right to information cannot mean that the fundamental rights of those affected by the exercise of that right are left empty of content, which should only be sacrificed to the extent necessary to ensure free information in a democratic society, as established in art. 10.2 of the European Convention on Human Rights (SSTC 171/1990, of November 12, FJ 5, and 121/2002, of May 20, FJ 4). And the public interest that the violent event aroused and that justified the defendant's newspaper reporting on it, even with identification of those affected by the event, did not require or justify the publication of the image of the victim of the event, obtained from his profile on a social network, without his express consent." C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 15/29 Likewise, the technique used to capture or distribute the video is not influential. In this regard, EL ESPAÑOL has stated that the video in question was not originally uploaded or hosted by that party, but rather the technique of transclusion was used, which refers to the inclusion of a video or document from another website by inserting the corresponding code on the EL ESPAÑOL website. On this issue, it should be noted, on the one hand, that the published news item not only included the link that allowed access to the video on another website, but the news item was illustrated with a photograph of the complaining party taken from said video. On the other hand, it is necessary to bear in mind that the inclusion of these links constitutes a processing of personal data, in accordance with the definition of processing established in article 4 of the GDPR, which considers as such any operation or set of operations carried out on personal data such as “communication by transmission, diffusion or any other form of enabling access, comparison or interconnection”. Regarding the use of this transclusion technique, EL ESPAÑOL also points out that the content is not transferred to a new public nor is it disclosed through a specific technique different from the original communication, as interpreted by the Court of Justice of the European Union in the Judgment of 13/02/2014, issued in case C- 466/12 (known as the Svensson Case). However, this Judgment addresses issues relating to intellectual property, so that the interpretations it makes, regarding the consequences that arise from the inclusion in an Internet site of links that lead to content protected by rights of that nature hosted on other sites, are not transferable to the present case. In any case, from what is stated in this Judgment in relation to the use of these links, it is interesting to highlight the following: “20. It follows from the above that, in circumstances such as those of the main proceedings, the fact of providing clickable links leading to protected works must be classified as "making available" and, consequently, as an "act of communication" within the meaning of the aforementioned provision." In another order, the respondent entity indicates in its allegations that it has demonstrated its proactivity by immediately complying with the provisional measure ordered by this AEPD, eliminating the video and all the content of the publication. However, this action, with which EL ESPAÑOL simply complies with the regulations and observes the resolutions of this supervisory authority, which are mandatory, cannot serve to modify its responsibility for the facts analyzed. V Fundamental right to freedom of information EL ESPAÑOL, in its allegations, states that the popularization of the video became a topic of public and journalistic interest, as a cultural phenomenon and for its social impact, motivating its sole intention to inform readers, without compromising the privacy or dignity of the complainant and without delving into his personal life or sensitive personal aspects and without making any type of value judgment. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 16/29 It adds that the focus of the published article was centered on the popularity and social implications of that trend on networks, providing readers with current and relevant information, in compliance with the work of the media media. Proof of this, according to EL ESPAÑOL, is the fact that other media also echoed the same trend. It also considers that the image and name of the complaining party are central elements of the newsworthy event, in the context of the information that is intended to be disseminated, without this implying an overstepping of the right to freedom of information. On the other hand, it is noteworthy that the jurisprudence cited by this Agency to support a data processing that may be considered excessive has focused on image reproductions in criminal contexts, in which the courts have held that the images in question lack relevance to the information to be transmitted. However, in the present case, as we will explain, the processing carried out by EL ESPAÑOL within the framework of freedom of information has been excessive, as there is no public information interest in the dissemination of the image and voice of the complainant, with indication of his name. Keeping said image and voice without anonymizing (without blurring the image and without distorting the voice, for example) does not provide any added value to the information, under which pretext it seems that those data have been disclosed, which make the person clearly identifiable, even more so if the name is specified. When weighing up the conflicting interests and taking into account the circumstances of this case, that is, the particularly sensitive nature of personal data and the impact on the privacy of the person (the complainant), the interest of the holder of the right to the protection of his or her personal data and to not have it disclosed deserves greater protection compared to the alleged public interest in its disclosure. It is true that we are dealing with a fundamental right, that of the protection of personal data, which is not absolute, since if necessary it may give way to the prevalence of other rights and freedoms that are also constitutionally recognized and protected, such as, for example, the fundamental right to freedom of information, which must be weighed on a case-by-case basis. In the conflict between the fundamental rights to freedom of information in relation to the fundamental right to the protection of personal data, even when an equal degree of protection of both constitutional rights is recognized, ordinarily the former is usually given precedence by our courts, after assessing and weighing up all the elements at stake. However, precedence does not mean precedence when, taking into account all the circumstances concurrent in a specific case, the limits set by law and jurisprudence are exceeded. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 17/29 In this regard, the Article 29 Working Party in its Opinion 06/2014 on the concept of legitimate interest of the data controller under Article 7 of Directive 95/46/EC, when examining the legal basis of the legitimate interest of Article 7.1.f) of Directive 95/46/EC, fully transferable to the current art. 6.1.f) of the RGPD, includes the right to freedom of expression or information as one of the cases in which the question of legitimate interest may arise, asserting that “without prejudice to whether the interests of the data controller will ultimately prevail over the interests and rights of the data subjects when the balancing test is carried out”. Limits to the Fundamental Right to Freedom of Information. Having said that, the fundamental right to freedom of information is not absolute either. We can observe very clear limits established by the courts in the civil sphere, in relation to the right to honour, personal and family privacy and one's own image. Thus, we will cite, for all, the STC 27/2020, of February 24, 2020 (appeal for protection 1369-2017) which provides, in relation to the image of a person, and based on the undisputed fact that it makes it identifiable, that “…the question in debate is reduced to considering whether the non-consensual reproduction of the image of an anonymous person, that is, of someone who is not a public figure, but who suddenly and involuntarily acquires a role in the newsworthy event, in this case as a victim of the failed attempt at murder by his brother and the subsequent suicide of the latter, constituted an illegitimate intrusion into his fundamental right to his own image (art. 18.1 CE). […] …that criminal events are newsworthy events, even regardless of the private subject status of the person affected by the news. However, the limit is the individualization, direct or indirect, of the victim, since this information is not of public interest because it lacks relevance to the information that is allowed to be transmitted (STC 20/1992, of February 20; 219/1992, of December 3; 232/1993, of July 12; 52/2002, of February 25; 121/2002, of May 20, and 127/2003, of June 30). This is currently recognised by Law 4/2015, of 27 April, on the status of victims of crime, in force since 28 October 2015, when it warns of the need "from the public authorities [to offer] the broadest possible response, not only legal but also social, to victims, not only repairing the damage in the framework of a criminal process, but also minimising other traumatic effects on the moral level that their condition may generate, all this regardless of their procedural situation. Therefore, this Statute, in line with European regulations on the matter and with the demands that our society raises, aims, based on the recognition of the dignity of the victims, to defend their material and moral assets and, with it, those of society as a whole". In cases such as those raised in this appeal, this Court must give importance to the prevalence of the right to the image of the victim of the crime over the freedom of information, since the graphic information became unnecessary or superfluous because the photograph of the victim lacked real interest for the transmission of C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 18/29 the information, in this case the apparent commission of a homicide and subsequent suicide” (emphasis added). We will add the STS, of its First Civil Chamber, 272/2011 of April 11, 2011 (rec. 1747/2008), in which, regarding the data necessary to provide information and the limits of the public interest, it states that “b) Trivial information is not protected (ATC 75/2006), but the fact of providing data that is not necessary in a case of rape (the full name, the initials of the surnames, the door of the street where the victim lived) that is not relevant to the community, does not respect confidentiality, only seeks to satisfy curiosity, causes disturbances or annoyances and unnecessarily reveals aspects of personal and private life, allowing neighbors, close people and family members to fully identify the victim and to know in great detail a fact that seriously violates her dignity (STC 185/2002) or about an illness that is not of public interest and affects the victim in a serious way (STC 185/2002) or about an illness that is not of public interest and affects the victim in a serious way (STC 185/2002). directly into the irreducible sphere of privacy and which is revealed for the purpose of a pure joke or prank (STC 232/1993);”. Likewise, the STS, of its First Civil Chamber, Judgment 661/2016 of 10 November 2016 (rec. 3318/2014), in relation to the capture and disclosure in court of the image of a victim of gender violence, provided that “1.ª) The interest of the information in question is not disputed, nor is the right of the defendant television network to broadcast recorded images during the oral trial of the criminal case, since there is no record of any limitation in this regard agreed by the judicial body. 2.ª) The only controversial point is, therefore, whether the identification of the plaintiff as a victim of the crimes prosecuted in said criminal case, through close-ups of her face and the mention of her first name and place of residence on 31/03/2022, was also included in the fundamental right of the defendant television channel to transmit truthful information or, on the contrary, was limited by the plaintiff's fundamental rights to her personal privacy and her own image. 3.ª) Regarding this issue, the jurisprudence has recognized the general interest and public relevance of information on criminal cases (judgment 547/2011, of 20 July), which is accentuated in cases of physical and psychological abuse (judgments 128/2011, of 1 March, and 547/2011, of 20 July), but it has also pointed out, as regards the identification of the persons involved in the trial, that the accused and the victim are not on an equal footing, since as regards the former, a complete identification is possible, and not only by their initials, due to the nature and social significance of the crimes of abuse (judgment 547/2011, of 20 July). […] 6.ª) In short, the defendant television channel should have acted with the prudence of a diligent professional and avoided broadcasting images that represented the appellant in close-up, either by abstaining from broadcasting the corresponding shots, or by using technical procedures to blur her features and prevent her recognition (judgment 311/2013, of May 8). Likewise, he should have also avoided mentioning her first name, because this information, insufficient on its own to C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 19/29 constitute an illegitimate interference, became relevant when it was spoken on screen simultaneously with the image of the plaintiff and the mention of her place of residence was added, all of which are unnecessary for the essence of the content of the information, as shown by the news about the same trial published the following day in other media. 7.) The identification of the applicant through her image and the personal data indicated and her direct connection with an episode of gender violence and other serious crimes, when the simultaneous or subsequent disclosure of data referring to how the victim and her aggressor met and the way in which the criminal acts occurred was foreseeable, means that the loss of anonymity violated both the applicant's right to her own image, due to the disclosure of her physical features, and her personal and family privacy, insofar as confidential data, belonging to her private life (that she used the Internet to start a relationship or the intimate content of some of her chats), lacking offensive significance in a situation of anonymity, became so from the moment that any person who saw these news programmes and who lived in the victim's locality could know who they referred to, so that the psychological damage inherent to her status as a victim of the crimes was added the moral damage consisting of the fact that details of his private life that he had not consented to be made public became known.” (emphasis added). As we can see, there is a clear reference to the excessive processing of personal data (some of which are not of an intimate nature) to provide the information, considering them unnecessary at all points in view of the current circumstances. Sometimes the courts refer to intimate data, but sometimes they are personal data that are not intimate, such as, for example, the image of a physical person obtained from a photograph published on a social network or the name and surname. . Balance between the fundamental right to freedom of information and the fundamental right to the protection of personal data. In the specific case examined, as we have indicated, the entity EL ESPAÑOL published, on the website referred to in the facts, the image of the complainant to illustrate a news item about social networks, in which, in addition, his name is mentioned, inserting links that led to the video that is the subject of the claim that has motivated the present sanctioning procedure. Thus, it is not a question, as in other cases examined by jurisprudence, of giving prevalence to one fundamental right over another, having to choose which has more weight in a specific case, but rather, of finding a balance between both to achieve the purpose of the first without distorting the second. The reconciliation of both rights is nothing new, since the European legislator mandates such reconciliation in article 85 of the GDPR. As we have seen previously, the fundamental right to freedom of information is not unlimited, since the jurisprudential interpretation when comparing it with other rights and freedoms does not allow in all cases and with all amplitude the same, but, nevertheless, the prevalence that the courts usually give it can be limited by other fundamental rights that must also be respected. This is how its limitation is observed when the personal data provided were unnecessary for the essence C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 20/29 of the content of the information. In this case, the image of the claimant and his voice, as well as his name, without restricting the provision of information, must be made compatible with the principle of data minimization, applicable to the form, the medium in which the information is provided and disseminated due to the immediate impact on personal data and the identification of the person. Precisely because the public interest in information is not denied in this specific case, it is not a question of undermining the fundamental right to freedom of information due to the prevalence of the fundamental right to the protection of personal data, but of making them fully compatible so that both are absolutely guaranteed. That is, the freedom of information of the media is not called into question, but rather the balance with the right to data protection based on the proportionality and necessity of publishing the specific personal data of the image or the name of the person. Such a situation could have been resolved by using technical procedures to prevent the recognition of the image and voice, both security measures applied, depending on the case, in a normal manner by the media, and by not indicating the name of the complaining party. Furthermore, we must point out that the claimant is an anonymous person and our Constitutional Court, in accordance with STC 58/2018 of June 4, states that public authorities, public officials and public figures or those engaged in activities that involve public notoriety "voluntarily accept the risk that their subjective rights of personality may be affected by adverse criticism, opinions or revelations and, therefore, the right to information reaches, in relation to them, its maximum level of legitimizing effectiveness, since their life and moral conduct participate in the general interest with greater intensity than that of those private persons who, without a vocation for public projection, are circumstantially involved in matters of public importance, to whom therefore, a higher scope of privacy must be recognized, which prevents granting general importance to facts or conduct that would have it if they were referred to public figures." The ECJ (Second Chamber) of 14 February 2019, in Case C 345/17, Sergejs Buivids, refers to various criteria for weighing up the right to respect for privacy and the right to freedom of expression, including “the contribution to a debate of general interest, the notoriety of the person concerned, the subject matter of the report, the previous behaviour of the person concerned, the content, form and impact of the publication, the manner and circumstances in which the information was obtained and its veracity (see, to this effect, the judgment of the ECHR of 27 June 2017, Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland, CE:ECHR:2017:0627JUD000093113, paragraph 165)”. Thus, a matter may be considered of general interest, of public relevance, not only by the person involved, but also by the subject matter to which it refers. Both requirements must be met. In the present case, (i) the complainant is not a public person; rather, on the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 21/29 the contrary, it is in the interest that it not be recognized by third parties, so that its fundamental rights are fully guaranteed; That is to say, we are not dealing with a personality of public relevance, in the sense that such relevance is sufficient to understand that it implies, ex lege, a dispossession of his fundamental right to the protection of his personal data, and (ii) although we are dealing with facts “of public relevance”, in the sense that they are revealed as “necessary” for the exposition of ideas or opinions of public interest, this need does not extend to providing data that identify the claimant. Therefore, and as the Supreme Court states in its (civil) judgment 697/2019, of 19 December 2019, the formation of a free public opinion does not require, nor justify, that the fundamental right to one's own image [in this case to the protection of personal data] be affected with such gravity and in a way that does not have the necessary connection with the identification of the person who is the object of the information. VI Classification and qualification of the infringement for the purposes of prescription In accordance with the evidence presented, in the present case, it is considered that EL ESPAÑOL has processed data that was excessive as it was not necessary for the purpose for which it was processed. Thus, the facts established constitute an infringement, attributable to EL ESPAÑOL, of article 5.1.c) of the GDPR, with the scope expressed in the previous Legal Basis, which implies the commission of the infringement specified in article 83.5, section a) of the GDPR, which under the heading "General conditions for the imposition of administrative fines" provides that: "Infringements of the following provisions shall be punishable, in accordance with section 2, by administrative fines of a maximum of EUR 20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual global turnover of the previous financial year, whichever is higher: a) the basic principles for processing, including the conditions for consent pursuant to articles 5, 6, 7 and 9; In this regard, the LOPDGDD, in its article 71 establishes that “The acts and conduct referred to in sections 4, 5 and 6 of article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this organic law, constitute infringements”. For the purposes of the limitation period, article 72 of the LOPDGDD indicates: Article 72. Infringements considered very serious. “1. Pursuant to the provisions of Article 83.5 of Regulation (EU) 2016/679, infringements that constitute a substantial violation of the articles mentioned therein and, in particular, the following are considered to be very serious and will be subject to a three-year statute of limitations: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 22/29 a) The processing of personal data in violation of the principles and guarantees established in Article 5 of Regulation (EU) 2016/679”. VII Sanction In order to determine the administrative fine to be imposed, the provisions of Articles 83.1 and 83.2 of the GDPR must be observed, which state: “1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article for infringements of this Regulation referred to in paragraphs 4, 9 and 6 are in each individual case effective, proportionate and dissuasive. 2. Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or as an alternative to the measures referred to in Article 58(2)(a) to (h) and (j). When deciding on the imposition of an administrative fine and its amount in each individual case, due account shall be taken of: (a) the nature, gravity and duration of the infringement, taking into account the nature, scope or purpose of the processing operation concerned as well as the number of data subjects affected and the level of damage suffered by them; (b) the intentionality or negligence of the infringement; (c) any measures taken by the controller or processor to mitigate the damage suffered by data subjects; (d) the degree of responsibility of the controller or processor, taking into account any technical or organisational measures they have implemented pursuant to Articles 25 and 32; (e) any previous infringement committed by the controller or processor; (f) the extent of cooperation with the supervisory authority in order to remedy the breach and mitigate any adverse effects of the infringement; (g) the categories of personal data affected by the infringement; (h) the manner in which the supervisory authority became aware of the infringement, in particular whether and, if so, to what extent the controller or processor notified the infringement; (i) where measures referred to in Article 58(2) have been previously ordered against the controller or processor concerned in relation to the same matter, compliance with those measures; (j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42, and (k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.” With regard to section k) of article 83.2 of the GDPR, the LOPDGDD, article 76, “Sanctions and corrective measures”, provides: “1. The sanctions provided for in sections 4, 5 and 6 of article 83 of Regulation (EU) 2016/679 shall be applied taking into account the grading criteria C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 23/29 established in section 2 of the aforementioned article. 2. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account: a) The continued nature of the infringement. b) The connection between the offender's activity and the processing of personal data. c) The benefits obtained as a consequence of the commission of the infringement. d) The possibility that the conduct of the affected party could have led to the commission of the infringement. e) The existence of a merger process by absorption after the commission of the infringement, which cannot be attributed to the absorbing entity. f) The impact on the rights of minors. g) Having, when not mandatory, a data protection officer. h) The submission by the responsible party or person in charge, on a voluntary basis, to alternative dispute resolution mechanisms, in those cases in which there are disputes between them and any interested party. In this case, considering the seriousness of the infringement found, taking into account especially the consequences that its commission causes in the claimant, the imposition of a fine is appropriate, in addition to the adoption of measures. The fine imposed must be, in each individual case, effective, proportionate and dissuasive, in accordance with the provisions of article 83.1 of the GDPR. Thus, the status of medium-sized company and the volume of business of the party being sued are considered, as a preliminary matter (…). In accordance with the provisions indicated, for the purposes of setting the amount of the fine to be imposed in the present case, it is considered that it should be graded in accordance with the following criteria established by the transcribed provisions: - Article 83.2.a) of the GDPR: Nature, seriousness and duration of the infringement: the Agency considers that the nature of the infringement is very serious since it causes the person to lose control over personal data, as they are disseminated through the Internet without restrictions. - Article 83.2.b) of the GDPR. Intention or negligence in the infringement: although the Agency considers that there was no intention on the part of the media, it is concluded that it was negligent in not ensuring a procedure that guaranteed the protection of personal data in such sensitive circumstances. - Article 83.2.g) of the GDPR. Categories of personal data affected by the infringement: although no “Special categories of personal data” have been affected, as defined by the GDPR in Article 9, the personal data to which the actions refer (image and voice of the complainant) is of a particularly sensitive nature, since it allows for the prompt identification of the person and increases the risks to their privacy. Considering the factors set out above, the value of the fine for the infringement of article 5.1.c) of the GDPR is 10,000 euros (ten thousand euros)>>. In its appeal, the appellant merely reproduces the arguments set out in the written pleadings submitted during the processing of the procedure that gave rise to the contested resolution, without considering the established facts and the grounds that serve as the basis for the agreement adopted, in which, in addition, the circumstances brought to light by said party are extensively analysed and the reasons that led to its dismissal are set out. Therefore, the arguments contained in the appeal are amply refuted by the transcribed arguments, which are considered valid and sufficient to reject the nullity of the requested sanctioning resolution, since the rights and freedoms susceptible to constitutional protection are not violated. The appeal now examined is based, once again, on the principles and jurisprudential criteria that are assessed for the weighing of the rights to honor, privacy and self-image against the freedoms of information and expression, which, although they may be guiding, are not transferable to the present case in the form intended by EL ESPAÑOL and do not replace or displace the principles that inform the normative order in terms of personal data protection, which are directly applicable and whose violation may be subject to sanction. With this approach, the AEPD does not deny, as it rightly reasons in its resolution, that the principles of personal data protection may be limited by the freedoms of expression and information, according to the weighing of these rights that must be carried out, in each case, when such rights collide. Thus, we agree with the statement made by EL ESPAÑOL regarding the possibility of a media outlet publishing personal data when it is necessary to provide the information in question. This is precisely the issue assessed to determine the infringement sanctioned in the contested resolution, which concludes after analysing the specific circumstances of the case, as set out in the transcribed grounds, that the processing of the image and voice of the interested party was not necessary for the informative purpose intended with the publication of the news item that is the subject of the actions. In contrast to the above, EL ESPAÑOL maintains the approach adopted in its written allegations to the opening of the procedure and proposed resolution formalised in the contested procedure. Thus, EL ESPAÑOL considers that the analysis of the case must be carried out taking into account only what it calls the "legitimizing requirements" of the right to freedom of information, namely, the relevance, public interest and veracity of the news, to which it believes the data protection regulations must be subject. It goes so far as to affirm that imposing a sanction restricts that freedom and C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 25/29 that the principle of data minimization, considering the obligations it entails, cannot be fulfilled by a communication medium. In support of this approach, EL ESPAÑOL resorts to the possibility of establishing exceptions to the personal data protection regulations when the processing is carried out for journalistic purposes or by information professionals, reflected in Recitals 4 and 153 and article 85 of the GDPR. If heeded, this approach would in practice mean the non-application of the personal data protection regulations to the exercise of journalism and could lead to the indiscriminate publication of personal data without any type of limitation. All of this was answered in the opposite way in Legal Basis II of the contested resolution, which includes the AEPD's response to the allegations to the proposed resolution formulated by EL ESPAÑOL, to which it is now appropriate to refer. However, it is considered appropriate to reiterate and emphasize again, first of all, that the AEPD does not understand the reasons that prevent a media outlet from complying with the principles relating to the processing of personal data, regulated in Article 5 of the GDPR, which includes, for what is of interest here, the principle of data minimization, which requires reducing the processing to those data that are adequate, pertinent and limited to what is necessary in relation to the purposes for which they are processed. It should be clarified that EL ESPAÑOL does not express in its appeal any reason for not applying this principle to the processing of personal data involved in the exercise of its activity as a means of communication, unlike what was expressed in its previous allegations, in which simple economic or human reasons were adduced, such as the lack of knowledge of the norm by the professionals of the medium, which are not mentioned now in its appeal writing, which were not considered sufficient, obviously, to accept the approach defended by the appellant entity. On the other hand, it is pertinent to add that the provisions included in the GDPR in Recitals 4 and 153 and in its article 85 of the GDPR, on the possibility that the Member States establish exceptions and exemptions from the provisions of this rule for processing carried out for journalistic purposes, are motivated by the establishment of a specific regulation to balance and reconcile the right to the protection of personal data with freedom of expression and information. This mandate, that of the need to reconcile these rights, has been respected in the resolution that gives rise to this appeal, without renouncing the analysis of the "legitimizing requirements" of the right to freedom of information mentioned by EL ESPAÑOL, which have been taken into account in this case, as can clearly be seen in the Grounds of the resolution, and in others of a similar nature, having found on occasions that the right to freedom of information took precedence over the right to data protection, according to the circumstances concurrent in each case individually considered. It cannot therefore be said, as EL ESPAÑOL does in its appeal, that the resolution in question represents a change of criteria with respect to previous actions. The contested decision also answers other questions reiterated in the appeal, such as the one regarding the professionalism attributed to a means of communication C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 26/29 and the effect that this has on the level of regulatory compliance that can be required of it in the matter we are dealing with. On this issue, EL ESPAÑOL considers that the AEPD requires a higher degree of diligence and that it does so on the basis of a judgment issued in a case of inclusion of data in a credit information file, which is true. However, the factual situation that gave rise to the judgment of the National Court invoked in the decision does not detract from the validity of the general declaration that it makes when it states that “in the assessment of the degree of diligence, the professionalism or lack of professionalism of the subject must be specially considered”. This assessment made by the resolution does not imply imposing on a media outlet requirements that are not equally applied to another entity with the same level of professionalism, belonging to any other sector of activity. In any case, as already indicated in the contested resolution, “it is not the AEPD, as EL ESPAÑOL points out, that demands this special responsibility, but rather it is the applicable rule itself that assesses circumstances such as risk or professionalism, already indicated, the context or the state of the art, among others.” On the other hand, EL ESPAÑOL defends in its appeal the relevance of the data processed in light of the interested party's status as a public figure and the need to use and disseminate his image and voice, as well as the accessory nature of the images that illustrated the published information. EL ESPAÑOL claims that the interested party's status as an "anonymous individual" is lost with the viralization of the video that had already occurred when its news was published on the website "elespañol.com", in reference to the concept of "supervening relevance". This AEPD does not agree that the viralization of the video in question causes the interested party to lose his status as an anonymous private person and turns him into a person of public relevance. In any case, even if this were the case, the publication of said video without subjecting it to a process of anonymization of the personal data of the interested party is not justified, since the images shown belong strictly to the scope of his privacy. It is already known that for the publication of images it is not enough for the interested party to be a person of public relevance, but it is also necessary that the image shows an act related to the public activity of the person or related to a public event. EL ESPAÑOL also insists on pointing out that it is not understood that the sanctioning resolution maintains that it is not possible to prove the participation of the complainant in the viralization of the video. However, there is no evidence in the proceedings that proves the intention of the complainant in the dissemination of the video, which was uploaded to a social network by a third party without anything showing that the complainant participated in this act. Furthermore, even if the complainant had disseminated it on his own social network profiles, this dissemination does not legitimize the subsequent use by a means of communication without having the prior consent of the interested party for this use of his personal data, disclosing them in a different way, as is clear from what was declared by the Supreme Court in Judgment No. 91/2017, dated 02/15/2017, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 27/29 already cited in the resolution that motivates the appeal. In the Supreme Court Judgment 593/2022, of July 28, regarding the publication by a media outlet of a video uploaded to YouTube with the consent of the actor, cited by the appellant, the issue regarding the role that social networks play on the Internet and their impact on fundamental rights is addressed. It cites STC 27/2020, of February 24, as follows: “The aforementioned STC 27/2020, of February 24, refers to this new panorama, with respect to platforms such as Facebook, Twitter, Instagram or Tuenti. From its reading, the following constitutional doctrine can be obtained, in summary: (i) Users of social networks continue to be holders of fundamental rights and their content remains the same as in the analog era. (ii) The fact that private data circulate through social networks on the Internet does not mean that what is private has become public, since the digital environment is not comparable to the concept of "public place" referred to in Organic Law 1/1982, nor can it be said that citizens of the digital society have lost or renounced the rights protected in art. 18 CE. (iii) The constitutional recognition of the fundamental rights included in art. 18 CE, entails the power of the person to control the data that circulate in the social network and that concern him. (iv) Unless there is an unequivocal authorization for the capture, reproduction or publication of the image by its owner, interference with the fundamental right to one's own image must necessarily be justified by the overriding public interest in having access to it and in disseminating it. (v) The owner of the fundamental right must authorize the specific act of using his image and the purposes for which he grants it. The consent given, for example, for the capture of the image does not extend to other subsequent acts, such as its publication or dissemination. In the same way, it must be understood that the authorization of a specific publication does not extend to other publications, whether they have the same or different purpose as the original one. Nor does the permission for use granted to a specific person extend to other possible recipients. In short, it must be understood that consent that was initially given for a specific occasion or purpose cannot be considered as indefinite and binding. Nor does this Agency dispute the dissemination of the video together with the published news. It is simply a matter of demanding the establishment of adequate guarantees for the protection of personal data subject to processing with the use of said audiovisual content, with its publication; guarantees that, in this case, do not denaturalize the informative interest of the news. With this, the AEPD exercises the powers that the law attributes to it as a control authority in the matter of personal data protection, which do not in any way imply the performance of any type of control over the content of the information published by the media. As for the accessory nature of the images alleged by EL ESPAÑOL, this is also a concept related to the right to honour, privacy and one's own image, as recognised by the appellant itself, which has been interpreted by our jurisprudence, allowing the publication of anonymous images of people to accompany a news item provided that the privacy of the person is not affected and this person does not constitute the main object of the information, the contrary to what occurs in the case at hand. Finally, as regards the amount of the fine imposed, which the appellant considers disproportionate, the appeal makes no mention of the factors and criteria of grading assessed in the resolution, nor of the reasons that led to the dismissal of that alleged lack of proportionality, which is now raised again based on the same circumstances rejected in the resolution, some of which are more related to the substantive issues that have determined the infringement than to the circumstances that led to the determination of the amount of the fine. III Conclusion Consequently, in the present appeal for reconsideration, the appellant has not provided new facts or legal arguments that allow the validity of the contested resolution to be reconsidered. IV Late resolution Due to reasons of operation of the administrative body, therefore not attributable to the appealing party, to date the mandatory statement of this Agency regarding this appeal has not been issued. In accordance with the provisions of art. 24 of Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations (LPACAP), the meaning of administrative silence in the procedures for challenging acts and provisions is dismissive. However, and despite the time elapsed, the Administration is obliged to issue an express resolution and to notify it in all procedures, regardless of their form of initiation, as provided for in art. 21.1 of the aforementioned LPACAP. Therefore, it is appropriate to issue the resolution that ends the procedure of the appeal for reconsideration filed. In view of the above provisions and other provisions of general application, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: TO DISMISS the appeal for reconsideration filed by EL LEÓN DE EL ESPAÑOL PUBLICACIONES, S.A. against the resolution of this Spanish Data Protection Agency issued on June 19, 2024, in file EXP202309208. SECOND: TO NOTIFY this resolution to EL LEÓN DE EL ESPAÑOL PUBLICACIONES, S.A. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 29/29 THIRD: To warn the sanctioned party that the sanction imposed must be paid once this resolution is notified, in accordance with the provisions of article 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, within the voluntary payment period indicated in article 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17 December, by paying it into the restricted account number ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Data Protection Agency at the Bank CAIXABANK, S.A. or, otherwise, it will be collected during the executive period. If the date of notification is between the 1st and 15th of each month, both inclusive, the deadline for making the voluntary payment will be until the 20th of the following month or the next business day thereafter, and if it is between the 16th and the last day of each month, both inclusive, the payment deadline will be until the 5th of the second following month or the next business day thereafter. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of Law 39/2015, of 1 October, on the Common Administrative Procedure of Public Administrations (LPACAP), interested parties may file an administrative appeal before the Administrative Litigation Division of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of 13 July, regulating the Administrative Litigation Jurisdiction, within two months from the day following the notification of this act, as provided for in article 46.1 of the aforementioned Law. Finally, it is noted that in accordance with the provisions of art. 90.3 a) LPACAP, the final resolution may be provisionally suspended by administrative means if the interested party states his intention to lodge an administrative appeal. If this is the case, the interested party must formally communicate this fact by means of a letter addressed to the Spanish Data Protection Agency, presenting it through the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the other registries provided for in art. 16.4 of the aforementioned LPACAP. The interested party must also transfer to the Agency the documentation that proves the effective filing of the administrative appeal. If the Agency is not aware of the filing of the administrative appeal within two months from the day following notification of this resolution, it will consider the provisional suspension terminated. 180-21112023 Mar España Martí Director of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es