AEPD (Spain) - PS/00209/2021
|AEPD (Spain) - PS/00209/2021|
|Relevant Law:||Article 6(1) GDPR|
Article 83(2)(b) GDPR
Article 83(2)(g) GDPR
|Parties:||CLUB GIMNASIA RÍTMICA SAN ANTONIO|
|National Case Number/Name:||PS/00209/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish DPA fined a gymnastics club €5,000 for posting images of two children on its Instagram page, despite the express denial of consent by their mother.
English Summary[edit | edit source]
Facts[edit | edit source]
A rhythmic gymnastics club held an Instagram page called "RITMICASANANTONIO", in which images of children performing exercises were published. The mother of two minors had several times asked the club not to publish images of her daughters on the social networks and she had also made clear that she did not give the club the authorization to photograph and record her daughters, aged 10 and 12.
The club continued its conduct and posted another video in which the two girls appeared.
The mother then filed a complaint with the Spanish DPA (AEPD) in this regard.
Holding[edit | edit source]
The Spanish DPA deemed that the club had violated Article 6(1) GDPR, since it had published images of the complainant's daughters on Instagram, without having any legitimacy to do so. The club could not prove that it had the right to process the data of the complainant's minor daughters, since they did not have the mother's consent.
The Spanish DPA considered that the sanction to be imposed should be aggravated in accordance with the criteria established in Article 83(2)(b) GDPR: negligent character of the infringement, and Article 83(2)(g) GDPR: categories of personal data affected, in this case images of minors.
For these reasons, the AEPD fined the rhythmic gymnastics club €5,000.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/6 Procedure No.: PS / 00209/2021 RESOLUTION OF SANCTIONING PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following: BACKGROUND FIRST: Mrs. A.A.A. (hereinafter, the claimant) dated February 7, 2021 filed a claim with the Spanish Data Protection Agency. The claim is directed against CLUB GIMNASIA RÍTMICA SAN ANTONIO with NIF G57922429 (hereinafter, the claimed one). The claimant, mother of two girls, aged 10 and 12, who do gymnastics rhythm in the club against which the claim is directed states that on February 5 of 2021 asked the club to remove from their social networks all photos and videos in those whose daughters appeared. He adds that he has no record of having given his authorization, which was only given to the Federation, and in relation to competitions in the girls to participate. And that, in any case, from that moment denied expressly your permission to take pictures of the girls and to publish them in Internet. It also points out that at dawn on February 6, the club published a new video in which his daughters appear, having asked Instagram the removal of your images. And, among other things, it provides the following documentation: Complaint dated February 7, 2021, before the offices of the Guard Civil of the P. Sant Antoni de Portmany Post (Illes Balears). Photo of the complaint before the social network Instagram. Annex 1 of the federative license of 2021, where the authorizations appear given by the claimant. SECOND: In accordance with the provisions of article 65.4 of the LOPGDD, which has provided a mechanism prior to the admission for processing of claims that are formulated before the AEPD, consisting of transferring them to the Protection Delegates of Data designated by those responsible or in charge of the treatment, for the purposes provided for in article 37 of the aforementioned norm, or to these when there are no designated, the claim was transferred to the claimed entity within the framework of the File E / 01193/2021, so that it could proceed with its analysis and respond to the complaining party and this Agency within one month. THIRD: On February 9 and 22, 2021, the claimed person was requested through the electronic notifications and postal mail service, which will provide this Agency the next information: 1. The decision taken regarding this claim. 2. In the event of exercising the rights regulated in articles 15 to C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/6 22 of the RGPD, accreditation of the response provided to the claimant. 3. Report on the causes that have motivated the incident that has originated the claim. 4. Report on the measures adopted to prevent the occurrence of similar incidents, implementation dates and controls carried out to check its effectiveness. 5. Any other that you consider relevant. It is clear that the first of them was returned on February 20, 2021 for having the delivery period had expired and the second was delivered to the requested by the service Postcard on March 3, 2021. Once the period granted to the claimed person has elapsed without having responded to the request for information, in accordance with the provisions of article 65.2 of the LOPDGDD, the admission for processing agreement is signed on May 4, 2021 of this claim. FOURTH: On June 18, 2020, the Director of the Spanish Agency for Data Protection agreed to initiate a sanctioning procedure against the CLUB SAN ANTONIO RHYTHM GYMNASTICS with NIF G57922429 by virtue of the powers of attorney established in art. 58.2 of the RGPD and in articles 47, 64.2 and 68.1 of the Organic Law 3/2018, of December 5, Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), for the violation of article 6 of the RGPD, typified in Article 83.5 b) of the RGPD and considered very serious in 72.1.a), for the purposes of prescription, setting an initial penalty of 5,000 euros (five thousand euros). FIFTH: The Agreement to Initiate Sanctioning Procedure, was notified to the defendant electronically, the date of making available being June 18, 2021 and the automatic rejection date on the 29th of the same month and year, as credited by the certificate issued by the FNMT that is on file. SIXTH: Formally notified of the initiation agreement, the one claimed at the time of the This resolution has not submitted a brief of allegations, so it is application of what is stated in article 64 of Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations, which in its section f) establishes that in case of not making allegations within the established period on the content of the initiation agreement, it may be considered a proposal for resolution when it contains a precise pronouncement about the responsibility imputed, for which a Resolution is issued. In view of all the actions, by the Spanish Protection Agency of Data in this procedure the following are considered proven facts: PROVEN FACTS FIRST: It is established that the claimed has an Instagram page called "RITMICASANANTONIO" in which images of minors are published training. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/6 SECOND: That the claimant has stated to the defendant that she does not want publish images of their daughters on social networks, which they have not given their authorization to photograph and record their daughters. THIRD: On June 18, 2021, this sanctioning procedure was initiated by the violation of article 6 of the RGPD (legality of the treatment), being notified on the 29th of the same month and year. Not having made any allegations, the defendant, to the agreement Of start. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each control authority, and as established in articles 47 and 48 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and to solve this procedure. II The defendant is charged with committing an offense for violation of the Article 6 of the RGPD, "Legality of the treatment", which indicates in its section 1 the cases in which the processing of third party data is considered lawful: "1. The treatment will only be lawful if at least one of the following is met terms: a) the interested party gave their consent for the processing of their data personal for one or more specific purposes; b) the treatment is necessary for the performance of a contract in which the interested is part or for the application at the request of this of measures pre-contractual; (…) " III Sections b), d) and i) of article 58.2 of the RGPD provide the following: “2 Each supervisory authority shall have all the following powers corrective measures listed below: (…) b) direct a warning to any person in charge or in charge of the treatment when the processing operations have violated the provisions of this Regulation;" (...) “D) order the person in charge of the treatment that the operations of treatment comply with the provisions of this Regulation, where appropriate, in a certain way and within a specified period; " C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/6 “I) impose an administrative fine in accordance with article 83, in addition or in place of the measures mentioned in this section, depending on the circumstances of each particular case; " The offense is classified in Article 83.5 of the RGPD, which considers as such: "5. Violations of the following provisions will be sanctioned, in accordance with with section 2, with administrative fines of a maximum of EUR 20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual global business volume of the previous financial year, opting for the highest amount: a) The basic principles for the treatment, including the conditions for the consent in accordance with articles 5,6,7 and 9. " Organic Law 3/2018, on Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) in its article 72, under the heading "Infractions considered very serious ”provides: "1. Based on what is established in article 83.5 of the Regulation (E.U.) 2016/679 are considered very serious and will prescribe after three years the infractions that suppose a substantial violation of the articles mentioned in that one and, in in particular, the following: (…) a) The processing of personal data without the concurrence of any of the conditions of legality of the treatment established in article 6 of the Regulation (EU) 2016/679. " IV The documentation in the file provides evidence that the claimed, has an Instagram page called "RITMICASANANTONIO" in which images of minors performing exercises are published. That the claimant has stated several times to the defendant, the last of them on February 5, 2021, that does not want images of their daughters to be published on social networks and that they do not They have the authorization to photograph and record their daughters. Well, the complainant has violated article 6.1 of the RGPD, since published images on Instagram of the claimant's daughters, without having any standing for it. It does not accredit the legitimacy for the treatment of the data of the minor daughters, 10 and 12 years of age, of the claimant. It is noteworthy that information on these facts is required from the defendant, on 9 and on February 22, 2021, although it appears that the second of the notifications by the postal service on March 3, 2021, has not replied to this Agency. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/6 Likewise, it is established that the Agreement to initiate this proceeding was notified on June 29, 2021. However, the defendant has not carried out allegations to it. V In accordance with the evidence available for the facts presented constitute, by the claimed party, an infringement of the provisions of article 6.1 a) of the GDPR. Likewise, it is considered that the sanction to be imposed should be adjusted according to with the following criteria established in article 83.2 of the RGPD: As aggravating factors the following: In the present case we are facing serious negligent action (Article 83.2 b). Personal data is affected - the image, which makes them identifiable - of two minors, to whom the regulations of data protection protects in a special way (article 83.2g). Likewise, in accordance with the provisions of the aforementioned article 58.2.d) of the RGPD, the claimed person is ordered, as the person responsible for the treatment, so that in the within a month, take the necessary measures to remove the image of the minors, in accordance with the provisions of article 6.1 a), as well as the provision of means of proof accrediting compliance with the requirements. Therefore, in accordance with the applicable legislation and assessed the criteria of graduation of the sanctions whose existence has been accredited, the Director of the Spanish Agency for Data Protection RESOLVES: FIRST: IMPOSE CLUB GIMNASIA RÍTMICA SAN ANTONIO, with NIF G57922429, for a violation of Article 6 of the RGPD, typified in Article 83.5 of the RGPD, a fine of € 5,000 (five thousand euros). SECOND: ORDER CLUB GIMNASIA RÍTMICA SAN ANTONIO, with NIF G57922429 so that within a period of one month in accordance with the provisions of the article 58.2.d) of the RGPD, adopt the necessary measures to remove the Image of the two minors, in accordance with the provisions of article 6.1 a), as well as the provision of means of proof accrediting compliance with the required. THIRD: NOTIFY this resolution to CLUB GIMNASIA RÍTMICA SAN ANTONIO, with NIF G57922429. FOURTH: Warn the sanctioned person that the sanction imposed by a Once this resolution is enforceable, in accordance with the provisions of the art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations (hereinafter LPACAP), within the payment period C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/6 voluntary established in art. 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17, by means of their entry, indicating the NIF of the sanctioned person and the number procedure that appears in the heading of this document, in the account restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Agency Spanish Data Protection in the banking entity CAIXABANK, S.A .. In case Otherwise, it will be collected in the executive period. Once the notification has been received and once it is executed, if the date of execution is finds between the 1st and the 15th of each month, both inclusive, the deadline to carry out the Voluntary payment will be until the 20th of the following or immediately subsequent business month, and if is between the 16th and last days of each month, both inclusive, the term of the payment will be up to the 5th of the second following or immediate business month. In accordance with the provisions of article 50 of the LOPDGDD, the This Resolution will be made public once it has been notified to the interested parties. Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the interested parties may file, optionally, an appeal for reversal before the Director of the Spanish Agency for Data Protection within a period of month from the day following notification of this resolution or directly contentious-administrative appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within two months from the day following notification of this act, as provided in article 46.1 of the referred Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, the firm resolution may be suspended in an administrative way If the interested party expresses his intention to file a contentious appeal- administrative. If this is the case, the interested party must formally communicate this made by writing to the Spanish Data Protection Agency, Presenting it through the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through any of the rest records provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. Too must forward to the Agency the documentation that proves the effective filing of the contentious-administrative appeal. If the Agency is not aware of the filing of the contentious-administrative appeal within a period of two months from the day after the notification of this resolution, I would terminate the precautionary suspension. Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es