Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Private individual: Insufficient legal basis for data processing
The Spanish DPA has imposed a fine of EUR 10,000 on a private individual.
Full text
The Spanish DPA has imposed a fine of EUR 10,000 on a private individual. The individual, a guard at a detention center, took pictures from the detention center's video surveillance system and forwarded them to colleagues via WhatsApp. The pictures showed a female visitor to the correctional facility. The DPA found that the individual did not have a sufficient legal basis to take and forward the pictures.
Industry: Individuals and Private Associations
How it connects
References
Related across sources
10 A 5144/23 VG Hannover: Controller appeals DPA reprimand over unlawful workplace video surveillance The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the… Administrative Court Hannover Aug 7, 2026 Controllers Supervisory Authorities Legitimate Interest
42 K 51.25 VG Berlin: DPA correctly found residential video surveillance for property protection The property management company of a high-rise building (the controller) had a video surveillance system installed at the entrances of the building in 2021. The installation was… Administrative Court Berlin Apr 20, 2026 Legitimate Interest Supervisory Authorities Retention Period
C-422/24 Case C-422/24 - AB Storstockholms Lokaltrafik. A new page has been created with the following information: "" CJEU Jan 7, 2026 Personal Data Fairness & Transparency Controllers
Guidelines 3/2019 processing of personal data through video devices Guidelines ·EDPB Jan 30, 2020 Personal Data Processing Material scope (GDPR)
CJEU: Camera image of identifiable person constitutes personal data Personal data: The image of a person recorded by a camera constitutes personal data because it makes it possible to identify the person concerned. (¶ 22) Dec 11, 2014 Personal Data Legitimate Interest Identification
7890/2026 BAC (Bulgaria) - 7890/2026 A data subject lodged a complaint with the Bulgarian DPA (CPDP), alleging that her neighbour (the controller) was unlawfully monitoring her property through CCTV. She claimed that… Jul 13, 2026 Integrity and Confidentiality Principle Personal Data Controllers