DPA case PS/00408/2020 – Reprimand (Spain, 2021)

A Secondary School reported to the Spanish DPA (AEPD) that they had found that several minors had a assaulted another student, and that they had recorded the assault and subsequently posted it on Instagram. This led to the distribution of the video, that ended in several newspapers and digital media. Following an investigation, the police was able to identify the minor that created the Instagram account and uploaded the video. Afterwards, the minor deleted the video and the account, that later could only be found on the media. All the minors involved were prosecuted and condemned for the assault by a criminal court. The AEPD concluded that the minor involved in the assault that had recorded such acts and uploaded the video to Instagram had infringed Article 6(1) GDPR, for processing personal data without a legitimate basis (namely without consent). They decided to issue only a warning for this behaviour, given that the violation was committed by a natural person, that was also a minor. They considered that a fine would have been a disproportionate sanction. They also ordered the minor never to process data without a legitimate basis again. The AEPD also discussed the interplay between the right to data protection and the right to information that the minor could have by posting the video on Instagram, mentioning the fact that, according to Spanish case law, the right to one's own image and the right to data protection is not an absolute right. However, for any of those rights to be overridden, there must be a public interest that prevails, what did not happen in this case. The authority also discussed whether a minor could be sanctioned by administrative law, as there is not such a clear legal framework on the subject as it exists in criminal law. They concluded that, for minors aged 14 onward, legal responsibility could be claimed, and therefore they can be sanctioned, even if their parents are co-responsible.