El León Espanol – €10,000 Fine (Spain, 2024)

A data subject filed several complaints with the Spanish DPA (Agencia – AEPD) against specific users of Twitter as well as a newspaper, the controller. The Twitter users had posted a video in which the data subject is clearly recognisable. After its publication on Twitter, the video went viral. The controller had published the video as part of an article on its website. The data subject stated that the video had been created for work purposes for the launch of a social media challenge. On the 9 September 2022, the AEPD started preliminary proceedings against the controller. In response, the controller submitted a statement showing that it had deleted the video from its website. The controller argued that the focus of the article was to analyse the popularity and implications of the trend rather than assessing the data subject’s personal or private life. It further argued that in its role as a media provider it was required to inform on current relevant events. It also highlighted that other media outlets had also shared the video. In addition, the controller brought forward that it had merely included a nickname of the data subject in the article, which had been manifestly made public through the trend. On the 15 April 2024, the AEPD in its preliminary findings found that the controller had breached the data minimisation principle under Article 5(1)(c) GDPR and for this issued a fine of €10,000. The AEPD stated that anonymization techniques should have been implemented which would have blurred the image or distorted the voice of the data subject. In response to this, the controller again submitted that GDPR protections cannot reasonably be applied in this case due to press freedom. As the video of the data subject had gone viral before the controller published their article, the data subject was already a person in the public interest. The controller further submitted that the article could not be understood without showing the content of the video including the audio. The AEPD rejected the argument that the data subject was a person of public interest. It set out that the video had gone viral due to the actions of third parties without the consent or involvement of the data subject. The AEPD also rejected the argument that the disclosure of the video was necessary in order to prove why the article was newsworthy. It explained that this could still be understood with the appropriate anonymization techniques in place. The AEPD further analysed that although the loss of control experienced by the data subject occurred upon the popularisation of the video on Twitter, this did not preclude any wrongdoing by the controller. The fact that the controller is a media provider, according to the AEPD, does not diminish the obligations set out by the GDPR. In fact, the AEPD highlights that as a media outlet, the controller should have taken proactive care in assessing the risk to the data subject in accordance with Article 5(2) GDPR. The AEPD clarified that the controller should have chosen not to disseminate the video when weighing up the public interest against the interest of the data subject. In conclusion, the AEPD reiterated its assessment of the 15 April 2024 for a breach of Article 5(1)(c) GDPR including an administrative fine of €10,000 and concluded the sanctioning procedure.