Banner2.png

AEPD (Spain) - EXP202403325

From GDPRhub
AEPD - EXP202403325
LogoES.jpg
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 6(1) GDPR
Type: Complaint
Outcome: Upheld
Started: 14.12.2023
Decided: 07.06.2024
Published: 26.02.2025
Fine: 10000 EUR
Parties: n/a
National Case Number/Name: EXP202403325
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Spanish
Original Source: AEPD (in ES)
Initial Contributor: n/a

An individual (controller) was fined €10,000 for unlawfully publishing the names, addresses, telephone numbers, data concerning health and images of ten data subject on Telegram and YouTube with the aim of encouraging others to make abusive phone calls.

English Summary

Facts

Between September 2023 & October 2024, seven data subjects filed complaints against a controller (an individual) for uploading their personal data to a Telegram group. The personal data included their full names, addresses, telephone numbers, images of the data subjects and data concerning health. This data was compiled in a list with disparaging comments about each data subject, along with a skull watermark. In each instance, the data subjects were amateur radio hosts and the controller was encouraging people to make abusive phone calls.

In October 2023, the controller uploaded a video to his YouTube channel including the name and telephone number of an eighth & ninth data subject, along with the word “blacksmith” and a watermark of a skull on the text. In October 2023, data subject eight & nine filed complaints with the DPA.

In April 2024, a tenth data subject filed a complaint with the DPA. In this instance, the controller had uploaded images of the data subject (as well as of others), their full address, date of birth and images of the data subjects with the message “want to fight?” inscribed upon it.

The DPA began investigating each claim between December 2023 & April 2024, grouping their investigation together as they relate to similar processing undertaken by the same data controller.

Holding

The DPA examined the lawfulness of the processing. They reasoned that no consent had been given by the data subjects and that no other legal basis would be applicable in the circumstances. They therefore found a violation of Article 6(1) GDPR.

In determining an appropriate sanction, the DPA had regard to the breadth of processing (ten data subjects), the intentionality in the processing, as well as the fact that the same controller had previously been fined €5,000 a year previously for similar facts. The DPA imposed an administrative fine of €10,000. The controller was also ordered to delete the unlawful processed personal data from the Telegram group and YouTube channel and to refrain from publishing the same in the future.

Comment

Same controller as in EXP202210999

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.