# Cultural association: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2021-03-15
- Original: https://www.enforcementtracker.com/ETid-602
- Canonical: https://overview.legal/posts/46717
- Topics: Controllers, Consent, Processing Agreement, Data Controller, Processing, Supervisory Authorities

## Summary

The Spanish DPA (AEPD) imposed a fine of EUR 3,000 on a cultural association. The controller had published pictures of a four-year-old child on various groups of the Chinese messenger service WeChat without the consent of the child's parents. The photos show the child taking part in the controller's Chinese lessons. Although the controller tried to obscure the child's face using a digital sticker, it was still partially visible. Also the controller did not respond to the parents' request to dele

## Full text

The Spanish DPA (AEPD) imposed a fine of EUR 3,000 on a cultural association. The controller had published pictures of a four-year-old child on various groups of the Chinese messenger service WeChat without the consent of the child's parents. The photos show the child taking part in the controller's Chinese lessons. Although the controller tried to obscure the child's face using a digital sticker, it was still partially visible. Also the controller did not respond to the parents' request to delete the photos and apologize to them.

GDPR Articles: Art. 6 (1) a) GDPR
Industry: Individuals and Private Associations

---
Generated by overview.legal · https://overview.legal/posts/46717 · 2026-08-22