DPA case PS/00050/2020 – Complaint Upheld (Spain, 2020)

The owner of a restaurant lodge a complaint with the Spanish DPA (AEPD) against another natural person that had published a tweet with a picture of a bill from that restaurant which included name, surname, fiscal ID and bank account number of the restaurant owner. This was in connection with a political discussion about the expenses of a political party when in power of the city administration. The person that posted the tweet argued that it was not the intention to unlawfully publish personal data but that the purpose was to showcase the expenses of the political party in the restaurant owned by the complainant and that this information is of public and political interest. He also argued that most of the data showed in the photo of the tweet was of public domain as the same data could be obtained from other public sources of information such as public procurement procedures that the owner of the restaurant had obtained. The Spanish DPA argued that even if the tweet with the attached photo might have some public interest for political debate, the photo still included personal data of a natural person that was not relevant for the debate. And also that some of the personal data (namely the bank account) was not an information that was available in other public sources. Is publishing a photo that includes personal data of a restaurant owner lawful in line of Article 5(1)(a) GDPR? The Spanish DPA concluded that there has been a breach of Article 5(1)(a) GDPR because the uploading of such personal data was not lawful, as it was not based on any lawful legal basis. Given that the offender was an physical person that does not process personal data on regular basis and that he had no previous convictions or any record of infractions related to data protection, the Spanish DPA decided to just issue a warning and request the removal of the tweet.