The Spanish data protection authority has closed the sanction procedure against an aesthetic clinic, not on the merits, but due to the prescription of the procedure, the authority having failed to issue its decision within the legal period of 12 months.

Facts and context

The Spanish data protection authority (AEPD) has today published a decision to close the sanction procedure initiated against PUCHERONLINE, S.L. due to prescription, concerning potential breaches related to the processing of health data and the absence of a legal basis.

The case originated from a complaint filed by an individual on 22 December 2023, concerning the unauthorized publication of their photographs on social networks following an aesthetic medicine treatment carried out the day before, while they had only consented to use within the framework of congresses.

Reasons for the decision

The authority had initiated a sanction procedure on 29 October 2024 for potential violations of Articles 6 and 9 of the GDPR. However, this decision does not rule on the merits of these breaches. The sole reason for the decision is the prescription of the procedure, the authority having failed to issue a final decision within the 12-month period provided by law, which results in the termination of the procedure and the archiving of the file.

The breaches initially considered by the authority were as follows:

• Obligation to have a lawful legal basis (Article 6 of the GDPR): The procedure was initiated because the complainant claimed that their images had been published on social networks without their consent. They had specifically limited their authorization to use within the framework of congresses, explicitly excluding social networks, which would have deprived the data controller of a valid legal basis for this publication.
• Obligation relating to the processing of special categories of data (Article 9 of the GDPR): The authority had also considered a potential violation of the prohibition on processing health data without an appropriate legal basis. The complainant's photographs, taken in the context of an aesthetic medicine treatment, constituted health data, the processing of which is generally prohibited except for exceptions provided by the GDPR, notably explicit consent for the intended purpose.

Decision of the authority

Consequently, the authority declared the sanction procedure prescribed and ordered the archiving of the file, without imposing any sanction against PUCHERONLINE, S.L.

Lessons learned

This decision confirms / specifies / recalls that:

• Supervisory authorities are subject to strict procedural deadlines; failure to comply with the time limit for ruling may result in the prescription of the sanction procedure and the termination of proceedings.
• Photographs taken in the context of an aesthetic medicine treatment are classified as health data within the meaning of Article 9 of the GDPR and their processing requires enhanced protection.
• Consent must be obtained for each specific purpose; authorization given for use in a scientific or professional context (congresses) does not constitute a valid legal basis for publication on public platforms such as social networks.
• The prescription of a sanction procedure results in its archiving, without a decision on the merits of the alleged breaches being made, which means that the company is neither sanctioned nor formally exonerated.