# Clinic owner: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2024-07-05
- Original: https://www.enforcementtracker.com/ETid-2462
- Canonical: https://overview.legal/posts/48577
- Topics: Social Media, Healthcare, Consent, Controllers, Processing Agreement, Data Controller, Processing, Supervisory Authorities

## Summary

The Spanish DPA has fined the owner of a plastic surgery clinic EUR 10,000. The controller posted before-and-after pictures of an individual who had undergone surgery at the clinic on social media (Facebook and Instagram) without obtaining the individual’s consent.

## Full text

The Spanish DPA has fined the owner of a plastic surgery clinic EUR 10,000. The controller posted before-and-after pictures of an individual who had undergone surgery at the clinic on social media (Facebook and Instagram) without obtaining the individual’s consent.

GDPR Articles: Art. 6 (1) GDPR, Art. 9 GDPR
Industry: Health Care

---
Generated by overview.legal · https://overview.legal/posts/48577 · 2026-08-22