AEPD - PS/00076/2021
|AEPD - PS/00076/2021|
|Relevant Law:||Article 6(1) GDPR|
|Parties:||CLÍNICA VIVANTA S.L|
|National Case Number/Name:||PS/00076/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD decision (in ES)|
The Spanish DPA held that where an employee had signed an image rights transfer agreement with their employer, prior to the display of an advertisement banner using the employee's image, this could be considered as a legal basis for data processing.
English Summary[edit | edit source]
Facts[edit | edit source]
A worker of a clinic lodged a complaint with the Spanish DPA because their employer had used their image for advertisement purposes without consent. They had placed huge banners with it in a display window.
The banners were on sight for more than a year, despite the worker's repetitive request, via different ways, for them to take them down.
Such banners were, however, taken down after the worker made a notarial request. The clinic alleged, mainly, that the worker had signed an image rights transfer agreement previous to the display of the banner.
Holding[edit | edit source]
The Spanish DPA held that the fact that the worker had signed an image rights transfer agreement previous to the display of the banner was considered as a legal basis for data processing. Hence, they did not find a violation of Article 6.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/6 Procedure No.: PS / 00076/2021 RESOLUTION OF SANCTIONING PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following: BACKGROUND FIRST: D. A.A.A., in the name and on behalf of D. B.B.B. (hereinafter, the claimant) on November 10, 2020, he filed a claim with the Spanish Agency for Data Protection. The claim is directed against CLÍNICA VIVANTA S.L with CIF B82809492 (hereinafter, Vivanta or claimed). The reasons on which the claim is based are that the claimant has been providing his services as a maxillofacial surgeon at the Vivanta Clinic, since September of the year 2009. Well, the claimed entity Vivanta, at the beginning of 2020 decided to make use of of the personal image of the claimant for advertising purposes of the clinic by putting in the shop window of this one a large poster with his image without ask him anything about it and he does not consent to such action. Likewise, on numerous occasions he has required those in charge of the clinic to to proceed to the removal of the poster with the claimant's image, both verbally as by means of a notarial request, without the complainant having proceeded to its withdrawal. Thus, the image without consent has been exposed to the public from the beginning of the year 2020, approximately one year, without the claimed attending the requirements for its withdrawal. Together with the claim, it provides the notarial request made. In the aforementioned requirement there are various photographs that certify the exhibition of the poster that motivates the presentation of the claim. SECOND: In accordance with article 65.4 of the LOPGDD, which has provided for a mechanism prior to the admission for processing of claims made before the AEPD, consisting of transferring them to the Data Protection Delegates designated by those responsible or in charge of the treatment, for the intended purposes in article 37 of the aforementioned norm, or to these when it has not designated them, it was given transfer of the claim to the claimed entity to proceed with its analysis and respond to the complaining party and this Agency within one month. THIRD: On December 4, 2020, the respondent was asked to will provide this Agency with the following information: 1. The decision taken regarding this claim. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/6 2. In the event of exercising the rights regulated in articles 15 to 22 of the RGPD, accreditation of the response provided to the claimant. 3. Report on the causes that have motivated the incident that has originated the claim. 4. Report on the measures adopted to prevent the occurrence of similar incidents, implementation dates and controls carried out to check its effectiveness. 5. Any other that you consider relevant. The writing was notified to the claimed party electronically being the date of acceptance of the notification on December 4, 2020, as evidenced by the certificate issued by the FNMT that is on file. Once the term granted to the claimed party has elapsed without having responded to the request for information, in accordance with the provisions of article 65.2 of the LOPDGDD, the admission for processing agreement is signed on February 10, 2021 of this claim. THIRD: On March 16, 2021, the Director of the Spanish Agency for Data Protection agreed to initiate a sanctioning procedure to the claimed, by the alleged violation of Article 6 of the RGPD, typified in Article 83.5 b) of the RGPD. SIXTH: Notified the initiation agreement, the claimed entity, by writing of On March 29 of this year, it made, in summary, the following allegations: a) “D. B.B.B. On January 22, 2019, he signed a Contract for the Assignment of Rights to Image with CLÍNICAS VIVANTA in which you gave your consent, giving do your image to it for a period of 24 months. Likewise, it is pointed out that The image may only be used through advertising media (television sion, press, graphic and exterior, web, mailing, leaflets or any type of size or format. In addition to, pedagogical means (presentations, manuals and protocols among others). A signed contract between the parties is attached as a document. ment # ONE. b) On October 16, 2020, it is notified by certified mail to CLÍNICAS VIVANTA, specifically, the one located at C / *** ADDRESS. 1 DE *** LOCALITY. 1, notarial requirement by the representation of Mr. B.B.B. requesting the withdrawal of the image alleging the absence of express consent for the use of it for said purpose, extreme that is not true since as mentioned in the previous point, D. B.B.B. signed an Image Assignment contract on January 22, 2019, with a valid for 24 months. c) CLÍNICAS VIVANTA once received the request, proceeded to give the internal instructions for the removal of images in which the whistleblower. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/6 d) Currently there is no public image of the complainant in CLINICS VIVANTA, the photos are provided as documents No. TWO, THREE and FOUR, of the facades of the three Clinics mentioned by D. B.B.B .. CLÍNICAS VIVANTA, considers that it has taken the diligence measures sufficient, and at no time has he committed any infraction regarding the legality of the treatment of the data of D. B.B.B., specifically its image, since your express consent was requested for the purposes mentioned in the This document with the signature of the Image Assignment contract that is attached. Likewise, once the notarial request had been made, the the images that are not currently displayed on any of the facades of VIVANTA CLINICS. On the other hand, and already mentioned in the first allegation of this document, the information requested in the notification of the AEPD of dated December 4, 2020 due to an internal procedural error, already resolved, and for this reason, this part provides said information in this document ”. PROVEN FACTS 1st. On November 10, 2020, the AEPD received a letter from claimant that the claimed entity at the beginning of 2020 made use of its personal image for advertising purposes of the clinic, placing in its window a large poster with his image, without consulting anything to the respect, or consent to such action. 2nd. It is proven that the claimant required the claimed entity to proceed to the removal of the poster with his image, by means of a notarial request. In the aforementioned request there are various photographs of the claimant. 3rd. The claimed provides, on March 29, 2021, the contract signed by the claimant of Assignment of Image Rights with CLÍNICAS VIVANTA in which gave his consent, yielding his image to it for a period of 24 months. Likewise, it is pointed out that the image can only be used through advertising media (television, press, graphic and outdoor, web, mailing, leaflets or any type of support or format. In addition to pedagogical means (presentations, manuals and protocols among others). The contract signed between the parties is dated January 22, 2019, where The name of the claimant with his ID and his signature appears. 4th. It is accredited by the claimed that they received a notarial request from the claimant on October 16, 2020, for the removal of the images, proceeding to its withdrawal. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/6 5th. Currently there is no public image of the claimant in Clinics Vivanta, the photos are provided as documents no. Two, three and four, of the facades of the three Clinics mentioned by the claimant. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and as established in arts. 47 and 48.1 of the LOPDPGDD, the Director of The Spanish Data Protection Agency is competent to resolve this process. II Law 39/2015, of Common Administrative Procedure of the Administrations Public (LPACAP) establishes in its article 89.1 that “the termination of the procedure, with filing of the proceedings, without the need for the formulation of the proposed resolution, when in the instruction of the procedure it is I manifest that any of the following circumstances concur: a) The non-existence of the facts that could constitute the offense ”. III The defendant is charged with committing an offense for violation of Article 6 of the RGPD, “Legality of the treatment”, which indicates in its section 1 the cases in which that the processing of third party data is considered lawful: "1. The treatment will only be lawful if at least one of the following is met terms: a) the interested party gave their consent for the processing of their data personal for one or more specific purposes; b) the treatment is necessary for the performance of a contract in which the interested is part or for the application at the request of this of measures pre-contractual; (…) " The offense is classified in Article 83.5 of the RGPD, which considers as such: "5. Violations of the following provisions will be sanctioned, in accordance with with section 2, with administrative fines of a maximum of EUR 20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual global business volume of the previous financial year, opting for the highest amount: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/6 a) The basic principles for the treatment, including the conditions for the consent in accordance with articles 5,6,7 and 9. " Organic Law 3/2018, on Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) in its article 72, under the heading "Infractions considered very serious ”provides: "1. Based on what is established in article 83.5 of the Regulation (E.U.) 2016/679 are considered very serious and will prescribe after three years the infractions that suppose a substantial violation of the articles mentioned in that one and, in in particular, the following: (…) b) The processing of personal data without the concurrence of any of the conditions of legality of the treatment established in article 6 of the Regulation (EU) 2016/679. " IV In the case at hand, after a detailed study of the documents working in this proceeding, and the claims of the claimed entity, We must point out that the contract for the Assignment of Rights of Image with the claimed dated January 22, 2019, with the name of the claimant, their ID and signed by signature, On the other hand, it is clear that once the petitioner received the notarial request requesting the withdrawal of the claimant's images, they proceeded to withdraw the themselves. Likewise, it should be noted that there is currently no public image of the claimant in Vivanta Clinics. Therefore, the file of the present sanctioning procedure proceeds. Considering the aforementioned precepts and others of general application, the Director of the Agency Spanish Data Protection RESOLVES: FIRST: FILE the sanctioning procedure PS / 00076/2021, instructed to CLÍNICA VIVANTA S.L with NIF B82809492, for having proven that the claimant I formalize a contract for the Assignment of Image Rights. SECOND: NOTIFY this resolution to CLÍNICA VIVANTA S.L with CIF B82809492. In accordance with the provisions of article 50 of the LOPDPGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDPGDD, and in accordance with the provisions of article 123 of the LPACAP, the Interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month to counting from the day after the notification of this resolution or directly C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/6 contentious-administrative appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within two months from the day following notification of this act, as provided in article 46.1 of the referred Law. Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es