Club Esportiu – €600 Fine (Spain, 2025)

Parents registered their son to play in junior football Summer Camp with Club Esportiu (controller). At the time of registration, the parents indicated on the form that they did not wish to consent for photographs to be taken of their son. The club followed up with the parents, urging them to consent to the photographs being taken in order for the registration to continue. The club noted that in any event, they could not guarantee that their child would not appear in photographs taken. The parents filed a complaint with the Catalan DPA (APDCAT) on June 19th 2024. During the proceedings, the controller argued that they did not have facial recognition technology and could thus not guarantee that specific children did not appear in group photos taken during the camp. They also claimed that the photos taken were only for use in club publications and their social network pages, and that the complaint should be dismissed. The DPA began their investigation on 19th November 2024. The DPA highlighted the fact that the parents were informed that without consenting to the photographs of their child being taken, they could not proceed with registration, and held that the consent given would not have been “free”, as required in Article 7 GDPR. The DPA according found that the controller infringed Article 7 GDPR. The DPA also noted that the absence of anonymisation software on the part of the controller was not an excuse for not offering the parents a genuine choice in consenting to the processing. The DPA initially set the fine at €1,000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may acknowledge its responsibility for the alleged violations and/or make a voluntary payment of the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €600