AEPD (Spain) - EXP202513088
From GDPRhub
| AEPD - EXP202513088 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1) GDPR Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 85 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 18.12.2023 |
| Decided: | |
| Published: | 11.12.2025 |
| Fine: | 20,000 EUR |
| Parties: | Objective Media |
| National Case Number/Name: | EXP202513088 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | RP |
The DPA fined a newspaper €20,000 for unlawfully publishing excessive personal data in an online article, violating Article 5(1)(c) GDPR.
English Summary
Facts
A data subject complained to the DPA after a digital newspaper, Objective Media (the controller), published an article that included a full copy of a document the data subject had sent to a public authority. The published document showed the data subject’s full name, identification number, home address, mobile phone number, and handwritten signature.
The controller argued that the publication fell within journalistic activity and that it served a legitimate public interest. They referred to Recital 4 GDPR, which explains that the right to data protection is not absolute, and Recital 153 GDPR, which requires Member States to reconcile data protection rules with freedom of expression and information. They also relied on Article 85 GDPR, which requires Member States to ensure that journalistic processing benefits from exemptions when necessary to protect freedom of information.
They argued that the processing had a legal basis under Article 6(1)(e) GDPR and that journalistic accuracy required publishing the full document, so readers could verify its authenticity. According to the controller, redacting the letter could create doubts about manipulation and reduce the credibility of the reporting. They added that Spanish case law, including decisions of the Constitutional Court and Supreme Court, often gave priority to freedom of information when the published data were truthful and had public interest. For this reason, they believed that publishing the full name, image and authorship of the document was part of the news and therefore lawful.
Holding
The DPA held that the controller breached the data minimisation principle in Article 5(1)(c) GDPR. The DPA recalled that the GDPR requires controllers to assess whether the processing of personal data is necessary and proportionate for the intended purpose, and to consider whether the same result can be achieved by less intrusive means. In line with Recital 39 GDPR, personal data must be limited to what is strictly necessary, and processing is disproportionate when the objective can “reasonably be achieved by other means” that create fewer risks for the data subject.
The DPA referred to the Court of Justice of the European Union judgment in Asociaţia de Proprietari bloc M5A-Scara A, C-708/18, which confirmed that Article 5(1)(c) GDPR reflects a proportionality requirement. If there are options to achieve the same purpose, the controller must choose the least invasive option. The DPA also noted that the right to data protection is not absolute. It may give way to other rights, such as freedom of expression and freedom of information. However, these rights are also not absolute and must be balanced case by case. In this balance, a key question is whether the interference with the data subject’s rights is necessary to achieve the journalistic aim.
The DPA accepted that the controller acted within the scope of freedom of information and that the news story concerned a matter of public interest. The DPA also accepted that the identity of the data subject was relevant to the story. However, the DPA emphasised that media outlets are still bound by the GDPR. They must identify a lawful basis under Article 6 GDPR, comply with the processing principles in Article 5 GDPR, and assess risks under Article 24 GDPR. In journalism, this includes assessing whether disclosing a particular item of personal data creates unnecessary or excessive risk when compared with the value the disclosure adds to the story.
The DPA found that the controller failed to perform this assessment The DPA rejected the argument that redaction would undermine credibility. It noted that blurring or masking personal data is a widespread and accepted practice in journalism. What mattered for the purposes of the story was identifying the signatory; this could be done by publishing their first and last names. The remaining personal data had no added journalistic value and created unnecessary risks for the data subject.
Accordingly, the DPA imposed a €20,000 fine to the controller. The controller accepted responsibility and paid the reduced voluntary fine.
Comment
The DPA affirmed that there was a legitimate basis for publishing the document, but didn't justify or explained its own reasoning.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/19
• File No.: EXP202513088
RESOLUTION TERMINATING THE PROCEEDINGS BY ACKNOWLEDGMENT
OF LIABILITY AND VOLUNTARY PAYMENT
From the proceedings initiated by the Spanish Data Protection Agency and based on the following
BACKGROUND
FIRST: On September 11, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against THE
OBJECTIVE MEDIA, S.L. (hereinafter, OBJECTIVE), by means of the Agreement transcribed below:
<<
File No.: EXP202513088
AGREEMENT TO INITIATE SANCTIONING PROCEEDINGS
Based on the actions taken by the Spanish Data Protection Agency and
on the following
FACTS
FIRST: On December 18, 2023, a complaint was filed with the
Spanish Data Protection Agency regarding a possible infringement attributable to THE
OBJECTIVE MEDIA, S.L., with Tax Identification Number B86757101 (hereinafter, OBJECTIVE).
The following facts are brought to the attention of this Authority in the complaint:
That on December 15, 2023, the online newspaper THE OBJECTIVE published on its website a
letter addressed by the complainant to the Government Delegation in the Autonomous Community of Navarre
to illustrate a news item concerning statements made by ***POSITION 1.
The image clearly displays the complainant's personal data, specifically:
name, surname, national identity document number, address, signature, and mobile phone number.
A screenshot of the publication on the website of the
cited media outlet is attached to the complaint.
SECOND: In accordance with Article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the aforementioned complaint was forwarded to OBJECTIVE so that it could analyze it and inform this Agency, within one month, of the actions taken to comply with the requirements established in the data protection regulations.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 2/19
The respondent has replied to the forwarding and request for information, stating the following:
It argues, firstly, that the publication is of journalistic interest. In this regard, they cite recital 4 of the GDPR, which reminds us that the right to data protection is not absolute and must be balanced with other fundamental rights, such as the right to information, and recital 153, which states that Member States must reconcile the rules governing freedom of expression and information, including journalistic freedom, with the right to data protection.
... It also mentions Article 85 of the GDPR, concerning the processing of personal data and freedom of expression and information, which states the following:
1. Member States shall reconcile by law the right to the protection of personal data under this Regulation with the right to freedom of expression and information, including processing for journalistic purposes (…)
2. For processing carried out for journalistic purposes or for the purposes of academic, artistic, or literary expression, Member States shall provide for exemptions or exceptions from the provisions of Chapters II (Principles), III (Rights of the Data Subject), IV (Controller and Processor), V (Transfer of Personal Data to Third Countries or International Organizations), VI (Independent Supervisory Authorities), VII (Cooperation and Consistency), and IX (Provisions relating to specific situations of data processing), if necessary to reconcile the right to the protection of personal data with freedom of expression and information.
Based on these principles, OBJECTIVE points out that:
“Thus, the GDPR itself recognizes a broader scope of action in relation to the processing of personal data, when such data processing is justified by the informational interest.”
It also cites Resolution E/03409/2018, issued by this Agency, which recalls that “the jurisprudence of the Constitutional Court tends to give precedence to freedom of expression over other constitutional rights.”
It also states that:
“It must be reflected that the right to freedom of information requires that the
information encompass the entire news story, all the reported facts
presented as true, and their known authorship, which justifies
including data such as the name, surname, and image of the person directly involved
as part of the “news story.” This is proclaimed in Supreme Court Judgment
No. 321/2001 (Civil Chamber), of March 29.”
In accordance with the above, OBJECTIVE maintains that the publication of the claimant's
personal data in the news article:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 3/19
“will be lawful, with THE
OBJECTIVE's right to freedom of information prevailing over the claimant's right to data protection, when
the information disclosed is truthful and of general interest.”
In this regard, it refers to the jurisprudence of the Constitutional Court and the Supreme Court regarding the veracity of the facts contained in a news item, as well as its public relevance, stating that both requirements are met in the publication of the news item that is the subject of the complaint.
Regarding the document containing the complainant's information, it states the following:
“With regard to the document sent by the complainant to the Delegation of the Government of Navarre, notifying them of the aforementioned event, it is understood that the information it contains is necessary to demonstrate its veracity. This is because the suppression or concealment of parts of the document could lead the reader to believe that it has been previously manipulated. Therefore, the publication of the entire document was deemed necessary, as it is justified from a journalistic and informational point of view.”
On the other hand, regarding the potential misuse and breach of the duty of custody
of the documents accompanying the news story, OBJECTIVE exercises its right not to
disclose its sources, as recognized by Article 20.1.d) of the Spanish Constitution.
Finally, OBJECTIVE states that, while it considers the publication of the news story
not to constitute a security breach, as it understands that the processing is
legitimized under Article 6.1.e) of the GDPR, it has proceeded to
prepare a “Guide to Good Practices in Data Protection for
journalists” and to appoint a Data Protection Officer.
Regarding this, it states:
“These actions are considered appropriate to minimize the probability of
similar incidents occurring. In any case, it must be
understood that journalistic activity involves the daily dissemination of
information and personal data, in many cases with the prior
consent or agreement of the data subject, therefore THE OBJECTIVE
considers the existence of new similar claims foreseeable.”
For all the above reasons, it requests the dismissal of the proceedings.
From the documentation provided, a possible violation of Article 5.1.c) of the
GDPR can be inferred.
THIRD: On January 18, 2024, this Agency gathered evidence that the
news item was still published on the OBJECTIVE website. As of the date of signing this
initiation agreement, it remains published on the media outlet's website.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 4/19
FOURTH: On March 18, 2024, in accordance with Article 65 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), the complaint was admitted for processing.
FIFTH: According to the report obtained from the AXESOR tool, the entity
OBJECTIVE is a company incorporated on June 12, 2013, with a turnover
of ***AMOUNT.1 euros in 2023.
LEGAL BASIS
I
Jurisdiction
In accordance with the powers granted to each
supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) and as established in Articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to initiate and resolve this procedure.
II
Procedure
Likewise, Article 63.2 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) establishes that: “The procedures
processed by the Spanish Data Protection Agency shall be governed by the provisions
of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder and, insofar as they do not contradict them,
subsidiarily, by the general rules on administrative procedures.”
In accordance with Article 64 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), and taking into account the
characteristics of the alleged infringement, a sanctioning procedure is initiated.
The procedure will have a maximum duration of twelve months from the date
of the initiation agreement. After this period, the procedure will expire and, consequently, the proceedings will be archived, in accordance with the provisions of
Article 64 of the LOPDGDD.
If no objections are raised to this initiation agreement within the stipulated period, it
may be considered a proposed resolution, as established in Article
64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of
Public Administrations (hereinafter, LPACAP).
III
Preliminary Issues
Article 4.1 of the GDPR defines “personal data” as: “any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 5/19
an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
Article 4.2 of the GDPR defines "processing" as: "any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction."
Article 4.7 of the GDPR defines "controller" as: "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its appointment may be laid down by Union or Member State law." Article 4.8 of the GDPR defines the "processor" as the natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.
In this case, in accordance with Articles 4.1 and 4.2 of the GDPR, personal data processing is taking place, since OBJECTIVE, among other processing activities, collects, stores, and disseminates a document containing personal data of natural persons, specifically their name, surname, national identity document number, postal address, mobile phone number, and handwritten signature.
OBJECTIVE carries out this activity in its capacity as controller, as it determines the purposes and means of such processing, pursuant to Article 4.7 of the GDPR.
IV. Breach of Obligation. Data Minimization
Article 5.1(c) of the GDPR stipulates:
"1. Personal data shall be:
(…)
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimization’);"
In this case, the proceedings were initiated following a complaint regarding the publication, by a media outlet, of personal data to illustrate a news article accessible online.
It is worth recalling that the legal system grants individuals the power to control their personal data, as well as its dissemination, and therefore, any person whose personal data is disseminated in violation of the law is entitled to protection.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 6/19
In this regard, Constitutional Court Judgment 292/2000, of November 30, establishes that:
“the content of the fundamental right to data protection consists of a
power of disposition and control over personal data that empowers the
individual to decide which of that data to provide to a third party, whether the
State or a private individual, or which that third party may collect, and which also
allows the individual to know who possesses that personal data and for what purpose,
being able to object to that possession or use. These powers of disposition and
control over personal data, which constitute part of the content of the
fundamental right to data protection, are legally specified in the
right to consent to the collection, obtaining, and access to personal data,
its subsequent storage and processing, as well as its use or
possible uses, by a third party, whether the State or a private individual. And this right to
consent to the knowledge and The processing of personal data, whether by computer or not,
requires, as essential complements, on the one hand, the
right to know at all times who has this personal data and
to what use it is being subjected, and, on the other hand, the right to object to that
possession and use.
The processing of personal data is regulated by the GDPR, which stipulates that it
must be governed by certain principles, including the principle of data minimization, which
is set out in Article 5.1.c) transcribed above.
Compliance with this principle requires, as a prerequisite, an assessment of the
necessity and proportionality of the processing operations in relation to the
purpose of the processing. In particular, taking into account whether the intended purposes can be
achieved in a less intrusive manner, as well as the risks to the protection
of fundamental rights and freedoms of individuals.
In this regard, Recital 39 of the GDPR states that:
“(…) Personal data must be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that their storage period is limited to a strict minimum. Personal data should only be processed if the purpose of the processing cannot reasonably be achieved by other means.”
As indicated in Recital 39, the principle set out in Article 5.1(c) is not met when the objective pursued by the processing can reasonably be achieved just as effectively by other means with less risk to the rights and freedoms of the data subjects.
Article 5.1(c) of the GDPR reflects the principle of proportionality (see the judgment of 11/12/2019, Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, paragraph 48), meaning that if alternatives exist to achieve the same purpose sought by the respondent, the least intrusive option must be chosen.
It should be clarified that the fundamental right to the protection of personal data is not absolute, as it could yield to the prevalence of other constitutionally recognized and protected rights and freedoms, such as, for example, the fundamental right to freedom of information or expression, which must be weighed on a case-by-case basis.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 7/19
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
7/19
In this regard, the Article 29 Working Party, in its Opinion 06/2014 on the concept of legitimate interest of the data controller under Article 7 of Directive 95/46/EC, when examining the legal basis for legitimate interest under Article 7(1)(f) of Directive 95/46/EC, which is fully transposed into the current Article 6(1)(f) of the GDPR, includes the right to freedom of expression or information as one of the cases in which the question of legitimate interest may arise, stating that:
“without prejudice to whether the interests of the controller will ultimately prevail over the interests and rights of data subjects when the balancing test is carried out.”
That said, the fundamental rights to freedom of information or expression are not absolute either. We can observe limits established by the courts in the civil sphere, in relation to the right to honor, to personal and family privacy, and to one's own image. Thus, it is worth citing Supreme Court Judgment 50/2017, First Civil Chamber, of January 27, 2017 (appeal 2139/2015), which states:
“In this regard, it is established case law (see, among the most recent, and
as a doctrinal summary, Judgment 605/2015, of November 3) that the
abstract prevalence of the freedoms of expression and information “can only
be reversed in the specific case by considering the relative weight of honor and
privacy according to the specific circumstances, provided that the
information and opinions disseminated refer to matters of general
interest or public relevance (due to the persons involved or the subject matter), that the unnecessary use or employment of unequivocally offensive or derogatory expressions is avoided in their communication, and, in the case of freedom of
information, provided that they are truthful, specifying in all cases that in the
scope of protection of the right to privacy the criterion for determining the
legitimacy or illegitimacy of intrusions is not that of veracity but rather
of the public relevance of the disclosed fact, that is, that its communication to
public opinion, even if true, is necessary based on
the public interest of the matter being reported on” (emphasis added).
It is not a matter of prioritizing one fundamental right over another, but rather of finding a balance between them that allows for their reconciliation; a reconciliation to which the European legislator refers in Article 85 of the GDPR. One of the elements to consider is precisely whether the intrusion (in this case, the processing of the complainant's personal data) is necessary to achieve the intended purpose; in this specific case, the publication of the news.
In short, media outlets process personal data in the exercise of freedom of information, are responsible for said processing, and, as such, must comply with the obligations set forth in the GDPR.
Among these obligations is the verification of the existence of a legal basis that
legitimizes the processing of personal data (Article 6.1 of the GDPR), the application of
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 8/19
the principles relating to processing (Article 5) or the performance of risk analyses
(Article 24) and the performance of data protection impact assessments
when necessary (Article 35).
In all processing of personal data, there are inherent risks to the rights and
freedoms of natural persons arising from it, which the data controller
must identify, assess, and evaluate in order to prevent or mitigate the
aforementioned risks from materializing. It must be taken into account that, on occasion, the
materialization of risks can have a significant impact on the rights and
freedoms of data subjects, that the damage may be irreversible and irreparable, and
the current technological context must also be considered.
With regard to the principle of data minimization enshrined in Article 5.1.c) of the GDPR, this implies that the media outlet must assess the dissemination of personal data to minimize the risk to the right to data protection.
In this case, as OBJECTIVE indicates in its response to the complaint, the purpose of the media outlet's processing is to report on a newsworthy event in which the complainant's identity is relevant.
Specifically, OBJECTIVE argues that publishing the news item does not constitute a security breach, as it understands that the processing is legitimized under Article 6.1.e) of the GDPR. Regarding the document containing the complainant's data, it states the following:
“With respect to the document sent by the complainant to the Government Delegation of Navarre, notifying them of the aforementioned event, it is understood that the data it contains is necessary to demonstrate its veracity. This is because the suppression or concealment of parts of the document could lead the reader to believe that it has been previously manipulated. Therefore, the publication of the full document was deemed necessary, as it is justified from a journalistic and informational perspective.”
However, even if there is a legal basis for publishing the document in question,
it could constitute a violation of the principle of data minimization insofar as it includes data that is not necessary for the intended purpose and that poses a risk to the rights of the affected person.
Thus, the purpose that OBJECTIVE indicates may require the publication of the claimant's first and last name if it is considered that their identity is part of the content of the news item, in order to demonstrate that they are the signatory of the document being reported on. However, this objective in no way entails the need to disseminate other personal data contained in the document, such as their national identity card number, their full postal address, their mobile phone number, or their handwritten signature.
The purpose that OBJECTIVE mentions (reporting the identity of the signatory of the document) is achieved with the mere publication of the first and last name.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 9/19
Nor can we accept OBJECTIVE's argument that the full publication of the document is necessary because the suppression or concealment of parts of it “could lead the reader to believe that it has been previously
manipulated,” given that publishing documents or images in which part of the content is blurred, hidden, or pixelated is a common and widespread practice in the media, particularly to avoid revealing the personal data of individuals mentioned in the information.
In short, in this case, as stated, the informational purpose of the
processing could clearly be achieved without making public the personal data of the
complainant mentioned above.
Therefore, in accordance with the evidence available at this time, and in accordance with the agreement to initiate sanctioning proceedings, it is considered that the known facts
could constitute an infringement, attributable to OBJECTIVE, for
violation of the article transcribed above.
V
Classification of the infringement of Article 5.1.c) of the GDPR and its classification for the purposes of
statute of limitations
Article 83.5 of the GDPR classifies as an administrative infringement the violation of the following
article, which will be sanctioned, in accordance with paragraph 2, with administrative fines
of up to EUR 20,000,000 or, in the case of an undertaking,
of up to 4% of its total annual global turnover
of the preceding financial year, whichever is higher:
"(a) the basic principles for processing, including the conditions for
consent pursuant to Articles 5, 6, 7 and 9;"
For its part, the LOPDGDD, in its Article 71, Infringements, states that:
“The acts and conduct referred to in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law, constitute infringements.”
For the sole purpose of the statute of limitations, Article 72.1 of the LOPDGDD
establishes the following:
“In accordance with the provisions of Article 83.5 of Regulation (EU) 2016/679, infringements that constitute a substantial violation of the articles mentioned therein, and, in particular, the following, shall be considered very serious and shall be subject to a three-year statute of limitations:
a) The processing of personal data in violation of the principles and guarantees established in Article 5 of Regulation (EU) 2016/679.”
VI
Proposed Sanction
In order to determine the administrative fine to be imposed, the provisions of Articles 83.1 and 83.2 of the GDPR must be observed. These provisions state:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 10/19
“1. Each supervisory authority shall ensure that the imposition of administrative fines under this Article for infringements of this Regulation referred to in paragraphs 4, 9 and 6 are, in each individual case, effective, proportionate and dissuasive.
2. Administrative fines shall be imposed, depending on the circumstances of each individual case, as an additional measure to, or in lieu of, the measures provided for in Article 58(2)(a) to (h) and (j). When deciding on the imposition of an administrative fine and its amount in each individual case, due consideration shall be given to the circumstances of the individual case.” The report shall include:
(a) the nature, seriousness, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation concerned, as well as the number of data subjects affected and the level of damage and loss suffered;
(b) whether the infringement was intentional or negligent;
(c) any measures taken by the controller or processor to remedy the damage and loss suffered by the data subjects;
(d) the degree of responsibility of the controller or processor, taking into account the technical or organizational measures implemented pursuant to Articles 25 and 32;
(e) any previous infringements committed by the controller or processor;
(f) the degree of cooperation with the supervisory authority to remedy the infringement and mitigate its possible adverse effects;
(g) the categories of personal data affected by the infringement;
(h) how the supervisory authority became aware of the infringement, in particular whether the controller or processor notified the infringement and, if so,
to what extent;
(i) where the measures referred to in Article 58(2) have been
previously ordered against the controller or processor concerned
in relation to the same matter, compliance with those measures;
(j) adherence to codes of conduct pursuant to Article 40 or to approved certification mechanisms
purchased pursuant to Article 42; and
(k) any other aggravating or mitigating factors applicable to the circumstances of the
case, such as financial benefits obtained or losses avoided, directly
or indirectly, through the infringement.”
For its part, Article 76 “Sanctions and Corrective Measures” of the LOPDGDD (Spanish Data Protection Law) provides:
“1. The sanctions provided for in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the criteria for determining the severity of the sanction established in paragraph 2 of said article.
2. In accordance with the provisions of Article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account:
a) The continuing nature of the infringement.
b) The connection between the infringer's activity and the processing of personal data.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 11/19
c) The benefits obtained as a consequence of committing the infringement.
d) The possibility that the affected party's conduct could have induced the commission of the infringement.” the infringement.
e) The existence of a merger by acquisition subsequent to the commission
of the infringement, which cannot be attributed to the acquiring entity.
f) The impact on the rights of minors.
g) Having, when not mandatory, a data protection officer.
h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms in those cases where disputes arise between them and any data subject.
In the present case, considering the seriousness of the possible infringement, and paying particular attention to the consequences that its commission has on the affected party,
a fine would be appropriate, in addition to the adoption of measures, if applicable.
The fine imposed must be, in each individual case, effective, proportionate, and dissuasive, in accordance with the provisions of Article 83.1 of the GDPR. To guarantee
these principles, the turnover of
OBJECTIVE, which was ***AMOUNT.1 euros in 2023, is considered beforehand.
For the purposes of deciding on the imposition of an administrative fine and its amount,
in accordance with the evidence available at this time of
the initiation of the sanctioning procedure, and without prejudice to the outcome of the
investigation, it is considered appropriate to determine the sanction to be imposed according to
the following circumstances, contemplated in the aforementioned provisions.
As a preliminary matter, the following circumstances are considered to exist:
• The nature, seriousness, and duration of the infringement, taking into account the
nature, scope, or purpose of the processing operation in question, as well as
the number of data subjects affected and the level of damage they have suffered (Article 83.2.a) of the GDPR): In this case, the publication of
various data of the data subject (specifically their national identity card number, full postal address,
mobile phone number, and handwritten signature), associated with their name and
surname, in an online media outlet implies the possibility of immediate and widespread dissemination of the content, which entails a loss of control and disposition over their personal data for the
data subject.
In this regard, the CJEU judgment of 1/08/2022 in Case C-184/20 (OT and Vyriausioji
tarnybinés etikos komisija) explains the amplifying effect of the internet, stating that:
“102 On the other hand, it is established that this processing leads to these personal data being freely accessible on the internet to the general public and, as a result, to a potentially unlimited number of people.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 12/19
In this specific case, it is worth referring to the data on visits to the media outlet and the website in question. Thus, according to information
published by the media outlet itself (https://theobjective.com/medios/2025-09-03/the-
objective-record-historico-audiencia/), OBJECTIVE would have had 3,588,372
unique users in July 2025, according to data from the company GfK Dam.
The figure for December 2024 was 2.57 million.
Furthermore, the publication of the news item with the aforementioned personal data has remained on OBJECTIVE's website, evidence of which was collected
by this Agency on January 18, 2024, and at the time of signing
this initial agreement, it remains published displaying the same data.
• Intentionality/Negligence in the infringement (Article 83.2.b) of the GDPR):
OBJECTIVE's actions may be considered negligent, given that the data could have been easily omitted by blurring the image or using a similar technique commonly used in the publication of information.
• Categories of personal data affected by the infringement (Article 83.2.g) of the GDPR): In this case, the disclosure of the complainant's national identity document number, as well as their address and mobile phone number, should be taken into account.
In this case, the complainant's national identity document number can be considered particularly sensitive data, as it allows for the direct and unambiguous identification of a natural person. As established by Royal Decree 255/2025, of April 1, which regulates the National Identity Document (DNI), the DNI is a general personal numerical identifier, sufficient to prove both the identity and nationality of the holder, making it a particularly sensitive element within the personal data ecosystem.
Furthermore, its misuse carries a high risk of identity theft, financial losses, or infringement of the right to honor, risks expressly contemplated in recital 75 of the GDPR. Therefore, a systematic and purposive interpretation of the GDPR (in accordance with recitals 51 and 75) allows the DNI to be considered a particularly sensitive piece of data, given its potential to cause significant harm in the event of unauthorized use.
On the other hand, the full postal address and mobile phone number are
data that allow the location of a natural person and private communication, which, in the context of public dissemination in a media outlet, as already indicated, can be considered
particularly sensitive, especially given that it concerns a
person of special public relevance.
In this regard, according to Guidelines 04/2022 on the calculation of
fines under the GDPR, when assessing this circumstance, reference should be made not only to the “types of data covered by Articles 9 and 10 of the
GDPR, but also to data outside the scope of these articles
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 13/19
whose dissemination causes immediate harm or difficulty to the data subject.” Among these,
it expressly mentions identity document numbers.
The assessment of the circumstances contemplated in Article 83.2 of the GDPR, with respect to the infringement committed by violating the provisions of Article 5.1.c) of the GDPR, allows for an initial administrative fine of €20,000.00.
VII
Corrective Measures
If the infringement is confirmed, the resolution issued may establish the corrective measures that the infringing entity must adopt to end the non-compliance with personal data protection legislation, in this case Article 5.1.c) of the
GDPR, in accordance with the provisions of Article 58.2.d) of the GDPR, according to which each supervisory authority may “require the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specific manner and within a specified time frame…”
Thus, the responsible entity may be required to adapt its actions to the personal data protection regulations, to the extent expressed in the preceding Legal Basis.
This document establishes the alleged infringement and the facts
that could give rise to this possible violation of data protection regulations, clearly outlining the measures to be adopted. However, the specific procedures, mechanisms, or instruments for implementing these measures are the responsibility of the sanctioned party, as the data controller is fully aware of their organization and must decide, based on
proactive responsibility and a risk-based approach, how to comply with the GDPR and the LOPDGDD.
However, in this case, notwithstanding the foregoing, in accordance with the evidence currently available regarding the initiation of disciplinary proceedings, the resolution adopted may require
OBJECTIVE to, within a maximum period of 3 months from the date of enforcement of the final resolution of these proceedings, adopt the following measure:
- Demonstrate the adoption of the necessary measures to guarantee
compliance with the provisions of Article 5.1.c) of the GDPR, to prevent the
publication or excessive dissemination of personal data.
Provide proof of having anonymized the personal data of the complainant contained in the disputed document, which are considered excessive for the purpose of the processing, such as their national identity card number, full postal address, mobile phone number, and handwritten signature.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 14/19
The imposition of this measure is compatible with the sanction consisting of an administrative fine, as provided for in Article 83.2 of the GDPR.
Please note that failure to comply with any order to adopt measures imposed by this agency in the resolution of this sanctioning procedure may be considered an administrative infringement in accordance with the provisions of the GDPR, classified as an infringement in Articles 83.5 and 83.6, and such conduct may lead to the initiation of further administrative sanctioning proceedings.
It is also noted that neither acknowledgment of the infringement committed nor, where applicable, voluntary payment of the proposed amounts, exempts the company from the obligation to take the necessary measures to cease the conduct or correct the effects of the infringement committed, and from the obligation to demonstrate compliance with this obligation to the Spanish Data Protection Agency (AEPD).
Therefore, in light of the foregoing, the President of the Spanish Data Protection Agency resolves:
FIRST: TO INITIATE SANCTIONING PROCEEDINGS against THE OBJECTIVE MEDIA, S.L., with Tax Identification Number (NIF) B86757101, for the alleged infringement of Article 5.1.c) of the GDPR, as defined in Article 83.5 of the GDPR.
SECOND: TO APPOINT S.S.S. as the investigating officer. and, as secretary, to R.R.R.,
indicating that they may be challenged, if applicable, in accordance with the provisions of
Articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector (LRJSP).
THIRD: TO INCORPORATE into the file, for evidentiary purposes, the claim
filed by the claimant and its documentation, as well as the
documents obtained and generated by the General Sub-Directorate of Data Inspection in the actions prior to the commencement of this sanctioning procedure.
FOURTH: THAT for the purposes provided for in art. 64.2.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, the applicable sanction would be an administrative fine of TWENTY THOUSAND EUROS (€20,000.00), without prejudice to the outcome of the investigation.
FIFTH: NOTIFY THE OBJECTIVE MEDIA, S.L., with Tax Identification Number (NIF) B86757101, of this agreement, granting it a period of ten business days to submit any allegations and present any evidence it deems appropriate. In its written allegations, it must provide its Tax Identification Number (NIF) and the procedure number shown in the heading of this document.
In accordance with the provisions of Article 85 of the LPACAP, it may acknowledge its responsibility within the period granted for submitting allegations to this initiation agreement. This will entail a 20% reduction of the
penalty to be imposed in these proceedings. With the application of this
reduction, the penalty would be set at €16,000.00, and the proceedings will be resolved with the imposition of this penalty.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 15/19
Likewise, at any time prior to the resolution of these proceedings, you may voluntarily pay the proposed penalty, which
will result in a 20% reduction of its amount. With the application of this reduction,
the penalty would be set at €16,000.00, and its payment will imply the termination
of the proceedings, without prejudice to the imposition of the corresponding measures.
The reduction for voluntary payment of the penalty is cumulative with the reduction applicable for acknowledging responsibility, provided that this acknowledgment is made within the period granted for submitting allegations upon the initiation of the proceedings. Voluntary payment of the amount referred to in the preceding paragraph may be made at any time prior to the resolution. In this case, if both reductions were to be applied, the penalty amount would be set at €12,000.00.
In any case, the effectiveness of either of the aforementioned reductions will be conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty.
Should you choose to make a voluntary payment of either of the amounts
indicated above (€16,000.00 or €12,000.00), you must do so
by depositing the funds into account number IBAN: ES00-0000-0000-0000-0000-0000
(BIC/SWIFT Code: CAIXESBBXXX) held in the name of the Spanish Data Protection Agency at CAIXABANK, S.A., indicating in the
description the procedure reference number shown in the header
of this document and the reason for the reduction you are applying for.
You must also send proof of payment to the General Sub-Directorate of Inspection
to continue with the procedure in accordance with the amount
deposited.
Finally, it should be noted that, in accordance with Article 112.1 of the LPACAP (Law on Administrative Procedure and Common Administrative Procedure),
no administrative appeal may be lodged against this decision.
1479-010725
Lorenzo Cotino Hueso
President of the Spanish Data Protection Agency
>>
SECOND: On October 2, 2025, OBJECTIVE paid the
fine in the amount of €12,000.00, taking advantage of the two reductions
provided for in the aforementioned Initial Agreement, which implies
acknowledgment of responsibility in relation to the facts referred to in the
Initial Agreement and their legal classification.
THIRD: In the aforementioned Initiation Agreement, it was stated that if
the infringement were confirmed, the responsible party could be required to adopt
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 16/19
appropriate measures to bring its actions into compliance with the regulations mentioned in this
act, in accordance with the provisions of Article 58.2 d) of the GDPR, according to which
each supervisory authority may “require the controller or processor to bring processing operations into compliance with the provisions of this
Regulation, where appropriate, in a specific manner and within a specified
time period…”.
Having received a letter from OBJECTIVE informing us that it has adopted the
necessary measures to prevent the recurrence of the events that led to the
infringement committed, this Agency acknowledges receipt thereof, without this
statement implying any pronouncement on the regularity or legality of the
measures adopted.
We draw attention to the provisions of Article 5.2 of the GDPR, which establishes the principle
of proactive responsibility when it states that “The controller shall be
responsible for compliance with paragraph 1 and able to
demonstrate such compliance.” This principle refers to the obligation of the
controller not only to design, implement, and observe the appropriate
legal, technical, and organizational measures to ensure that data processing is
in accordance with the regulations, but also to remain actively vigilant throughout the
processing lifecycle to ensure that such compliance is correct, and to be
able to demonstrate it.
LEGAL BASIS
I
Jurisdiction
In accordance with the powers conferred upon each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) and as established in Articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to resolve this procedure.
Likewise, Article 63.2 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) stipulates that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them, subsidiarily, by the general rules on administrative procedures."
II
Termination of the Procedure
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 17/19
Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), under the heading
“Termination of Sanctioning Procedures,” provides the following:
“1. Once sanctioning proceedings have been initiated, if the offender acknowledges their responsibility,
the proceedings may be resolved by imposing the corresponding sanction.”
2. When the sanction is solely monetary, or when both a monetary and a non-monetary sanction are applicable but the latter has been deemed inappropriate, voluntary payment by the alleged offender at any time prior to the resolution will terminate the proceedings, except with regard to restoring the altered situation or determining compensation for damages caused by the commission of the infraction.
3. In both cases, when the sanction is solely monetary, the competent body will apply reductions of at least 20% to the proposed sanction amount. These reductions are cumulative. These reductions must be specified in the notification initiating the proceedings, and their application is conditional upon the withdrawal or waiver of any administrative action or appeal against the sanction.
The percentage reduction provided for in this section may be increased by regulation.
III
Voluntary Payment and Acknowledgment of Responsibility
In accordance with the provisions of Article 85 of the LPACAP (Law on Administrative Procedure of Public Administrations), the notified initiation agreement informed the party of the possibility of acknowledging responsibility and making voluntary payment of the proposed penalty, which would entail two cumulative reductions of 20% each. With the application of these two reductions, the penalty would be set at €12,000.00, and its payment would result in the termination of the proceedings, without prejudice to the imposition of the corresponding measures.
Following notification of the aforementioned initiation agreement, OBJECTIVE has proceeded to acknowledge responsibility and make voluntary payment of the penalty, taking advantage of the two reductions provided for. In accordance with paragraph 3 of Article 85 of the LPACAP, the effectiveness of these reductions is conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty.
It should be noted that, In accordance with the provisions of the LPACAP (Law on the Common Administrative Procedure of Public Administrations), as well as the jurisprudence of the Supreme Court on this matter, the exercise of voluntary payment by the alleged offender does not exempt the administration from the obligation to resolve and notify all proceedings, regardless of how they were initiated. Likewise, Article 88 of the aforementioned law establishes that the resolution that concludes the proceedings will decide all issues raised by the interested parties and any others arising therefrom.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 18/19
Therefore, in accordance with the applicable legislation and having assessed the criteria for determining the severity of the sanctions, the President of the Spanish Data Protection Agency resolves:
FIRST: To declare the commission of the infringements and to confirm the sanctions determined in the operative part of the initial agreement transcribed in the This resolution.
The sum of the aforementioned amounts totals €20,000.00.
Following THE OBJECTIVE MEDIA, S.L.'s prompt payment and acknowledgment of responsibility, a 40% reduction of the aforementioned total is applied, pursuant to Article 85 of the LPACAP (Law on Administrative Procedure of Public Administrations), resulting in a final amount of €12,000.00.
The effectiveness of these reductions is conditional upon the withdrawal or waiver of any administrative action or appeal.
SECOND: To declare the termination of procedure EXP202513088, in accordance with the provisions of Article 85 of the LPACAP.
THIRD: To notify THE OBJECTIVE MEDIA, S.L. of this resolution.
FOURTH: In accordance with the provisions of Article 85 of the LPACAP, The reduction for voluntary payment is conditional upon the withdrawal or waiver of any action or appeal through administrative channels. This resolution will be final through administrative channels and fully enforceable upon notification.
In accordance with Article 50 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), this resolution will be made public. Publication will take place once the resolution has been notified to the interested parties.
Against this resolution, which concludes the administrative process as stipulated by Article 114.1.c) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, interested parties may file an appeal with the Administrative Chamber of the National Court, in accordance with Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the jurisdiction. Administrative Litigation, within two months from the
day following notification of this act, as provided for in Article 46.1 of the
referred Law.
However, in accordance with the provisions of Article 90.3 a) of the LPACAP, the final administrative decision may be
provisionally suspended if the interested party
expresses their intention to file an administrative litigation appeal. If this is the case,
the interested party must formally communicate this fact in writing
addressed to the Spanish Data Protection Agency, submitting it through the Agency's
Electronic Registry [https://sedeaepd.gob.es/sede-electronica-web/], or
through one of the other registries provided for in Article 16.4 of the aforementioned Law
39/2015, of October 1. They must also forward the documentation to the Agency.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 19/19
that proves the effective filing of the administrative appeal. If the
Agency is not notified of the filing of the administrative appeal within two months from the day following notification of this
resolution, the precautionary suspension will be terminated.
1219-101025
Lorenzo Cotino Hueso
President of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
