AEPD (Spain) - EXP202316921
From GDPRhub
| AEPD - EXP202316921 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | 10,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | EXP202316921 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | RP |
The DPA fined a school €10,000 for displaying a minor’s photo on posters without any legal basis, violating Article 6(1) GDPR.
English Summary
Facts
The Spanish Data Protection Agency (AEPD - Spain) received a complaint from the parents of a minor with a disability. The complaint concerned the display of two posters in the school playground and in the child’s classroom. The posters included a photograph of the minor, depicting them as a victim of aggression by another student, with pictograms showing undesirable behaviour.
The school (controller) argued that the posters served an educational purpose, citing legal obligations under Spanish education law, and claimed legitimate interest or parental consent based on a 2021 authorisation from the father for general school communications.
Holding
The AEPD found that the school processed personal data in the form of the minor’s photograph without a valid legal basis under Article 6(1) GDPR.
The AEDP stress the importance of consent, especially when dealing with children's personal data and held that the father’s authorisation only allowed use of the data subject image for general school publicity, not for posters about a violent incident. No express, specific, or informed consent was obtained for this use.
Also, the school’s reliance on legal obligations was deemed insufficient. The cited educational laws did not authorise public display of a child’s image without parental consent.
Finally, the AEPD held that the processing could not be based on a legitimate interest.. Even if educational in nature, the child’s fundamental rights and dignity outweighed any alleged school interest. The child and their parents could not have reasonably expected this use of the image. Consequently, the AEPD imposed an administrative fine of €10,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/17
• File No.: EXP202316921
RESOLUTION OF SANCTIONING PROCEEDINGS
From the proceedings initiated by the Spanish Data Protection Agency (hereinafter, AEPD) and based on the following:
BACKGROUND
FIRST: On November 5, 2023, a complaint was filed with the AEPD regarding a possible infringement attributable to the cooperative society ESCOLA LES CAROLINES COOP. V., with Tax Identification Number (NIF) F46114039 (hereinafter, ESCOLA).
The facts brought to the attention of this authority are as follows:
The complaint is filed by the parents of a minor with a disability, enrolled
at the school in question, who authorized the collection and processing of the minor's data
for the purpose of their teaching, stating that
the minor's image has been misused, as a
photograph of the minor has been included on posters displayed since December 19, 2022, in the schoolyard
and in the minor's classroom. These posters refer to a
situation in which the minor was subjected to various acts of aggression by a classmate. The complaint states that the removal of the
posters was verbally requested from the school.
On December 20, 2022, the child's mother removed
the poster located in the schoolyard herself, an area accessible to other parents of
children enrolled at the school, as it was an access point for picking up their
children. On December 30, 2022, she sent an email to the school administration requesting the removal of the poster located in the child's classroom.
This poster was removed on January 10, 2023, by the child's teacher, at the request of the child's
parents. They were later able to verify that the poster was located in the
Principal's office, visible to anyone who entered the space, as
they confirmed during a meeting held there on January 16, 2023.
The claimant provides the following documentation:
- Image of the family record book, proving that they are the parents of the affected minor.
- Disability certificate for the minor, dated September 2, 2022, from the
Valencian Regional Government.
- Image of the poster in question, showing the face of the affected minor and
the face of the other minor involved, the latter obscured to prevent identification, with pictograms
depicting situations considered undesirable.
- Image of the poster displayed in the classroom where the minor attends school.
- Email dated December 30, 2022, to the school administration requesting
the removal of the poster.
- Authorization form for the use of images of minors enrolled
at the center, prepared in April 2023 and signed by the complainant
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 2/17
expressly excluding the use of their child's image for posters such as the one
subject of this complaint.
SECOND: In accordance with Article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), this complaint was forwarded to the SCHOOL so that it could
analyze it and inform the AEPD within one month of the actions
taken to comply with the requirements of the data protection regulations.
The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), was notified on November 27, 2023, as evidenced by the acknowledgment of receipt included in the file.
On December 21, 2023, the respondent replied, acknowledging the display of two posters and justifying their design and display, without the need for consent, under Article 6.1.c) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR), as the legal basis,
referring to the Organic Law on Education, so that the center could carry out its teaching activities.
THIRD: On January 5, 2024, in accordance with Article 65 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), the complaint was admitted for processing.
FOURTH: The Sub-Directorate General for Data Inspection proceeded to carry out
preliminary investigative actions to clarify the facts in question, by virtue of the functions assigned to supervisory authorities in Article 57.1 and the powers granted in Article 58.1 of the GDPR and in accordance with the provisions of Title VIII of the LOPDGDD, requesting information from the respondent on January 18, 2024, who replied on February 1,
2024, providing the following information and statements:
- Copy of the email dated March 21, 2023, from the education inspector
of the Valencian Regional Government, which demonstrates that he was aware of the situation.
- Authorization from the minor's father, signed on September 14, 2021, for the
publication of images or recordings of his son in the context of
school and educational communication, prior to the subsequent one in April 2023 submitted by the
parents in their complaint.
- Report from the Data Protection Officer (DPO) on this incident, from
VERSIS ASESORES, undated and unsigned, in which the DPO analyzes the case and
concludes that there is no violation of data protection rights, since the SCHOOL's acquisition of the photograph
falls perfectly within the educational context. The PURPOSE for which this image is obtained is none other than to carry out the PEDAGOGICAL and EDUCATIONAL mission, which clearly does not focus solely on providing formal education, but also, as has been indicated numerous times, on ensuring the personal development and well-being of the students through the measures that the SCHOOL itself deems appropriate. The use of posters with pictograms and photographs, given the characteristics of the target audience (age of those involved in the aggression and the personal circumstances of the victim), is understood to perfectly fulfill the PEDAGOGICAL and EDUCATIONAL purpose of educating students in NON-VIOLENCE.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 3/17
The aforementioned report indicates that the legal basis for the processing of data is:
• Primarily the performance of a contract [Article 6.1.b) of the GDPR], consisting of the provision of educational services, within which the use of the poster to resolve the conflict falls.
• And compliance with a legal obligation [Article 6.1.c) of the GDPR] established in Additional Provision 23 of Organic Law 2/2006, of May 3, on Education (hereinafter, Organic Law 2/2006), making the requirement of consent unnecessary.
• - Justifies the need to include the child's image on posters in Decree
195/2022, of November 11, of the Consell, on equality and coexistence in the
Valencian education system, which in its First Additional Provision establishes
that “until the implementing regulations for this
decree are developed, the provisions relating to the
protocols for action and intervention in cases of school violence with
seriously detrimental consequences for coexistence in schools,
set forth in Order 62/2014, of July 28, of the Ministry of Education,
Culture and Sport, which updates the regulations governing the development
of coexistence plans in schools in the Valencian Community
and establishes the protocols for action and intervention in cases of
school violence, will remain in force.”
- The following measures were implemented:
• The situation and the measures implemented were reported to the Education Inspectorate.
• The family of the student who committed the assault was informed so that they were aware of the seriousness of the matter and the measures that had been put in place.
• The two children were separated to ensure the protection of the victim.
• Close monitoring and supervision of students were implemented both in the classroom and on the playground.
• The student's emotional state was assessed daily by the teacher.
• Posters with pictograms were designed for use by people who are illiterate due to age or disability. The
pictogram posters are a pedagogical tool for visual reinforcement
to remind both students that they must play in separate spaces
since one of the problems in that situation was
that both children were seeking each other out to play, and it also serves to
remind them that rough play is not allowed. The poster was designed to
teach both students that they cannot be together in the same
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 4/17
areas of the playground. The poster's design is not improvised, but rather
created by staff specializing in special education and speech and language therapy.
Regarding the measures adopted to prevent similar incidents and the controls carried out to verify their effectiveness, a procedure has been introduced whereby, in a similar case, before using the reinforcement poster tool, parents or guardians must give their consent to the poster's design and display location.
FIFTH: On May 1, 2025, the Presidency of the Spanish Data Protection Agency (AEPD) agreed to initiate sanction proceedings against the respondent, in accordance with the provisions of Articles 63 and 64 of the LPACAP (Law on the Common Administrative Procedure of Public Administrations), for the alleged infringement of Article 6.1 of the GDPR, classified in Article 83.5 of the GDPR, due to the processing by the school of the image of a minor without a legitimate legal basis. The corresponding sanction would be €10,000 (ten thousand euros).
SIXTH: Having been notified of the commencement agreement in accordance with the LPACAP, ESCOLA submitted on
May 26, 2025, a statement of allegations in which, in summary, it reiterates that the
display, starting on December 19, 2022, of the minor's image on posters
located in the playground and in the minor's early childhood education classroom, was a
specific, proportionate, protected action aimed at the minor's benefit, with the poster
displayed in the school playground for one day and the one located inside the classroom being removed on
January 10, 2023, coinciding with the return to school after the Christmas holidays, remaining in the principal's office. Furthermore, in these
allegations, the SCHOOL states that the placement of the posters falls
within the legitimate interests of the school and that, moreover, the child's father authorized the
use of the child's image in the context of school and educational communication,
without said consent having been revoked at the time the posters were put up. Therefore, it requests that the disciplinary proceedings be dismissed due to
the absence of a violation of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), the measure adopted by the
SCHOOL being aligned with the principle of the best interests of the child, enshrined in Article
3 of the Convention on the Rights of the Child and in Article 4 of the LOPDGDD.
The SCHOOL alleges that upon learning of the mother's concern, the image was removed without
opposition and that the school has at all times demonstrated good faith, a willingness to engage in
dialogue, and a desire to rectify any possible unintended consequences. Finally, if it is deemed that the action was not appropriate, it requests that the application of the principle of proportionality be assessed, given that it is a non-profit institution, and that, in accordance with Articles 77.2 of the LOPDGDD and 58.2.b) of the GDPR, any sanction be replaced with a warning.
SEVENTH: On June 24, 2025, a proposed resolution was formulated, proposing that ESCOLA be sanctioned for an infringement of Article 6.1 of the GDPR, classified in Article 83.5 of the GDPR, with a fine of €10,000.00 (ten thousand euros).
EIGHTH: Once the proposed resolution was notified in accordance with the rules established
in the LPACAP, the respondent submitted a written statement of allegations in which it reiterates
that the measure being challenged falls within the legitimate interest of the center
and does not respond to purposes unrelated to the educational environment, as well as the consent
on the part of the minor's father to the use of the minor's image for, among other
issues, use in the field of school and pedagogical communication. However, it questions the basis for the consent requirement set forth in
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 5/17
the proposed resolution based on Opinion 2/2009, of February 11, on the protection of personal data of individuals (General Guidelines and special reference to schools), of the Article 29 Working Party (hereinafter, Opinion 2/2009), as this is merely an advisory body. Finally, it requests that the disciplinary proceedings be dismissed due to the absence of an infringement and, alternatively, that any sanction be replaced by a warning, pursuant to Article 58.2.b) of the GDPR, as it is a non-profit social economy entity, acting immediately, with legitimate motivation, and without persistence or prejudice.
NINTH: According to the report obtained from the AXESOR tool, the
SCHOOL is a company established in 1992, with a turnover
of €938,911 in 2023.
From the actions carried out in this proceeding and the documentation
in the file, the following have been established:
PROVEN FACTS
FIRST: According to the information provided by the claimant, and
confirmed by the respondent, the SCHOOL displayed two posters,
one in the schoolyard and the other in one of its classrooms—and after being
removed, one was placed in the principal's office—showing
the face of the affected minor and that of the other minor involved, the latter obscured to prevent
identification, along with pictograms of situations considered undesirable. The poster located in the playground was displayed for one day and removed by the child's mother. The poster located in the child's classroom was displayed for 22 calendar days, 5 of which were school days, and was removed by the child's teacher at the request of the parents.
SECOND: In accordance with sections 1 and 2 of Article 4 of the GDPR, the processing of personal data by the SCHOOL is documented. The SCHOOL carried out the aforementioned activity in its capacity as data controller, as it is the entity that determines the purposes and means of such processing, pursuant to Article 4.7 of the GDPR.
THIRD: The SCHOOL has provided authorization from the child's father, signed on September 14, 2021, for the publication of images or recordings of his child in the context of school and educational communication. FOURTH: There is no record of consent from the minor's legal representatives
for the display of the minor's image on the posters displayed at the school.
The school stated that such consent was not necessary, as the
action in question was carried out in compliance with a legal obligation, established in
Additional Provision 23 of Organic Law 2/2002, of May 3, on Education.
FIFTH: In response to the transfer of the complaint
submitted, the school indicated that a procedure has been implemented whereby, before
using the reinforcement poster tool, parents or guardians must
consent to the poster design and its display location.
LEGAL BASIS
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 6/17
I
Jurisdiction
In accordance with the powers granted to each supervisory authority by Article 58.2 of the GDPR, and as established in Articles 47, 48.1, 64.2 and 68.1 of the LOPDGDD, the Presidency of the Spanish Data Protection Agency (AEPD) has jurisdiction to resolve this procedure.
II
Procedure
Likewise, Article 63.2 of the LOPDGDD (Spanish Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) establishes that: “The procedures
processed by the Spanish Data Protection Agency shall be governed by the provisions
of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them,
subsidiarily, by the general rules on administrative procedures.”
The procedure shall have a maximum duration of twelve months from the date
of the initiation agreement. After this period, the procedure shall expire and,
consequently, the proceedings shall be archived, in accordance with the provisions of
Article 64 of the LOPDGDD.
III
Preliminary Issues
The physical image of a person, pursuant to Article 4.1 of the GDPR, is personal data
and its protection is therefore subject to said Regulation. Specifically, Article 4.1 of the GDPR defines "personal data" as: "any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."
Article 4.2 of the GDPR defines "processing" as: "any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction."
Article 4.7 of the GDPR defines the “controller” as: “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its appointment may be laid down by Union or Member State law.”
In turn, Article 4.8 of the GDPR defines the "data processor" or
"processor" as the natural or legal person, public authority, agency, or other
body that processes personal data on behalf of the controller.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 7/17
Furthermore, Article 4 of the GDPR, in paragraph 11, defines the "data subject's consent" as any freely given, specific, informed, and
unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 7/17
On the other hand, Article 4 of the GDPR, in paragraph 11, defines the "data subject's consent" as any freely given, specific, informed, and
unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Consent of the data subject: ...tract of the data subject In this case, in accordance with the provisions of paragraphs 1 and 2 of Article 4 of the GDPR, the processing of personal data has been established, since
the SCHOOL, as the data controller, displayed posters including the image of a minor in the playground and one of its preschool classrooms starting on December 19, 2022,
without the specific consent of the minor's legal representatives.
The SCHOOL carried out this activity in its capacity as data controller,
since it is the entity that determines the purposes and means of such activity, pursuant to Article 4.7 of the GDPR.
IV
Response to the Objections to the Initial Agreement
In response to the objections submitted to the initial agreement, the Spanish Data Protection Agency (AEPD) reiterated in its proposed resolution that, according to the documentation provided by the complainant, and without any evidence to the contrary being provided by the school, the posters displayed the minor's face along with pictograms of situations considered undesirable. The posters were removed directly by the minor's mother the day after they were placed in the playground, and on January 10, 2023, the minor's class teacher removed the poster in the classroom at the request of the affected minor's parents. The parents had previously sent an email to the school on December 30, 2022, requesting the removal.
Regarding the legal basis for the display of said posters alleged by the
ESCOLA, the AEPD's proposed resolution noted that, in response to the transfer of the complaint, the ESCOLA referred to the execution of a
contract [Article 6.1.b) of the GDPR], consisting of the provision of the
education service, within which the use of the poster falls in order to eliminate the
conflict raised, and to compliance with a legal obligation [Article 6.1.c) of the
GDPR] established in Additional Provision 23 of the Organic Law. 2/2006 and in Order
62/2014, of July 28, from the Ministry of Education, Culture and Sport, which
updates the regulations governing the development of coexistence plans in the
educational centers of the Valencian Community and establishes the protocols for
action and intervention in cases of school violence (hereinafter, Order
62/2014), therefore, there was no need to require the consent of the
parents of the affected minor.
However, in the initial agreement, the Spanish Data Protection Agency (AEPD) indicated that although obtaining the
photograph of the minor by the educational center fell within the functions of the
educational center, its use must correspond to the educational and teaching mission for which
it was obtained; if this is not the case, as indicated in section 2 of Additional Provision 23 of Organic Law 2/2006, the express consent of the
legal representatives of the minor is necessary. And so, in the arguments presented by the
SCHOOL to the initial agreement, it went on to justify as a legal basis the legitimate interest
[Article 6.1.f) of the GDPR] and now, indeed, the existence of prior consent
Article 6.1.a) of the GDPR], referring to the authorization of the minor's father signed on September 14, 2021, for the publication of images or recordings of his son in the context of school and educational communication.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 8/17
September
2021 Therefore, in its proposed resolution, the Spanish Data Protection Agency (AEPD) indicated, with respect to the legitimate interest justification alleged by ESCOLA, that, as established by the repeated case law of the Court of Justice of the European Union (hereinafter, the CJEU), including, among others, the judgment of 9 January 2025, Case C-394/23, regarding the application of Article 6.1(f) of the GDPR, the processing of personal data will be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Therefore, three cumulative requirements are established for the processing of personal data to be lawful under Article 6.1(f) of the GDPR: that the controller pursues a legitimate interest; that the processing of personal data is necessary for the purposes of that legitimate interest; and that the interests or fundamental rights and freedoms of the data subject in the protection of the data do not override the legitimate interest of the controller or of a third party.
In this case, in accordance with Article 13.1.d) of the GDPR, the data controller is responsible, when obtaining personal data from a data subject, for informing them of the legitimate interests pursued when such processing is based on Article 6.1.f) of the GDPR and the consent requested by the school was, literally, for the dissemination of the school's activities, without any clear and unequivocal reference being made to measures such as the one that is the subject of this complaint. Thus, as already indicated, the consent given by the minor's father was for the "dissemination of information about the Les Carolines School and its activities in posters, flyers, and similar formats." Therefore, this did not include measures such as those adopted by the school when displaying
the aforementioned posters, especially considering the specific circumstances of
this particular case, with the child's image displayed not only in
their classroom but also in the schoolyard, and including situations that have been deemed
undesirable. The child's interests in protecting their image should have prevailed.
Following this line of reasoning, in its proposed resolution, the Spanish Data Protection Agency (AEPD) referred to Opinion
2/2009, which made a series of recommendations regarding the processing of children's personal data
in the school setting, following the principles also found
in international instruments, such as the United Nations Convention on
the Rights of the Child of November 20, 1989, cited by ESCOLA in
its response to the initial agreement. This opinion highlights the importance of obtaining valid consent for the processing of children's data, especially when it involves sensitive information, and the importance of that consent being explicit and unambiguous. Furthermore, the opinion emphasizes the need for an approach that considers the best interests of the child, particularly when dealing with data that could affect their development or well-being. Specifically regarding photographs of children, it notes that children and their legal representatives must be informed of the publication, and when dealing with individual photographs of specific children, as in this case, prior consent from their parents or legal representatives must be obtained.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 9/17
Therefore, in the proposed resolution, the AEPD reiterated that the authorization given
by the minor's father in September 2021, which ESCOLA used in its arguments against the initial agreement to justify the display of the minor's image on the controversial posters,
was given for the dissemination of ESCOLA's activities, which does not
include the measure adopted by the center, which, according to the center, was based on the provisions of the Organic Law. 2/2006 and in Order 62/2014, although the center has not provided the coexistence plan or internal regulations, in compliance with which the design and location of the posters were assessed, Order 62/2014 stipulates communication to the family and/or legal representatives of those involved and information to them of the proposed individual, organizational, and preventive measures and actions, which are not shown to have been carried out beforehand, nor were the content of said posters explicitly stated in this case. In fact, as has been demonstrated according to the information in the file, as soon as the minor's parents became aware of the existence and content of said posters, they requested their removal, without in any case having given their express consent to the measure adopted by the school.
Furthermore, in light of the allegations presented by ESCOLA, the AEPD was aware that the requirement for specific, informed, and unequivocal consent from the minor's legal representatives had already been established by ESCOLA itself following these events, as indicated in the proposed Resolution. ESCOLA informed the AEPD that, to prevent similar incidents from occurring, a procedure had been introduced whereby, in a similar case, before using the reinforcement poster tool, parents or guardians must consent to the poster's design and its display location.
V
Response to the allegations raised against the proposed resolution
The school again argues for the legitimate interest of the center and the consent of the minor's father
to the use of his image and questions the provisions of Opinion
2/2009 of the Article 29 Working Party, given that it is merely an advisory body.
In addition to reiterating what was already stated in section IV above and acknowledging that the aforementioned Opinion is not legally binding, this does not preclude the fact that the Spanish Data Protection Agency's (AEPD) reference to it serves as a guide for
supervisory authorities and data controllers, especially in the school setting. This Opinion emphasizes the need for explicit consent, which coincides with the requirements of Order 62/2014, namely, communication with the family and/or legal representatives of the minor, as well as informing them of the individual measures and actions, and the proposed organizational and preventative measures. There is no record that the school informed the minor's parents about the content of the posters and their display. In any case, this consent must comply with Article 4.11 of the GDPR, which defines "data subject's consent" as any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
(This refers to the processing of personal data relating to him or her.) C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 10/17
The need for this express and unequivocal consent has also been indicated by the courts, as in the judgment of the National Court of February 14, 2023, appeal no. 463/2020, which states that “only express consent will be valid, which must be given through a clear affirmative act that demonstrates a free, specific, informed, and unequivocal declaration of will by the data subject, in the sense that there is not the slightest doubt that there has been a manifest will on the part of said data subject.” And it is not established that the
consent given by the minor's father was in accordance with the requirements, since it was
granted for another purpose, namely, the dissemination of the activities of the educational center, but
not for the display of the minor's image in the controversial posters, without
that express consent for said action by the center being on record. As stated in
Supreme Court ruling 3212/2022 of July 28, 2022 (following what was already indicated in rulings 1225/2003 of December 24; 1024/2004 of October 18; 1184/2008 of December 3; and 311/2010 of June 2), the consent given to publish an image for a specific purpose—literally, “dissemination of the Les Carolines School and its activities on posters, flyers, and similar formats”—does not legitimize its publication for a different purpose, such as the one adopted in this case by the school when it displayed the aforementioned posters with the minor's image.
As ESCOLA itself states in the arguments presented to the proposed resolution, “the placement of the student's image on a poster located in the car and playground was done to foster empathy and care towards him on the part of the rest of the student body, as a preventative measure against further aggression. This measure falls within the legitimate interests of the school and does not serve purposes unrelated to the educational environment.” This purpose does not correspond to the dissemination of ESCOLA's activities,
for which consent was requested, nor does it fall within the alleged legitimate interest, in accordance with the provisions of Articles 6.1.f) and 13.1.d) of the GDPR, both with respect to the three cumulative requirements for the processing of personal data to be lawful, already indicated by the Spanish Data Protection Agency (AEPD) in the previous section IV,
and to the requirement for the data controller, when obtaining personal data relating to a data subject, to provide them with all the information
relating to said legitimate interest. In any case, in accordance with recital 47 of the GDPR, the interests and fundamental rights of the data subject may, in particular, prevail over the interests of the controller when personal data are processed in circumstances where the data subject does not reasonably expect such processing (judgments of 4 July 2023, Meta Platforms and Others, C-252/21 and of 12 September 2024, HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV, C-17/22 and C-18/22) and, as evidenced by the information in the file, the parents of the minor never consented to the use of the minor's image in these posters, objecting to it when they became aware of this fact.
ESCOLA also alleges a distorted interpretation by the AEPD in the
proposed Resolution, specifically regarding the new procedure adopted by ESCOLA. According to this procedure, in a similar case, before using the
reinforcement poster tool, parents or guardians must provide
consent to its design and display location. On the contrary, the sole
purpose of referring to this new measure communicated by ESCOLA when
submitting its arguments to the initial agreement was to highlight the measures already
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 11/17
implemented by ESCOLA to prevent situations like the one complained of. Therefore,
the proposed resolution did not propose any corrective measures, given
those already communicated by ESCOLA in response to the initial agreement to initiate
this sanctioning procedure.
Finally, in its arguments, ESCOLA requests that the disciplinary proceedings be dismissed due to the absence of an infringement and, alternatively,
that any sanction be replaced with a warning, pursuant to Article 58.2.b) of the GDPR, given that it is a non-profit social economy entity,
with immediate action, legitimate motivation, and without persistence or harm to the affected minor.
Regarding the allegations, it is worth recalling that Recital 148 of the GDPR refers to
serious infringements as opposed to minor ones, stating that “In the case of a minor infringement, or if the fine likely to be imposed would constitute a
disproportionate burden for a natural person, a warning may be issued instead of a fine. However, special attention should be paid to
the nature, seriousness and duration of the infringement, its intentional character, the
measures taken to mitigate the damage suffered, the degree of
responsibility or any relevant prior infringements, the manner in which the
supervisory authority became aware of the infringement, compliance with
measures ordered against the controller or processor, adherence to codes of conduct and any other aggravating or mitigating circumstances.”
In this case, we are not dealing with a natural person, as this
disciplinary procedure has been opened against a legal entity, and we are not dealing with a case
of a minor infringement, as explained in the proposed resolution, taking into account the
nature, scope, duration, and level of the damages suffered (Article
83.2.a) of the GDPR), the lack of due diligence (Article 83.2.b) of the GDPR), and, particularly,
the category of personal data affected by the infringement (Article
83.2.g) of the GDPR) – the image of a disabled minor – therefore, in no case could this disciplinary procedure be replaced by a warning,
without prejudice to the fact that the conduct for which this disciplinary proceeding has been opened
against ESCOLA, which is unlawful, does not allow for its liability to be mitigated by not imposing a financial penalty.
Finally, it should be noted that the provisions of
77.2 of the LOPDGDD and
58.2.b) of the GDPR do not apply to ESCOLA, as it is a
cooperative society established in 1992, which falls within the definition of a
undertaking. ESCOLA is a cooperative society that meets the
concept of an undertaking, in accordance with established EU case law, such as the
judgment of the CJEU of 13 February 2025 in Case C-383/23, which expressly
stated that, for the purposes of the GDPR, an undertaking is understood to be “any
entity that carries out an economic activity, irrespective of the legal status
of that entity and its means of financing”.
Therefore, the Agency considers that the allegations presented against the proposed resolution should be dismissed, noting that the arguments presented do not invalidate the essential content of the declared infringement nor do they constitute grounds for justification or exoneration.
VI
Breach of Obligation. Lawfulness of Processing, Article 6.1 of the GDPR
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 12/17
Article 6.1 of the GDPR establishes the following:
"1. Processing shall be lawful only if at least one of the following conditions applies:
a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
b) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
c) processing is necessary for compliance with a legal obligation to which the controller is subject;
d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
f) processing is necessary for the satisfaction of legitimate interests pursued
by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
The provisions of point (f) of the first paragraph shall not apply to processing carried out by public authorities in the exercise of their functions. "
In this case, in accordance with sections 1 and 2 of Article 4 of the GDPR, it is established that the ESCOLA has been processing personal data since December 19, 2022, by displaying two posters, one for one day in the schoolyard and the other in one of the classrooms, until January 10, 2023. Taking into account the Christmas holiday period of the 2022-2023 school year, according to the
resolution of June 14, 2022 (Official Gazette of the Valencian Community of June 16, 2022), issued by the Director General of Educational Centers, which establishes the school calendar for the 2022-2023 academic year in the Valencian Community, point Four states:
"The holiday periods for this school year will be as follows: 1. Christmas Holidays: from the From December 23, 2022, to January 6, 2023, both dates inclusive, the second poster was displayed for a total of 22 calendar days, of which 5 were school days.
The ESCOLA's acquisition of the minor's photograph falls within its functions, and its use must correspond to the educational and teaching mission for which it was obtained. If this is not the case, as indicated in section 2 of Additional Provision 23 of Organic Law 2/2006, express consent will be required. However, the only authorization requested by ESCOLA from the minor's legal representatives is the one generally requested from the legal representatives of minors enrolled in the center for the dissemination of its activities, as specifically indicated in the form submitted by the center to obtain said authorization. The center provided the authorization signed by the minor's legal representative in September. 2021 for the “dissemination of the Les Carolinas School and its activities in posters, flyers, and other similar formats,” and by the
defendant, the one subsequently signed in April 2023, indicating by hand by
the latter “no posters of negative reinforcement for other students.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 13/17
Furthermore, although the SCHOOL refers to the provisions of Order 62/2014, it has not
provided a coexistence plan or internal regulations, in compliance with which
the placement of the posters was designed and assessed, with Order 62/2014 stipulating the
communication to the families and/or legal representatives of those involved, as well as
informing them of the measures and actions of an individual nature, as well as the proposed organizational and preventative measures, which are not documented in this case. On the contrary, as soon as the minor's parents became aware of the existence of said posters on December 19, 2023, they requested their removal. Given the center's inaction, the minor's mother removed the poster located in the schoolyard the following day.
The poster displayed in the classroom was removed on January 10, 2023, by the minor's class teacher at the parents' request.
Consequently, the known facts are considered to constitute an infringement attributable to the school for violation of Article 6.1 of the GDPR.
VII
Classification of the infringement of Article 6.1 of the GDPR and its classification for the purposes of the statute of limitations
Article 83.5 of the GDPR classifies as an administrative infringement the violation of the following articles, which are They will impose, in accordance with paragraph 2, administrative fines
of up to €20,000,000 or, in the case of a company, an amount equivalent to up to 4% of its total annual global turnover for the previous financial year, whichever is higher:
"a) the basic principles for processing, including the conditions for consent pursuant to Articles 5, 6, 7 and 9;"
For its part, the LOPDGDD, in its Article 71, Infringements, states that:
"The acts and conduct referred to in paragraphs 4,
5 and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law, constitute infringements."
For the sole purpose of the limitation period, Article 72.1 of the LOPDGDD
establishes the following:
"Based on the provisions of Article 83.5 of Regulation (EU) 2016/679,
infringements that constitute
a substantial breach of the articles mentioned therein, and in particular, the following, are considered very serious and shall be subject to a three-year statute of limitations:
a) The processing of personal data in violation of the principles and safeguards
established in Article 5 of Regulation (EU) 2016/679."
VIII
Sanction for infringement of Article 6.1 of the GDPR
In order to determine the administrative fine to be imposed, the provisions of paragraphs 1 and 2 of Article 83 of the GDPR must be observed:
"1. Each supervisory authority shall ensure that the imposition of administrative fines under this Article for infringements of this Regulation referred to in paragraphs 4, 9, and 6 is, in each individual case, effective, proportionate, and dissuasive.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 14/17
2. Administrative fines shall be imposed, depending on the circumstances of each individual case, either in addition to or as a substitute for the measures provided for in Article 58(2)(a) to (h) and (j). When deciding on the imposition of an administrative fine and its amount in each individual case, due consideration shall be given to:
(a) the nature, seriousness, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation concerned, as well as the number of data subjects affected and the level of damage suffered by them;
(b) whether the infringement was intentional or negligent;
(c) any measures taken by the controller or processor to remedy the damage suffered by the data subjects;
(d) the degree of responsibility of the controller or processor, taking into account the technical or organizational measures they have implemented pursuant to Articles 25 and 32;
(e) any prior infringements committed by the controller or processor;
(f) the degree of cooperation with the supervisory authority to remedy the infringement and mitigate its possible adverse effects. (g) the categories of personal data affected by the infringement;
(h) how the supervisory authority became aware of the infringement, in particular whether and, if so, to what extent the controller or processor notified the infringement;
(i) where the measures referred to in Article 58(2) have been previously ordered against the controller or processor concerned in relation to the same matter, compliance with those measures;
(j) adherence to codes of conduct pursuant to Article 40 or to approved certification mechanisms pursuant to Article 42; and
(k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.”
For its part, Article 76 “Sanctions and corrective measures” of the LOPDGDD provides:
“1. The penalties provided for in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the criteria for determining the severity of the penalty established in paragraph 2 of that Article.
2. In accordance with Article 83.2(k) of Regulation (EU) 2016/679, the following may also be taken into account:
(a) The ongoing nature of the infringement.
(b) The connection between the infringer's activity and the processing of personal data.
(c) The benefits obtained as a result of committing the infringement.
(d) The possibility that the data subject's conduct could have induced the commission of the infringement. C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 15/17
e) The existence of a merger by absorption subsequent to the commission of the infringement, which cannot be attributed to the acquiring entity.
f) The impact on the rights of minors.
g) Having a data protection officer, when not mandatory.
h) The voluntary submission by the controller or processor to
alternative dispute resolution mechanisms in cases where
disputes arise between them and any data subject.
In this case, considering the seriousness of the potential infringement, and
especially the consequences for the affected party,
a fine would be appropriate. The fine must be, in each case, individual,
effective, proportionate, and dissuasive, in accordance with Article 83.1 of the
GDPR. To guarantee these principles, the ESCOLA's turnover of €938,911 in 2023 is taken into account.
For the purpose of determining the amount of the penalty for the infringement of Article 6.1 of the GDPR against
the entity under investigation as the controller of said infringement, in accordance with
the available evidence, the balance of the circumstances
contemplated in Article 83.2 of the GDPR and 76.2 of the LOPDGDD, it is appropriate to
adjust the fine taking into account:
• The nature, seriousness, and duration of the infringement, considering the
nature, scope, or purpose of the processing operation in question, as well as
the affected data subject and the level of damage suffered
(Article 83.2.a) of the GDPR): the seriousness of the infringement is demonstrated by the
context of the improper processing of a minor's image in two posters with
pictograms of undesirable situations, specifically of aggression against said minor by another
classmate. One poster was displayed in the schoolyard,
accessible to the parents of other minors enrolled at the school, and
was displayed for one day. The other poster was displayed in the minor's classroom for 22
calendar days, five of which were school days. The display of these posters could not only
have a significant impact on the emotional and reputational well-being of the
minor, as stated by their parents after becoming aware of the display
not only were the posters displayed, but their continued presence in the child's immediate and sensitive environment, namely their classroom, was neither a one-off occurrence nor accidental.
The poster remained on display for the period indicated above,
despite the explicit and repeated objections of the child's parents.
This demonstrates a lack of proactive responsibility on the part of the school regarding the child's image.
• Intentionality/Negligence in the infringement (Article 83.2.b) of the GDPR): a serious lack of diligence is observed in compliance with the obligations imposed by data protection regulations, since despite the parents' request for the removal of said posters, it was the child's mother who proceeded to remove them repeatedly in the schoolyard, and in the classroom, the teacher removed them days later, after repeated requests from the parents. This demonstrates a lack of diligence on the part of the school once the parents expressed their disagreement with the display of the aforementioned posters.
• The categories of personal data affected by the infringement (Article 83.2.g of the GDPR): taking into account the type of data affected, in this case, the image of a disabled minor, and making inappropriate use of their image on the displayed posters.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 16/17
In light of the facts presented, it is considered appropriate to impose a sanction on the defendant for the infringement of Article 6.1 of the GDPR, as defined in Article 83.5 of the GDPR. The corresponding sanction is an administrative fine of €10,000.00 (ten thousand euros).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 16/17 Therefore, in accordance with applicable legislation and having assessed the criteria for determining the severity of the sanctions, the existence of which has been proven, the Presidency of the Spanish Data Protection Agency (AEPD) resolves:
FIRST: To impose on ESCOLA LES CAROLINES COOP. V., with Tax Identification Number (NIF) F46114039, for an infringement of Article 6.1 of the GDPR, as defined in Article 83.5 of the GDPR, a fine of €10,000.00 (ten thousand euros).
SECOND: To notify ESCOLA LES CAROLINES COOP. V. of this resolution.
THIRD: This resolution will become enforceable once the period for filing an optional appeal for reconsideration (one month from the day following notification of this resolution) has expired without the interested party having exercised this right.
The sanctioned party is hereby notified that they must pay the imposed sanction once this resolution becomes enforceable, in accordance with the provisions of Article 98.1.b) of the LPACAP, within the voluntary payment period established in Article 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in conjunction with Article 62 of Law 58/2003, of December 17, by making a deposit, indicating the sanctioned party's Tax Identification Number (NIF) and the procedure number shown in the heading of this document, into restricted account IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX), held in the name of the Spanish Data Protection Agency (AEPD) at CAIXABANK, S.A. Failure to do so will result in collection proceedings. in the enforcement period.
Once the notification is received and becomes enforceable, if the enforcement date falls between the 1st and 15th of each month, inclusive, the deadline for making a voluntary payment will be the 20th of the following month or the next business day thereafter. If the date falls between the 16th and the last day of each month, inclusive, the payment deadline will be the 5th of the second following month or the next business day thereafter.
In accordance with Article 50 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), this Resolution will be made public. Publication will take place once the resolution is final through administrative channels.
Against this resolution, which concludes the administrative process pursuant to Article 48.6 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), and in accordance with Article 123 of the LPACAP (Law on the Common Administrative Procedure of Public Administrations), interested parties may, at their discretion, file an appeal for reconsideration with the President of the AEPD (Spanish Data Protection Agency) within one month from the day following notification of this resolution, or directly file an appeal with the Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998 of July 13, regulating the Contentious-Administrative Jurisdiction.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 17/17 provided for in Article 46.1 of the aforementioned Law.
Finally, it should be noted that, in accordance with the provisions of Article 90.3.a) of the LPACAP,
the final administrative decision may be provisionally suspended if the
interested party expresses their intention to file an appeal with the Administrative Court.
If this is the case, the interested party must formally notify the AEPD of this fact by means of a written communication addressed to them, submitting it through the AEPD Electronic Registry
[https://sedeaepd.gob.es/sede-electronica-web/], or through one of the other
registries provided for in Article 16.4 of the LPACAP. They must also submit to the
AEPD the documentation that proves the effective filing of the appeal with the Administrative Court. If the Spanish Data Protection Agency (AEPD) does not receive notification of the filing of an administrative appeal within two months of the day following notification of this resolution, it will terminate the precautionary suspension.
938-180725
Lorenzo Cotino Hueso
President of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
