AEPD (Spain) - PS/00335/2019

AEPD - PS/00335/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1)(a) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	16.03.2020
Published:
Fine:	4,000 EUR
Parties:	n/a
National Case Number/Name:	PS/00335/2019
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The AEPD fined EUR 4,000 individual for taking pictures at the beach without the consent of the data subjects.

English Summary

Facts

The data processor took pictures of women at the beach. The pictures allowed an identification of the concerned women. The police filed a respective claim with the AEPD on July 9, 2019.

Dispute

Whether the taking of pictures in public without the consent of the data subjects infringes Article 6 (1) (a) GDPR.

Holding

The AEPD fined the data processor in an amount of 4,000 Euro for the violation of Article 6 (1) (a) GDPR. Since the women on the pictures can be identified, a consent was required for capturing the pictures. The fact that the women were in public does not harm their right of privacy. The opposite, the facts that the women were mainly not aware of the pictures and the pictures are quite sensitive make the strengthen of the privacy rights necessary. The intention of using the pictures on the phone and the denunciation of “sexual touching” in a public area were further taking into account for the fine.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

Procedure No.: PS / 00335/2019 
938-051119 
RESOLUTION OF PENALTY PROCEDURE 
Of the procedure instructed by the Spanish Agency for Data Protection and 
based on the following 
ACTS 
FIRST: CITY COUNCIL OF *** LOCALITY. 1 - LOCAL POLICE (* hereinafter, 
the claimant) on July 9, 2019, filed a claim with the Agency 
Spanish Data Protection, motivated by the data processing carried out at 
through cameras of a video surveillance system whose owner is identified as 
AAA with NIF *** NIF.1 (* hereinafter the claimed) installed in the claimed Mobile. 
The reasons on which the claim is based are “capturing photographs of women in 
the beach area near the *** *** RIVER.1 ”for sexual purposes. 
Along with the claim, he provides documentary evidence (Annex I) that proves the 
capturing the images of bathers without their consent, as they are in the 
mobile device hard drive. 
The frames provided allow the bathers to be identified, all of them 
teenagers, who are enjoying a day at the beach, all of them in bathing suits and 
from various angles without ever being aware of being 
being photographed / recorded by a third party unrelated to them. 
Photograph nº1. Girl strolling along the beach strolling, sharp front shot. 
Photograph nº2. Girl with her back walking on the beach. 
Photograph nº3. Girl sitting on poyete looking at her mobile. 
Photograph nº4. Girl running in a swimsuit by the beach area. 
Photograph nº5. Girl in sitting leisure pose. 
SECOND : In view of the facts reported, in accordance with the evidence 
available, the Data Inspection of this Spanish Agency for the Protection of 
Data considers that the processing of personal data carried out by the 
announced through the cameras to which the complaint refers, does not comply with the 
decisions imposed by the data protection regulations, so the 
opening of this sanctioning procedure. 
THIRD: On October 4, 2019 , the Director of the Spanish Agency for 
Data Protection agreed to initiate a sanctioning procedure for the claimed party, with 
glo to the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the Pro- 
Common Administrative assignment of Public Administrations (hereinafter, LPA- 
CAP), for the alleged violation of Article 6.1.a) of the RGPD, typified in Article 
83.5 of the RGPD. 
FOURTH: Once the aforementioned initial agreement has been notified, the defendant submitted a written 
allegations in which, in summary, it stated that the people photographed were 
his “cousins” that the State Security Forces and Corps did not leave him 
explain in any way. 
FIFTH: On 11/28/19 the procedure instructor agreed to open a 
practice period of tests, taking into account the previous actions 
of investigation, E / 08045/2019. 
Specifically, he was asked to provide reliable evidence that accredited 
the relationship of kinship that he used in his defense brief, leaving the 
same to prove such extreme. 
SIXTH: A list of documents in the 
procedure, reminding the defendant that if required, he has full access 
to the administrative file. 
SEVENTH: On 07/01/19 a resolution proposal is issued, where they are given by 
proven the facts transferred to this body, to be accredited the 
"Data processing" of third parties without the informed consent of their owners, 
outside the cases allowed by the Laws, proposing a sanction of 4000 € for the 
infringement of the content of art. 6.1 RGPD. 
FUNDAMENTALS OF LAW 
I 
By virtue of the powers that article 58.2 of the RGPD recognizes to each authori- 
control, and as established in art. 47 of Organic Law 3/2018, of 5 of 
December, on Personal Data Protection and guarantee of digital rights (in 
hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection 
is competent to initiate and resolve this procedure. 
II 
In the present case, we proceed to examine the claim dated 07/09/2019 after- 
Ladada by the City of Valladolid (Local Police) through which it is put 
In the knowledge of this Agency, the "capture of photographs of bathers" without their 
feeling with a sexual purpose. 
Article 6.1 RGPD provides the following: “The treatment will only be lawful if it 
meets at least one of the following conditions. 
a) The interested party gave their consent for the processing of their personal data- 
them for one or more specific purposes. (…) ” 
The images (personal data) are obtained by the accused surreptitiously, 
that is, without the consent of those affected, who were outsiders in all 
moment to the recording of your image. 
Article 18 EC provides “The right to honor, to personal privacy is guaranteed 
sonal and familiar and to the image itself ”. 
The Constitutional Court (STC 292/2000, November 30) BOE no. 4 of 
January 4, 2001) has declared that art. 18.4 CE contains, in the terms of the 
STC 254/1993, an institute guaranteeing the rights to privacy and honor and the 
full enjoyment of the remaining rights of citizens, which, in addition, is itself 
mo "a fundamental right or liberty, the right to liberty against potential 
assaults on the dignity and liberty of the person resulting from illegitimate use 
of mechanized data processing, what the Constitution calls 'computing' ", what 
which has been called "computer freedom" (FJ 6, reiterated later in the 
SSTC 143/1994, FJ 7, 11/1998, FJ 4, 94/1998, FJ 6, 202/1999, FJ 2). 
"This fundamental right to data protection, unlike the right to 
the privacy of art. 18.1 CE, with whom it shares the objective of offering an effective pro- 
constitutional provision of personal and family private life, attributes to its owner a beam 
of powers consisting for the most part of the legal power to impose on third parties 
the performance or omission of certain behaviors whose specific regulations 
tion must establish the Law, that which according to art. 18.4 CE Must Limit Use 
of computing, well developing the fundamental right to data protection 
(art. 81.1 CE), well regulating its exercise (art. 53.1 CE). The peculiarity of this right 
fundamental right to data protection with respect to that fundamental right so 
akin to that of intimacy lies, then, in its different function, what 
consequently, that their object and content also differ ” (* the underline belongs to 
this AEPD). 
As the Supreme Court has stated, the right to self-image is a 
personality right, recognized as a fundamental right in art. 18.1 of 
the Constitution and as an autonomous fundamental right by the Constitutional Court, 
and that, in its negative or exclusive facet, it grants the power to prevent obtaining, 
reproduction or publication of your own image by a third party without the consent 
express of the holder. 
It is this sense The Judgment of the Supreme Court of May 28, 2007 recognizes 
that: “The protection of the right to the image ex art. 7.5 of LO 1/1982 extends to 
the cases in which the photograph is captured on a beach or in another public place, without 
consent of the photographed person ”. 
The fact that the images are obtained in a public space does not imply 
"Elimination" of the subjective right and the renunciation of freedom in leisure spaces, thus 
as well as the activities that are carried out in these spaces according to the nature of 
the same (eg sunbathing, bathing, walking or even topless, etc). 
It is not unusual in today's times, when practically all 
citizens have mobile devices, to obtain images of spaces 
public, which are subsequently disseminated either on social networks or transmitted 
between individuals through messaging systems (vgr. whatsapp). 
In the present case, the photographs obtained are not the result of chance, 
but there is an active conduct of the accused in following his potential victims. 
but furtively, so that without their consent they obtain images of the same 
while they carry out activities according to the nature of this type of spaces (eg pa- 
searching, sunbathing, showering, etc.). 
The ease of obtaining a photograph with this type of device does not 
admits discussion, having assumed in practice, that anyone can become 
in a graphic “reporter” of facts and news in real time. 
The foregoing, however, cannot imply an elimination for practical purposes. 
of the right to the image, so that we can be recorded by anyone without 
our consent in public spaces that we go to for leisure purposes, 
rest, enjoyment, recreation, etc. 
In most cases the victims of these attacks on privacy are 
women or adolescents, who are affected at the core of their intimacy, restricting 
their freedom, being the object of photographs in swimming trunks, bikini, etc. with a lascivious purpose 
in some cases or mockery, unwarranted criticism, joke etc in others. 
Therefore, it is necessary to strengthen the protection of image processing 
as personal data, to fight against the dangers derived from an invasive use of 
new technologies, which among other things facilitate the taking of images without 
that the person affected can realize this, as well as its dissemination to wide 
audience members. 
III 
Article 6.1 of the RGPD (Legality of treatment) establishes the assumptions 
cretos under which the treatment of the personal data of the 
interested. 
In this case, from the documentation in the procedure, it is extracted that 
the accused has used his mobile device to obtain clear images of 
adolescent swimmers in a public area, without the express “consent” 
of them with a lewd a priori purpose. 
The images obtained are not accidental, because the documentary evidence 
contributed by the acting force (Annex I) allow verifying a follow-up of the 
affected, there being a clear intention to obtain images of them, 
to later enjoy these, for no apparent reason or reason. 
Article 77 section 5 of Law 39/2015 (October 1) provides as follows: 
"The documents formalized by the officials who recognize the condition 
of authority and in which, observing the corresponding legal requirements, 
take the facts found by those will prove these unless proven 
the contrary. " 
The above supposes a behavior of “treatment” without the consent of the holders. 
of the data, which are affected in their right to the image, which is affected 
This type of behavior, which is carried out in a furtive manner, without the 
but they know that they are being recorded by a third party unrelated to them. 
Furthermore, the images are stored in the memory of the device 
mobile position, which in its case would allow the non-consensual diffusion of the same in relation 
rights, hindering the protection of the affected right that could be the object of 
disclosure on a larger scale, aggravating the illegality of the act. 
IV 
The Supreme Court (Judgments of April 16 and 22, 1991) considers that the ele- 
point of guilt it follows “that the act or omission, described as infringement 
administratively punishable, must be, in any case, attributable to its author, 
for intent or recklessness, negligence or inexcusable ignorance . ” 
The Supreme Court (Judgments of July 5, 1998 and March 2, 1999) 
has been understanding that recklessness exists whenever a legal duty is neglected 
of care, that is, when the offending subject does not behave with the required diligence 
ble. Diligence whose degree of demand will be determined in attention to the circumstances 
concurrent companies in each case, such as the special value of the protected legal asset 
or the professionalism required of the offender. In this sense, the aforementioned Judgment of 5 
June 1998 requires professionals in the sector “ a duty to know especially 
the applicable norms ”. 
Applying the previous doctrine, the National Court requires the entities that operate 
in the data market, special diligence when carrying out the use or work 
treatment of such data or the transfer to third parties. And this because being the protection 
of data a fundamental right (Judgment of the Constitutional Court 292/2000), the 
custodians of this data must be especially diligent and careful when 
operate with them and they must always opt for the most favorable interpretation to the protection 
tion of the legal assets protected by the standard. In this sense, among others, Sen- 
Tences of the National Court dated February 14 and September 20, 2002 
and April 13 and May 18, 2005). 
The mere commission of an administrative offense — objective type — is not sufficient 
time to proceed to impose an administrative sanction. 
Guilt as reprehensibility to the active subject for injury to the property 
protected legal, is evident when the subject voluntarily performs the 
typical conduct intentionally aimed at obtaining the unlawful result, which 
is sought and loved 
Therefore, willful or negligent conduct must be involved, whether gross negligence 
or mild or simple, depending on the degree of neglect. 
In accordance with the evidence obtained in this sanctioning procedure 
dor, it is considered proven that the accused has proceeded to record on his device 
mobile images of bathers without their consent sneaking, proceeding to 
"Process personal data" of these without your consent. 
The known facts are constitutive of an infraction, attributable to the claim 
mado , for violation of art. 6.1 RGPD, without any of the circumstances 
reflected in it, to "process the data", even less the consent of the 
affected unaware of the described behavior. 
Article 83.5 RGPD provides the following: “Violations of the provisions- 
Subsequent measures will be sanctioned, in accordance with section 2, with administrative fines 
you go for a maximum of 20,000,000 EUR or, in the case of a company, a quantity 
equivalent to a maximum of 4% of the total global annual turnover for the year. 
previous financial year, opting for the largest amount: 
a) the basic principles for treatment, including conditions for 
consent pursuant to articles 5, 6, 7 and 9; (…). 
When motivating the sanction, the following criteria are taken into account: 
-The fact of obtaining images (personal data) without consent- 
of the holders, thereby affecting a constitutionally recognized right 
(art. 83.2 a) RGPD). 
-the intention of using the images for lewd purposes, making a 
improper use of your mobile device where you store them (art. 83.2 b 
RGPD). 
- the transfer of the facts by the State Security Forces and Corps- 
c, when required by the citizenry to denounce the presence of a real man 
using “sexual touching” in a public area and obtained images of third parties without 
your consent (art. 83.2h) RGPD). 
For all this, an encrypted sanction is imposed in the amount of € 4,000 (Four 
Thousand Euros) for infringement of the content of art. 6.1 RGPD, when “treating third-party data 
ros ”by obtaining photographs, without the consent of the 
mos (as), with a clear intention far from normal use. 
For the accused, no coherent explanation has been offered, and even less 
even provided objective evidence to corroborate what was stated in his brief 
tions. 
Consequently, the allegations of the accused must be rejected, 
be confirmed the concurrence of criminality and guilt in their offending conduct- 
ra. 
Therefore, in accordance with the applicable legislation and the criteria of 
graduation of sanctions whose existence has been proven, 
the Director of the Spanish Agency for Data Protection RESOLVES: 
FIRST: TO IMPOSE Don AAA , with NIF *** NIF.1 , for a violation of the article 
6.1.a) of the RGPD, typified in article 83.5 of the RGPD, a fine of € 4,000 (Four 
Thousand Euros), having treated third party data without your consent, infringement 
typified in article 83.5 a) RGPD, being punishable in accordance with art. 
58.2 RGPD. 
SECOND: NOTIFY this resolution to Don AAA 
THIRD: Warn the sanctioned that they must make effective the sanction imposed a 
once this resolution is executive, in accordance with the provisions of the 
art. 98.1.b) of Law 39/2015, of October 1, of the Administrative Procedure 
Common of Public Administrations (hereinafter LPACAP), within the payment period 
volunteer established in art. 68 of the General Collection Regulation, approved 
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, 
December 17, by entering, indicating the NIF of the sanctioned and the number 
of procedure that appears in the heading of this document, in the account 
restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Agency 
Spanish Data Protection at Banco CAIXABANK, SA Otherwise, 
will be collected in the executive period. 
Notification received and once executive, if the date of enforcement is 
finds between the 1st and 15th of each month, both inclusive, the deadline to carry out the 
Voluntary payment will be until the 20th of the following month or the next business day, and if is between the 16th and last day of each month, both inclusive, the term of the 
Payment will be until the 5th of the second following month or immediately following business. 
V
In accordance with the provisions of article 50 of the LOPDGDD, the 
This Resolution will be made public once the interested parties have been notified. 
Against this resolution, which ends the administrative procedure pursuant to art. 
48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the 
LPACAP, interested parties may file, optionally, appeal for reversal 
before the Director of the Spanish Agency for Data Protection within one 
month from the day after notification of this resolution or directly 
administrative contentious appeal before the Contentious-administrative Chamber of the 
National Court, in accordance with the provisions of article 25 and section 5 of 
the fourth additional provision of Law 29/1998, of July 13, regulating the 
Contentious-administrative jurisdiction, within two months from 
day after notification of this act, as provided in article 46.1 of the 
referred Law. 
Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the 
LPACAP, the firm resolution may be provisionally suspended in administrative proceedings 
if the interested party expresses his intention to file a contentious appeal- 
administrative. If this is the case, the interested party must formally communicate this 
made by writing addressed to the Spanish Agency for Data Protection, 
presenting it through the Electronic Registry of the Agency 
[https://sedeagpd.gob.es/sede-electronica-web/], or through any of the rest 
records provided in art. 16.4 of the aforementioned Law 39/2015, of October 1. Too 
You must transfer to the Agency the documentation that proves the effective filing 
of the contentious-administrative appeal. If the Agency had no knowledge of the 
filing of the contentious-administrative appeal within two months from the 
day after notification of this resolution, would terminate the 
precautionary suspension. 
Director of the Spanish Agency for Data Protection