AEPD · PS/00377/2025

The DPA imposed a fine of €6,000 on the controller for publishing on numerous websites naked images of the data subject without a valid legal basis.

StatusNot cited by any decision here yet

€6,000Fine

Spain

Personal Data Processing Supervisory Authorities Lawful Basis Controllers

GDPRhub pageNov 10, 2026Sourcegdprhub.eu

Full text

Machine translation of the decision, via GDPRhub — not the official text.

The DPA imposed a fine of €6,000 on the controller for publishing on numerous websites naked images of the data subject without a valid legal basis. English Summary. Facts. The DPA received a complaint by a data subject after a controller created fake profiles in the data subjects name, and published images from eight years ago where the data subject appeared naked. The images were published and made available on multiple websites. The DPA initiated a preliminary investigation, and located links and images of the data subject on other websites. The DPA found the data subject and the images in question on 89 websites. The DPA contacted some of the websites and requested them to remove the images, however on eight websites removal did not happen. Holding. The DPA held that in the present case, numerous images of the data subject were published on various websites which constitutes processing of personal data by the controller. The images contained erotic or pornographic content and inclu

How it connects

References

Art. 6

Related across sources

C-40/17 Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV C-40/17 (Fashion ID) CJEU Jul 29, 2019 Controllers IP Address Legitimate Interest

C-362/14 Maximillian Schrems v Data Protection Commissioner C-362/14 (Schrems I) CJEU Oct 6, 2015 Privacy Shield International Transfer Supervision

C-131/12 Google Spain SL and Google Inc. v AEPD and Mario Costeja González C-131/12 (Google Spain) CJEU May 13, 2014 Right to be Forgotten Controllers IP Address

C-92/09 Volker und Markus Schecke GbR (C-92/09) and Hartmut Eifert (C-93/09) v Land Hessen The Court of Justice of the European Union (Grand Chamber) ruled on whether EU regulations requiring Member States to publish on a website the names of all beneficiaries of… CJEU ·Grand Chamber Nov 9, 2010 GDPR Subject-Matter and Objectives Personal Data Legitimate Interest

C-212/13 František Ryneš v Úřad pro ochranu osobních údajů The Court of Justice of the European Union (Fourth Chamber) addressed whether operating a camera system on a residential property that records images of individuals passing by… CJEU ·Fourth Chamber Dec 11, 2014 Material scope (GDPR) Personal Data IP Address

Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors Joint Controllers