AEPD (Spain) - EXP202403325
| AEPD - EXP202403325 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 6(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 14.12.2023 |
| Decided: | 07.06.2024 |
| Published: | 26.02.2025 |
| Fine: | 10000 EUR |
| Parties: | n/a |
| National Case Number/Name: | EXP202403325 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | n/a |
An individual (controller) was fined €10,000 for unlawfully publishing the names, addresses, telephone numbers, data concerning health and images of ten data subject on Telegram and YouTube with the aim of encouraging others to make abusive phone calls.
English Summary
Facts
Between September 2023 & October 2024, seven data subjects filed complaints against a controller (an individual) for uploading their personal data to a Telegram group. The personal data included their full names, addresses, telephone numbers, images of the data subjects and data concerning health. This data was compiled in a list with disparaging comments about each data subject, along with a skull watermark. In each instance, the data subjects were amateur radio hosts and the controller was encouraging people to make abusive phone calls.
In October 2023, the controller uploaded a video to his YouTube channel including the name and telephone number of an eighth & ninth data subject, along with the word “blacksmith” and a watermark of a skull on the text. In October 2023, data subject eight & nine filed complaints with the DPA.
In April 2024, a tenth data subject filed a complaint with the DPA. In this instance, the controller had uploaded images of the data subject (as well as of others), their full address, date of birth and images of the data subjects with the message “want to fight?” inscribed upon it.
The DPA began investigating each claim between December 2023 & April 2024, grouping their investigation together as they relate to similar processing undertaken by the same data controller.
Holding
The DPA examined the lawfulness of the processing. They reasoned that no consent had been given by the data subjects and that no other legal basis would be applicable in the circumstances. They therefore found a violation of Article 6(1) GDPR.
In determining an appropriate sanction, the DPA had regard to the breadth of processing (ten data subjects), the intentionality in the processing, as well as the fact that the same controller had previously been fined €5,000 a year previously for similar facts. The DPA imposed an administrative fine of €10,000. The controller was also ordered to delete the unlawful processed personal data from the Telegram group and YouTube channel and to refrain from publishing the same in the future.
Comment
Same controller as in EXP202210999
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
