AEPD (Spain) - ps-00107-2022
|AEPD - ps-00107-2022|
|Relevant Law:||Article 6(1) GDPR|
Article 83(2) GDPR
§169(1) Criminal Code
|National Case Number/Name:||ps-00107-2022|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||Michelle Ayora|
The Spanish DPA imposed a €5,000 fine on a 16 years-old teenager for using videos and pictures received via WhatsApp to blackmail a 13 year-old minor who could not express valid consent. The DPA also ordered the teenager to delete any other personal data regarding the data subject and to report about the measures adopted to do so.
English Summary[edit | edit source]
Facts[edit | edit source]
The 16 year-old (controller) and the 13 year-old (data subject) were in contact through Instagram and WhatsApp, where the data subject sent intimate images to the controller. After some time, the controller asked for more images and, to obtain that, the controller threatened and blackmailed the data subject by stating that those videos and images will be made public on social media. As a result, the data subject sent more images. For the above-mentioned facts, the defendant was sentenced by the Juvenile Court.
The data subject’s parent also submitted a complaint before the Spanish DPA, which initiated an investigative proceeding for an alleged violation of Article 6(1) GDPR.
The defendant claimed the violation of the constitutional principle non bis in idem since the controller was already found guilty of criminal threats by a juvenile court.
Holding[edit | edit source]
In the first place, the DPA challenged the claim regarding the principle non bis in idem. In order to guarantee legal certainty, no administrative sanction should be adopted if a criminal sanction was already applied for materially the same offence. However, the DPA held that in this case, the sanctioning offences were not the same. The DPA stated the necessary elements to consider sanctioning concurrence, that is, the similarity between subject, facts and ground. In the present case, there was only similarity regarding the subject; however, there was neither a factual nor a causal similarity. About the correlation of facts, the DPA stated that the juvenile criminal proceedings started and ended due to the violation of Article 169(1) of the Spanish Criminal Code (threatening the data subject) whereas the present sanctioning proceeding started due to the alleged violation of Article 6(1)(a) GDPR (unlawful processing of data subject’s personal data and void consent). Regarding the ground or reason, the DPA stated that in the juvenile criminal proceedings, the protected legal good was the right to freedom of choice whereas, in this administrative proceeding, it was the right to have one's personal data protected. Therefore, the DPA was allowed to start sanctioning proceedings against the controller.
Secondly, the DPA mentioned that the mere collection, register, and storage of the data subject’s images and videos made by the controller were enough to be considered as processing of personal data under Article 4(2) GDPR, hence making the GDPR applicable.
In third place, the DPA recalled the need for a legal basis for processing. Regarding consent, since the data subject was a minor, Article 7 of the National Legislation was applicable. The provision foresees that consent is only valid if given by someone over 14 years old. Otherwise, the consent of parents or another legal representative is mandatory. In the present case, the minor was 13 years old, therefore, the processing could not be based on consent in relation to Article 6(1)(a) GDPR since the consent could not be considered valid.
Finally, the DPA applied two aggravating circumstances of Article 83(2) GDPR: the nature scope and purpose of the processing concerned as well as the level of damage for the data subjects, and the intentional character of the infringement, since the defendant threatened the data subject, and this was proven by a judicial sentence. Similarly, the DPA applied one aggravating circumstance contained in Article 76(2)(a) of the National Legislation: prejudice to a minor.
On the other hand, the DPA applied the principle of proportionality as well as individualisation of sanctions and considered the defendant’s testimony about the deletion of the images and videos, which stopped the processing of such data.
The DPA imposed a fine of €5,000 for a lack of valid legal basis for processing under Article 6 GDPR, ordered the contrroller to delete any other personal data regarding the data subject and requested the controller to report about the measures adopted to do so.
Comment[edit | edit source]
In Spain, the administrative law allows minors over 14 years old to be administratively sanctioned for violations of such laws. In those cases, their parents become responsible for the payment (indirect liability) as explained by the DPA in this brochure: https://www.aepd.es/es/documento/responsabilidad-menores-padres-madres.pdf . The legal basis for this measure is Article 3 LPAC .
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.