El León de El Español Publicaciones, S.A., the controller, operates the Spanish digital newspaper „El Español“

1,” which was recorded as evidence by the AEPD. The news article contains “(…)”. ” If you click the play button, you can watch the video in which, inside (…), a young man appears talking to an older person, and you can hear the young man ask, (…) and the older person respond: (…). m. 1, with 59 likes and 122 comments. 1” is not visible, and it is reported (…) that the news item was not flagged, as evidenced by the AEPD. 2 with the text “(…)…” and images from a video in which, inside (…), a young man is seen talking to an elderly person, (…) and responding to the older person: (…). 3 million views, serving as evidence of the aforementioned posts on file with the AEPD. 3, the Director of the Spanish Data Protection Agency ordered the ex officio initiation of preliminary investigative proceedings in connection with information obtained through the media regarding a possible violation in the processing of personal data related to the dissemination of a video.

According to the information published, the video in question was (…) recorded by a third party and subsequently disseminated through various media outlets and social media platforms. 4, following a letter from EE stating that it had proceeded to “remove the news article, preventing access to it both externally and through the newspaper’s internal search engine,” the Inspector verified that the content had been erased from the various platforms used by EE. Evidence of the erasure of the content is recorded and included in the case file. A. is an SME incorporated in 2014, with a turnover of 19,443,719 euros in 2023. A. (EL ESPAÑOL), with Tax ID No. a). A. (EL ESPAÑOL), with Tax ID No. A87115226, since it is considered that the continuation of the processing activities under review could further exacerbate the irreversible risks to the privacy of the victim and the perpetrator—a minor— (protection of personal dignity, personal threats, loss of control over the right to self-determination and data availability), which could result in harm that is difficult or impossible to remedy.

The provisional measure shall remain in effect until the final resolution of the proceedings, at which time it shall be confirmed, modified, or lifted. “ FIFTH: Once the aforementioned decision to initiate proceedings was served in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), on April 15, 2025, EE filed a written statement of defense in which, in summary, it stated: 1-The alleged sanction for publishing unnecessary data in a report is disproportionate and amounts to administrative censorship, especially considering that the proceedings were initiated ex officio, without a complaint from any party, the undeniable virality of the published content, and the fact that it was provoked by the protagonist of the events himself, which constitutes a criminal offense. It refers to the case E/03409/2018, which was dismissed, regarding the necessity to publish personal data, and which contradicts the findings of this proceeding.

It cites Supreme Court Judgement 241/2003 of March 14, which, among other issues, refers to the concept of “accessory nature” in relation to the content of the written report (conflict between the right to one’s own image and the right to information) in a case involving a person “holding public office,” supplemented by Supreme Court Judgement 593/2022 of July 28, regarding a media outlet’s publication of images taken from a video uploaded to YouTube with the subject’s consent. 4—“Regarding the aggressor’s status as a minor” The respondent's recital states that in the present case, both the assailant and the person recording the video—notwithstanding their minority status—are fully aware of the act they have committed and its seriousness, which is why they flee the scene, as well as the aggressor’s defiant and intimidating gestures toward a vulnerable and defenseless person— behaviors that only serve to demonstrate that, despite being a minor, he possessed sufficient maturity to understand the magnitude of his actions and, consequently also to be the subject of a news story regarding said act—an aspect that the Agency failed to take into account when assessing the alleged violation of the principle of data minimisation, when it is indisputable that the minor is aware that he is being recorded and gives his consent to it.

5—“Regarding the classification and characterization of the alleged violation and the amount of the penalty” -Both the video and the minor’s identity had already been widely disseminated previously. The assertion that the publication of the news story resulted in the complainant losing disposition and control over their personal data, as it was disseminated over the internet without restrictions, failed to take into account that this loss of control had already occurred at the moment the video went viral—an event not attributable to the respondent. It is not possible to consider that the respondent’s actions produced the same effect. b) of the GDPR, the respondent points out that, without the video, the news story’s informational content would be empty had the video been edited to anonymize the complainant’s personal data; the video footage serves to help readers understand the context of the news story.

It reiterates that the exercise of the right to freedom of information may entail the loss of control over personal data by the subjects of the news reports, and in this case, such loss is proportionately necessary for the exercise of the right to freedom of information, with a corresponding limitation on the right to data protection and privacy of those affected. FIRST:-:-Reiterates that judicial proceedings exist to guarantee the right to one’s own image, and that the AEPD’s arguments are more relevant to the purported protection of the right to one’s own image guaranteed by Organic Law 1/1982. es 6/28 It considers that the response given—that these are distinct legal interests—is incorrect, as it believes that the right to data protection and the right to one’s own image do protect the same legal interest, which is none other than a person’s power of disposition over their image and other personal characteristics such as their voice.

It reiterates the decision to dismiss proceedings E/03409/2018 in a section of the reasoning that states that the right to information involves the processing of data that does not require the prior consent of the data subject, although there are limits, and points to the protection provided by the aforementioned Organic Law 1/1982. -It asserts that the minor’s face is not even fully visible, since the newspaper cropped out the only moment in which his full face was visible; in the published video, only the back of the minor’s head can be seen, or at most the side of his head. Recital: It considers that the possibility of using artificial intelligence to create an identity reconstruction, generate detailed profiles, or simulations based on what was published is impossible due to the quality of the video. SECOND—Reiterates that the purpose of publishing the news story was the video itself, having argued that the published video was incidental to the information regarding which no response was received.

THIRD—It points out that the special protection afforded by the legal system to minors regarding their rights to data protection, honor, privacy, and their own image must always be assessed according to the level of maturity demonstrated by the minor themselves; in this case, they were aware of the video recording and the seriousness of the events, demonstrating sufficient maturity to understand the magnitude of the events and therefore capable of being the subject of a news story regarding said action. It requests that this be taken into account, as it is indisputable that the minor is aware that they are being recorded and gives their consent to it, with the intention of disseminating it, as they ultimately did. -Regarding the best interests of the minor, the petitioner states that Article 7 of the LOPDGDD establishes 14 years of age as the valid age for giving consent, considering that at that age, minors already possess sufficient maturity to understand the implications involved.

FOURTH—Regarding the amount of the fine, the defendant considers it disproportionate given the nature of the right that is at stake, which is an institutional guarantee; any measure that restricts it, such as the penalty, must be interpreted narrowly in accordance with the criteria of necessity and proportionality. It notes that, at the time of the newspaper’s publication, the video already had millions of views, while the views resulting from the news article were minimal by comparison—a fact that must be taken into account in determining the amount of the alleged penalty. ” The news article states: “(…)”. The post includes a video related to the incident, in which the victim of the assault (…), as well as the assailant (…), can be seen, without the use of any techniques that would prevent the identification of these individuals. m. 1, with 59 likes, 122 comments, and it is reported (…) that the news story was not flagged, as evidenced by previous proceedings by the AEPD.

3, this Agency issued a precautionary measure addressed to the controller EE, requesting the immediate removal of the video published at the URLs specified in the preceding established fact. 4, following a written notice from EE stating that it had proceeded with the “removal of the news article, preventing access to it both externally and through the newspaper’s internal search engine,” this Agency verified that the content of the video that is the subject of this disciplinary proceeding no longer exists at the aforementioned web addresses, a fact substantiated by the report on prior investigative proceedings. LEGAL GROUNDS I Jurisdiction In accordance with the powers granted to each supervisory authority by Article 58(2) of the GDPR, and pursuant to Articles 47, 48(1), 64(2), and 68(1) of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter, LOPDGDD), the Presidency of the Spanish Data Protection Agency has jurisdiction to rule on this proceeding.

” Recital 4 states: “The processing of personal data should be designed to serve humanity. The right to data protection is not an absolute right, but must be considered in relation to its role in society and maintain a balance with other fundamental rights, in accordance with the principle of proportionality. a). In the present case, a news article was published that includes personal data of the individuals in question, such as their age or municipality of residence, accompanied by a video in which the two individuals in question can be seen, making it possible to identify them, which constitutes the processing of personal data; therefore, the controller carrying out such processing is required to comply with the obligations set forth in the GDPR and the LOPDGDD. , and what is it for? es 9/28 current events—in this case, news stories. The specific activity under consideration in this case affects the fundamental rights and freedoms of natural persons, particularly their right to privacy with respect to the processing of personal data by EE, as the entity that determines the purposes and means of this processing activity, and must ensure, within the framework of its responsibilities, powers, and capabilities, that said activity meets the requirements of the GDPR and the LOPDGDD so that the safeguards established therein may take full effect and effective and comprehensive protection of data subjects—in particular, of those rights—may be ensured.

III Response to the Allegations In response to the allegations raised in these disciplinary proceedings, the following should be noted: Regarding the argument against the (preliminary) proposal, it should be noted that the Spanish Constitution, in Article 20, expressly provides for certain limits on freedom of information, such as the right to honor, privacy, one’s own image, and the protection of youth and children. However, it must also be taken into account—as already noted in the decision to initiate proceedings, in the proposed resolution, and in this resolution—that freedom of information and expression is not absolute, nor is the fundamental right to data protection. These are rights that must be balanced in their application, without attempting to assert the supremacy of one over the other. What is at issue in this case is not the legitimacy of the processing but rather the necessity and proportionality of using personal data to accompany detailed information about the events that occurred several months earlier, given that the juvenile assailant who appears as the main figure has been located It is worth noting, given its relevance to this case, the Supreme Administrative Court (SAN) decision of November 19, 2024, Rec.

1 of the Spanish Constitution, with which it shares the objective of providing effective constitutional protection of personal and family privacy, by shielding it from the knowledge of others and from third-party interference against one’s will, seeks to guarantee that person the power to control their personal data, its use, and its destination, with the purpose of preventing its unlawful trafficking and harm to the dignity and rights of the data subject. es 10/28 to honor, and to the full exercise of an individual’s rights. The fundamental right to data protection extends the constitutional guarantee to those data that are relevant to or have an impact on the exercise of any of an individual’s rights, whether or not they are rights. In this regard, it should be noted that the video shows him looking at the camera, and he can be identified directly or indirectly; furthermore, the information provided in the news report helps provide additional details to narrow the search and consider him identifiable.

Similarly, as the respondent herself has stated, the video in question corresponds to others circulating on the web; thus, both directly and indirectly, the assailant and the victim can be identified or are identifiable, which must be considered personal data. The right to personal data protection safeguards the image and voice of the individuals appearing in the video, requiring that dissemination based on freedom of information comply with the relevant requirements regarding legitimacy and the principles of the regulations, among which is the principle of data minimization. Regarding the claim that the video went viral—since it is unknown whether the first video that led to the dissemination of its content was actually put into circulation by the aggressor—the fact that it went viral on a massive scale should not, therefore, serve as a justification for its publication in its entirety.

In this case, the legitimacy of the processing is not in question, but rather the necessity and proportionality of the personal data in order to accompany detailed information about the events that occurred several months earlier, given that the minor perpetrator who appears as the main subject has been located. This necessity and proportionality in assessing the conflict of rights between the right to information and the right to the protection of privacy and personal data of a minor—who is also a vulnerable person—must, in this case, be weighed in favor of the latter, considering the repercussions that the dissemination of their images may have—a point the respondent has not mentioned in any of its complaints. The conflict in this case must not be resolved by the prevalence or primacy of the right to information, but rather by reconciling it with the right to data protection, under the premise of the prevalence of the best interests of the minor, which will be established as applicable in this instance.

The right to personal data protection requires that the processing of the published data that may have taken place comply with the relevant requirements regarding legitimacy and principles, and in this case, it is not only a matter of protecting the image, but also of its dissemination through a medium to which anyone with an internet connection could have had access (digital media and social media). All of this without disputing in these proceedings the legitimacy but rather the scope of the content of the data used as an accompaniment to the news story, which cannot be disclosed as it takes precedence over the right to freedom of information. Regarding the argument against the proposal that the affected parties did not exercise any rights, it should be noted that this is not a requirement for the protection of the right, the exercise of which falls explicitly within the AEPD’s jurisdiction.

Regarding the public relevance of the events due to the video’s virality, it must be noted once again that the respondent is an audiovisual news outlet operating within the information society and long accustomed to processing personal data. es 11/28 staff are dedicated to data processing and, given the knowledge they are expected to have of these groups in their reporting work, must reconcile this with the special respect required by the regulations on minors and digital media that apply to them as a safeguard of the dignity of minors and vulnerable persons. ” It must be taken into account that in the present case there are distinguishing factors: In the case of the file in question, it concerned a person in the public eye—a politician— and did not involve a minor or vulnerable person (the victim) in any way; therefore, the balancing test must be considerably different from that of the alleged case.

Thus, the arguments raised cannot be taken into account. -Regarding the preponderance or primacy of the right to information over the dissemination of the video containing personal data, it must be noted that the respondent does not include the rights and interests of the data subjects parties involved—both of whom are vulnerable—(…), Recitals 153, as well as Article 85, provide for the application of exemptions or exceptions to be established by the Member State, only if they are necessary to reconcile the right to data protection with the freedom of expression and information. ” In the present case, the relevance of the matter or the fact that the events are of public interest and newsworthy is not in dispute; rather, the issue concerns the limits that must be applied in assessing the balancing of rights. Just as the news report did not include the first and last names—which, according to the respondent, were already known and had been published on social media—it was not necessary to show the image of those involved or include audio in order to broadcast the news The infringement involved—in terms of failing to respect the right to data protection of the individuals concerned—means that the right to information cannot prevail, in the manner argued by the respondent; however, it is possible to reconcile this right and ensure it is not rendered meaningless through the use of certain tools.

The use of tools that prevent the identification of the individuals in the video demonstrates that an alternative exists that equally guarantees the right to information. Therefore, the arguments presented cannot be taken into account. es 12/28 the respondent intends to assert—neither that the video was disseminated by the assailant himself, a claim that has not been substantiated, nor that he was aware of what he was doing and possessed sufficient maturity to understand his actions. Furthermore, the aforementioned consideration of the minor’s best interests has not been addressed in any way in the respondent’s arguments, which indicates that the respondent also failed to take it into account when processing the personal data that constitutes the minor’s identity, which is the subject of this case. It is the best interests of the child that should prevail in any case, and this requires that the processing of personal data be adapted to ensure that no further harmful effects occur to those involved, given the intrusion posed by the universal dissemination of digital media and the harm that this entails, along with the risks to the minor in particular.

The third argument made in the proposal—regarding the maturity conferred by being over 14 years of age to consent to processing—is unrelated to the specific act alleged against the respondent, nor does it imply a diminution in the interest worthy of protection of minors. Hence the importance of compliance with and the provisions set forth in Article 25 of the GDPR, titled “Data Protection by Design and by Default,” which states in paragraph 2: “The controller shall implement appropriate technical and organizational measures to ensure that, by default, only personal data necessary for each specific purpose of the processing are processed. This obligation applies to the amount of personal data collected, the scope of its processing, its storage period, and its accessibility. […]”, and these measures must be adapted to the risk posed by the processing, taking into account the means of processing.

Therefore, the arguments raised cannot be taken into account. - Regarding the seriousness of the violation, in Recital 83(2)(a) of the GDPR, the respondent argues that the data was already circulating on social media. In response, it should be noted that even if this is true, each instance of dissemination further contributes to such dissemination and amplifies its effects, especially considering that the video remained online until February 27, 2025, the date on which technical measures were implemented to prevent identification. Regarding the disagreement over the application of Article 83(2)(b), which indicates negligent conduct, and the assertion that the video’s informational content was necessary to understand the context—weighing public relevance and veracity—it has already been noted that these two elements are neither decisive nor sufficient in this case for the balancing of rights, given the social vulnerability of the victim and the minor status of the perpetrator.

Furthermore, the respondent is a commercial entity specializing in public and audiovisual information that is presumed to have a track record in which data processing and its specific aspects—such as those involving vulnerable individuals—cannot be foreign to it. It should be noted that the defendant acts as the controller for the processing of the news article published along with the video in question. es 13/28 controller is required to exercise in order to comply with the obligations imposed by personal data protection regulations, the Judgement of the National Court dated October 17, 2007 (Case No. 63/2006) is highly illustrative, which states, with regard to entities whose activities involve the continuous processing of customer data, that: “(…) the Supreme Court has held that negligence exists whenever a legal duty of care is disregarded, that is, when the offender fails to act with the required diligence.

” Thus, denying the existence of negligent conduct on the part of DMP would amount to acknowledging that its conduct—whether by action or omission—was diligent. Obviously, this perspective on the facts is not shared. As for the argument made in the motion that the penalty is disproportionate and constitutes a measure that restricts rights, it is reiterated that this is not the case; rather, the sanction reconciles fundamental rights and can coexist with freedom of information, especially considering the best interests of minors as enshrined in, among other laws, Organic Law 1/1996 on the Legal Protection of Minors, and Organic Law 8/2021 on Protection, and that this should lead to taking it into account to the appropriate extent in any decision involving data on minors, with special caution regarding its processing in digital media such as this newspaper and social media. Regarding the comparison of the amount of the penalty with that imposed in certain you cite in your arguments against the proposal, it should be noted that, regarding the comparison with potential penalties, it would be appropriate, where applicable, to compare them with those that may have been imposed by this AEPD; in this regard, it should be clarified that in 2023 several penalties were imposed on media outlets for the same violated principle and the public disclosure of personal data.

Therefore, the arguments raised cannot be taken into account. 3, and in its online newspaper, in which (…) appeared, which constitutes the processing of both individuals’ personal data. Given the foregoing, it should first be noted that individuals have the right to determine the use of their personal data, as well as its dissemination; consequently, there is no doubt that a person whose personal data is disseminated in violation of the legal system is entitled to protection. es 14/28 allows the individual to know who possesses that personal data and for what purpose, and to object to such possession or use. These powers of disposition and control over personal data, which constitute part of the content of the fundamental right to data protection data protection, are legally embodied in the right to consent to the collection, acquisition, and access to personal data, its subsequent storage and processing, as well as its possible use or uses, by a third party, whether the State or a private individual.

” The principles relating to processing are, on the one hand, the starting point and the concluding clause of the legal framework for data protection; they constitute true guiding rules of the system with a strong expansive force. On the other hand, because they are highly specific, they are mandatory rules that are subject to violation. c) of the GDPR, which provides that: “1. Personal data shall be: (…) c) adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);” Compliance with this principle requires, as a prerequisite, an assessment of the necessity and proportionality of processing operations with respect to their purpose, taking into account whether the intended purposes can be achieved or not achieved in a less intrusive manner, as well as the risks to the protection of the fundamental rights and freedoms of individuals.

c) of the GDPR relates to Recital 39 of the GDPR, which states that “(…) the specific purposes of the processing of personal data must be explicit and legitimate, and must be determined at the time of collection. Personal data must be adequate, relevant, and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the storage period is limited to a strict minimum. Personal data should only be processed if the purpose of the processing could not reasonably be achieved by other means” As can be inferred from the aforementioned Recital, this requirement of necessity is not met when the intended objective can reasonably be achieved just as effectively by other means that pose less risk to the rights and freedoms of the data subjects, particularly with regard to the rights to respect for private life and data protection, guaranteed by Articles 7 and 8 of the CFR EU Charter of Fundamental Rights, since exceptions and restrictions to the right to data protection must be established without exceeding the limits of what is strictly necessary (see, to that effect, the judgement of December 11, 2019, Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, paragraphs 46 and 47).

es 15/28 In any case, the default settings must not include the collection of personal data that is not necessary for the specific purpose of the processing. In other words, if certain categories of data are unnecessary or if detailed data are not needed because less granular data are sufficient, then personal data should not be collected. In this case, if another processing method could achieve the same objective and is available under the terms described, or if processing personal data is not necessary to achieve the same purpose, the processing of such personal data may be dispensed with, or it may be processed to a lesser extent and with less intensity of use; this approach is preferable and implies that no data processing is necessary, and alternatively, that the collection of data is necessary for the established or intended purpose and, if so, that it is proportionate. Article 5(1)(c) of the GDPR reflects the principle of proportionality (see the judgement of December 11, 2019, Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, paragraph 48), in the sense that, if alternatives exist to achieve the same purpose intended by the respondent, the least intrusive option must be chosen.

This principle is also linked to that of the necessity of processing; both principles must be taken into account from the moment that the use of personal data restricts rights and freedoms—such as the right to data protection—when processing such data, and in this case, also the right to dignity of the person who was slapped and of the minor. V Balance between the right to personal data protection and other fundamental rights and freedoms However, the fundamental right to personal data protection is not absolute, since, where appropriate, it may yield to the prevalence of other rights and freedoms that are also constitutionally recognized and protected, such as, for example, the fundamental right to freedom of information or expression, with this being weighed on a case-by- case-by-case basis. ” That said, the fundamental rights to freedom of information and freedom of expression are not absolute either.

It is not a matter of giving one fundamental right precedence over another, but rather of finding a balance between the two that allows for the reconciliation of both rights; a reconciliation to which the European legislator itself refers in Article 85 of the GDPR. And one of the factors to be taken into consideration is, precisely, whether the intrusion involved in the processing of personal data—which is subject to sanctions—is necessary to achieve the intended purpose; in this specific case, the publication of the news story. At this point, it is necessary to refer to the case law that analyzes the relationship between freedom of information and expression, on the one hand, and the rights of those affected by informative content, on the other. Thus, the European Court of Human Rights (ECHR), in its judgement of June 19, 2012, rendered in Case No. 1593/2006, states the following: Although the press must not overstep certain limits, particularly with regard to the reputation and rights of others or the proper administration of justice, its duty is nonetheless to disseminate, in a manner consistent with its obligations and responsibilities, information and ideas on all matters of public interest (paragraph 48) (…), the publication of photographs and articles whose sole purpose is to satisfy the curiosity of a particular reader regarding the details of the private life of a public figure cannot be considered to contribute to any debate of general interest to society, even though the person is known to the public.

Under such circumstances, freedom of expression calls for a stricter interpretation (…). (para. es 17/28 right to respect for private life enshrined in Article 8—the Court of Justice must balance the public interest in the publication of the information and the need to protect private life (see Hachette Filipacchi Associés v. France, No. (Paragraph 51) It concludes that, since the parties affected by the news report were not public figures, “the disclosure of their identity cannot be considered essential to understanding the details of the case (paragraph 57),” and that “there is no doubt that the protection of the most intimate sphere of a minor’s life—who had become a victim of a custody dispute and had not entered the public sphere— deserved special protection due to his vulnerable position. (paragraph 59)” (emphasis added). In this regard, and given the circumstances of the case at hand, in which personal data—voice and image—have been disseminated as part of news content that EE provides to its readers, it must be understood that the limits established by case law regarding the necessary protection of the fundamental rights of those affected.

2 without obtaining the consent of the copyright holder. In that ruling, after noting that “we must once again emphasize that physical appearance, insofar as it is a basic means of identification and external projection and an essential factor for one’s very recognition as a person, constitutes the primary defining element of the personal sphere of every individual (SSTC 156/2001, Legal Grounds 6 and 99/1994, Legal Grounds 5),” it concludes that “the primary rule for ensuring the protection of this fundamental right is that in order to capture, reproduce, and/or publish a person’s image, their unequivocal consent is indispensable, and cases in which such authorization is not required are exceptional (…)” At this point, it is worth referring to Judgement 117/1994, of April 25 (RTC 1994\117), which states the following: “when the right to one’s own image conflicts with other constitutionally protected rights or interests, particularly the freedoms of expression and information (Art.

a and d of the Spanish Constitution), the various conflicting interests must be weighed, and, taking into account the specific circumstances of each case, a decision must be made as to which interest deserves greater protection” (SSTC 105/1990, dated June 6; 72/2007, Legal Ground 5, and 156/2001, Legal Ground 6). (…) As is easily deducible, this occurs not only when it conflicts with the rights to honor and privacy, but also with the fundamental right to one’s own image, for example, in those cases in which news reports disseminate photographs or video clips that can only be understood as mere instruments for satisfying the curiosity of others and have been included not for an informative purpose, but for the purpose to satisfy the anticipation that, under such circumstances, a particular news story may generate. es 18/28 (…) the image of an anonymous or unknown individual—that is to say, someone who does not hold public office or practice a high-profile profession—even if captured in a public place, may not be used without their express consent, except in two cases.

First, where the person appears in the photograph in a purely incidental and insignificant manner, without playing any prominent role. Second, in the event that the initially anonymous person’s participation in the newsworthy event was principal or prominent, in which case their fundamental right to their image must yield to the right to information, precisely because of the non-incidental role that the subject themselves has assumed. (…) Although the risks of intrusion have increased exponentially with the widespread use of social media, to ward them off we must continue to rely on the same basic principle that governs the analog environment and affirm that the constitutional recognition of the covered by Article 18 of the Spanish Constitution entails the individual’s right to control the data circulating on social media that concerns them. Therefore, we reiterate that, unless there is unequivocal authorization for the capture, reproduction, or publication of the image by its owner, any interference with the fundamental right to one’s own image must necessarily be justified by an overriding public interest in having access to it and in disseminating it.

(…) Consent covers only that which constitutes the subject matter of the declaration of intent. The holder of the fundamental right must authorize the specific act of using their image and the purposes for which they grant such authorization. ” In light of the foregoing, and given that it has been established that there has been processing of personal data that constitutes an infringement of the fundamental right to data protection for the participants appearing in the aforementioned video, it must be noted that one of the individuals affected by this violation was a minor at the time of the events. In this regard, it is worth noting some of the numerous judicial rulings that highlight the enhanced protection that should be afforded to minors against unlawful infringements of their fundamental rights. Thus, as stated by the Supreme Court, First Civil Chamber, in its Judgement No. 1003/2008 of Oct.

23, 2008 (Case No. ” In line with the foregoing, the special protection that must be afforded to data concerning minors has been enshrined in Organic Law 1/96 of January 15 on the Legal Protection of Minors. es 19/28 as a limit on the right to freedom to receive or transmit information, it is necessary that the news disseminated lack public interest or that, even if it is of public interest, it lacks veracity, since in a democratic society that proclaims as one of the principles inspiring its coexistence, respect for human dignity, the disclosure of facts pertaining to the private lives of individual citizens must not be tolerated, nor should the dissemination of untrue news be tolerated, not in the sense that they must correspond exactly to what actually happened, but in the sense that the publisher has exercised the necessary diligence to ensure that what is disclosed is not a mere rumor—Judgements of the Constitutional Court 54/2004, of April 15, and 61/2004, of April 19—.

However, in cases involving minors, constitutional doctrine has established a sphere of heightened protection that requires extreme caution regarding the information provided about them, even if such information is in the public interest. Thus, the Constitutional Court has held that a minor’s legitimate interest in preventing the disclosure of information regarding their family or personal life “appears to impose an insurmountable limit on both freedom of expression and the fundamental right to freely communicate truthful information, without the alleged truthfulness of what is revealed exempting the media outlet from liability for intrusion into the private lives of both minors,” even if the news story merits the designation of neutral information—Constitutional Court Judgement of July 15, 1999—(the underlining is ours). Along the same lines, it is worth noting the ruling of the Supreme Court in its Judgement 777/2021 of Nov.

11, 2021, (First Chamber, Civil, Case No. ” Likewise, due consideration must be given to international standards for the protection of children (regarding whose interpretive value under Art. 2 of the Spanish Constitution need not be emphasized), and, among these, in particular, the United Nations Convention on the Rights of the Child (ratified by Spain by an Instrument dated November 30, 1990), which guarantees the right of children to the protection of the law against arbitrary or unlawful interference in their private life (Art. 16), as well as the European Parliament Resolution on the CFR European Charter of the Rights of the Child, which states that “every child has the right not to be subjected by a third party to unjustified intrusions into his or her private life, into that of his or her family, or to unlawful attacks on his or her honor” (paragraph 29 of § 8 of Resolution A 3-0172/92 of July 8).

“In turn, Organic Law 1/1982 of May 5 on the Protection of the Right to Honor, Privacy, and One’s Own Image, after establishing that no unlawful intrusion shall be deemed to have occurred within the protected sphere when the right holder has given his or her express consent to that effect (Art. 2), goes on to specify in Art. es 20/28 required to give prior notice to the Public Prosecutor’s Office of the proposed consent, and the judge must rule if, within eight days, the Public Prosecutor’s Office objects. (…)” Therefore, media outlets process personal data in the exercise of freedom of information and are responsible for doing so. As controllers, they must comply with the obligations set forth in the GDPR, among which we highlight, among others, verifying the existence of a that legitimizes the processing of personal data, applying the principles relating to processing or conducting risk assessments (Article 24 of the GDPR), and conducting data protection impact assessments when necessary (Article 35 of the GDPR).

The fact is that any processing of personal data entails risks to the rights and freedoms of natural persons arising from such processing, which the controller must identify, assess, and evaluate in order to implement technical and organizational measures of all kinds to prevent or mitigate the materialization of the aforementioned risks materialize. It must be taken into account that, at times, the materialization of these risks can have a very significant impact on the rights and freedoms of data subjects, and the harm may be irreversible and irreparable. Furthermore, the analysis of these risks must take into account the clearly technological context of today. In today’s technological context, marked by the exponential development of artificial intelligence and its ability to analyze, identify, and associate voices and images with unprecedented precision, the need to exercise extreme caution in the processing of this personal data is reinforced.

Artificial intelligence makes it possible, even from minimal image fragments, to reconstruct identities, generate detailed profiles, or create hyper-realistic simulations, which significantly increases the risks to the rights and freedoms of natural persons. All of this is in addition to compliance with the principle of data minimisation applicable to the form and means by which information is provided and disseminated, given the immediate impact on a natural person’s personal data. Thus, the controller must assess, prior to carrying out the processing, whether the dissemination of personal data is as non-intrusive as possible, analyzing and implementing, where case, other ways of providing the information (alternative measures) that pose a lower risk to the right to personal data protection, including the right to privacy. 2 of the GDPR)—must conduct from the outset not only an active analysis of measures for the design of the processing in order to comply with the principles of the GDPR, (one of which is data minimisation) but also a risk analysis and document it for the specific case in question, while also applying the principle of data minimisation to the in order to adopt, if necessary in light of an individual’s circumstances, the appropriate technical and organizational measures to reconcile the fundamental right to freedom of information with the fundamental right to data protection.

es 21/28 In this regard, it should be noted that current technology allows for the publication of information— whether a video or an audio recording—without making the participants identifiable; therefore, a media outlet could provide the information while remaining compliant with data protection regulations. Technical measures consisting of the use of technical procedures to prevent the recognition and identification of the individuals concerned, which must be assessed in each case by the controller. As we can see, this is not a matter of giving one fundamental right precedence over another, but rather of determining which carries greater weight in a specific case. Rather, it is a matter of striking a balance between the two to achieve the purpose of the former without undermining the latter, and always on a case-by-case basis. The reconciliation of these two rights is set forth by the European legislature in Article 85 of the GDPR.

VI Breach of Obligation. Data Minimisation Every controller has obligations regarding data protection data protection, as prescribed by the GDPR and the LOPDGDD, particularly—as indicated—the assessment of the necessity and proportionality of data processing, the accountability set forth in Article 5(2) of the GDPR, and the assessment of the risks to fundamental rights and freedoms posed by the processing of personal data, and the implementation of appropriate security measures. These obligations do not cease to apply simply because the controller is a media outlet. Recital 79 of the GDPR states: “The protection of the rights and freedoms of natural persons with regard to the processing of personal data requires the adoption of appropriate technical and organizational measures to ensure compliance with the requirements of this Regulation. In order to demonstrate compliance with this Regulation, the controller must adopt internal policies and implement measures that comply, in particular, with the principles of data protection by design and by default.

Such measures could consist, among other things, of minimizing the processing of personal data, pseudonymisation of personal data as soon as possible, and ensuring transparency regarding the purposes and processing of personal data,” which relates to Article 25 of the GDPR, which establishes data protection by design and by default, whereby the controller must implement technical and organizational measures capable of effectively ensuring compliance with the principles referred to in Article 5 of the GDPR. Thus, the first paragraph of the aforementioned article provides for data protection by design, stating that: “1. 2 of the LPODGDD, which states: () “b. ” Both of these circumstances apply in the present case. Of particular importance during this phase of determining the means of processing is the implementation of appropriate technical and organizational measures in the design of data processing operations and throughout their execution.

The second paragraph of Article 25 of the GDPR describes the principles of data protection by default, stating that: “2. The controller shall implement appropriate technical and organizational measures to ensure that, by default, only personal data that is necessary for each of the specific purposes of the processing is processed. This obligation applies to the amount of personal data collected, the scope of its processing, its storage period, and its accessibility. ” This paragraph is directly related to the obligation of the controller to implement appropriate technical and organizational measures to ensure that, by default, only the personal data necessary for the specific purpose are processed, thereby establishing an explicit connection to the principles of data minimisation and purpose limitation. In this case, if we combine the dissemination of the video showing the victim and her assailant (with all its nuances)—in which they can be recognized by third parties—with the factual account provided provided by the news report—which remains publicly available for an extended period, with the possibility of forwarding or copying the video—it is clear that there is a very high and highly probable risk that the individuals concerned may suffer harm to their rights and freedoms.

The clarification of the possible purposes that may arise in the processing of the news alongside the videos must focus not on the legitimacy of reporting, but rather on emphasizing, as has been stated that, in this case, the defense of the rights of both the victim and the aggressor, given that the videos are included, does not appear to be secondary to the interests advocated by EE through the three broadcasts of the videos alongside the news story. es 23/28 It is considered that even if EE’s purpose was to report on the violent nature of the assault, thereby illustrating the content of the message aimed at fostering the formation of free public opinion, there has been a violation of the personal data of the assailant and the victim, as they are identified or could be identified, and there is a lack of due necessity and proportionality between the exercise of the right to freedom of information—given its content, purpose, and context—and respect for the personal data of the assailant and the victim, thereby infringing upon their right to data protection.

” For the purposes of the statute of limitations, article 72 of the LOPDGDD states: “1. Pursuant to the provisions of Article 83(5) of Regulation (EU) 2016/679, infractions that constitute a substantial breach of the articles mentioned therein and, in particular, the following: a) The processing of personal data in violation of the principles and safeguards established in Article 5 of Regulation (EU) 2016/679. ” “Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or in lieu of the measures set forth in Article 58, paragraph 2, subparagraphs (a) through (h) and (j). ” With regard to Article 83(2)(k) of the GDPR, Article 76 of the LOPDGDD, “Penalties and Corrective Measures,” provides: “2. In accordance with the provisions of Article 83(2)(k) of Regulation (EU) 2016/679, the following may also be taken into account: a) The ongoing nature of the infringement.

b) The connection between the offender’s activity and the processing of personal data. c) The benefits obtained as a result of committing the violation. d) The possibility that the data subject’s conduct may have contributed to the commission of the violation. e) The existence of a merger by absorption occurring after the commission of the violation, which cannot be attributed to the absorbing entity. f) The impact on the rights of minors. g) Having a data protection officer, where not mandatory. es 25/28 In the present case, in recital, the seriousness of the possible violation is taken into account, as is the impact it has on the data subjects. A fine must be imposed, in addition to the adoption of measures. The fine imposed must be, in each individual case, effective, proportionate, and deterrent, in accordance with the provisions of Article 83(1) of the GDPR. Thus, the turnover of EE (€19,443,719 in 2023) is taken into account as a preliminary consideration.

For the purposes of deciding on the imposition of an administrative fine and its amount, based on the established facts, the penalty to be imposed must be determined in accordance with the following circumstances, as set forth in the aforementioned provisions. a) of the GDPR: “The nature, gravity, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the level of damage they have suffered;” The Agency considers that the nature of the infringement is very serious, since it results in individuals losing control over their personal data, as it is disseminated unrestricted via the internet in the online newspaper and on two social media platforms. In this regard, the CJEU judgment of August 1, 2022, in Case C-184/20 (OT and Vyriausioji tarnybinés etikos komisija) highlights the amplifying effect of the internet, stating that “102 Furthermore, it is established that such processing results in that personal data being freely accessible on the internet to the general public as a whole and, as a result, to a potentially unlimited number of people,” with implications for significant damages should the aforementioned processing continue.

-Article 83(2)(b) of the GDPR. “Intent or negligence in the violation”: EE’s conduct is considered to have been negligent for failing to ensure a procedure that would guarantee data protection in such sensitive circumstances, especially since techniques exist that allow for the anonymity of the individuals appearing in the video that is the subject of the proceedings. -Article 83(2)(g) of the GDPR. Categories of data affected by the violation: although no “special categories of personal data,” as defined by the GDPR in Article 9, the personal data referred to in the proceedings are of a particularly sensitive nature, given the victim’s vulnerability and the special situation of minors who must be protected, insofar as they the individuals can be easily and quickly identified in conjunction with the rest of the news report, thereby increasing the risks to their privacy. es 26/28 LOPDGDD).

EE processed personal data belonging to a minor; therefore, given the minor’s particular vulnerability, it can be considered that an infringement of their right to personal data protection would have particularly significant implications and consequences . The amount of the applicable fine is €20,000 (twenty thousand euros). IX Corrective Measures It is further agreed to require the data controller to adopt appropriate measures to bring its actions into compliance with the regulations mentioned in this decision, in accordance with provisions of Article 58(2)(d) of the GDPR, pursuant to which each supervisory authority may “order the controller or processor to ensure that processing operations comply with the provisions of this Regulation, where appropriate, in a specific manner and within a specified time limit…” The imposition of this measure is compatible with the sanction consisting of an administrative fine, as provided for in Art.

83(2) of the GDPR. c) of the GDPR, to prevent the excessive publication or dissemination of personal data, particularly that of minors. In this case, compliance with the regulations requires the permanent cessation of the processing to which the proceedings refer, with the permanent removal from the entity’s website of the content referred to in the complaint. This must be done in such a way as to prevent access to the personal data, its dissemination, and access to the original by third parties, preventing—to the extent that the state of technology permits—the re-upload or re-posting of exact copies or replicas by Internet Users of the published content. In any case, its storage shall be ensured for the purpose of safeguarding evidence that may be necessary in the course of any police or administrative investigation or judicial proceedings that may be initiated. However, it should be noted that within the framework of the preliminary investigative proceedings conducted by this Agency, it was agreed to require the aforementioned cessation of processing from EE, as a precautionary measure subsequently confirmed in the decision to initiate the present proceedings.

Therefore, the measure ordered here amounts to making the previously imposed precautionary measure definitive. 6, and such conduct may lead to the initiation of further administrative disciplinary proceedings. , with Tax ID No. a) of the GDPR, a fine of 20,000 euros. , with Tax ID No. c) of the GDPR, preventing the excessive publication or dissemination of personal data and, in particular, of minors, in accordance with the provisions of this Decision. , of this decision. FOURTH: This resolution shall become enforceable once the deadline for filing the optional appeal for reconsideration has expired (one month from the day following notification of this resolution) without the data subject having exercised this right. The party subject to the sanction is hereby notified that they must pay the imposed sanction once this resolution becomes enforceable, in accordance with the provisions of Art.

b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), within the voluntary payment period established in Art 68 of the General Collection Regulation, approved by Royal Decree 939/2005, dated July 29, in conjunction with Art 62 of Law 58/2003, dated December 17, December, by making a deposit, indicating the taxpayer identification number (NIF) of the party subject to the penalty and the procedure number appearing at the top of this document, into the restricted account No. A. Otherwise, collection will proceed during the enforcement period. Upon receipt of the notice and once it becomes enforceable, if the enforceability date falls between the 1st and 15th of each month, inclusive, the deadline for voluntary payment will be until the 20th of the following month or the next business day thereafter; and if it falls between the 16th and the last day of each month, inclusive, the payment deadline will be until the 5th of the second following month or the next business day thereafter.

In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution shall be made public. Publication shall take place once it has been notified to the data subjects. 1 of the aforementioned Law. 3(a) of the LPACAP, the final administrative decision may be provisionally suspended if the data subject expresses their intention to file a contentious-administrative appeal. If this is the case, the data subject must formally notify the Agency of this fact in writing, addressed to the Spanish Data Protection Agency, by submitting it through the Agency’s Electronic Registry , or through any of the other registries provided for in Art. 4 of the aforementioned LPCAP. The interested party must also submit to the Agency the documentation proving that the contentious-administrative appeal has been effectively filed. If the Agency is not notified of the filing of the contentious-administrative appeal within two months from the day following notification of this decision, it will consider the precautionary suspension to have ended. es