The Spanish authority closes a sanction procedure initiated for sharing a manipulated photograph of a minor, on the grounds that the facts have already been subject to judicial proceedings before a juvenile court which ended with a conciliation agreement, considered an adequate response.

Facts and context

The Spanish data protection authority (AEPD) published a decision to close the procedure against an individual for a potential breach related to the unlawful processing of a minor's photograph.

The case originated from a complaint by the mother of a minor, who reported the sharing by a third party of a photograph of her daughter, initially posted on Instagram, manipulated to make her appear naked.

Reasons for the decision

• Obligation to have a legal basis for processing (Article 6 of the GDPR): The authority had initiated a sanction procedure considering that the manipulation and sharing of the photograph of a minor, without her consent or any other valid legal basis, constituted an alleged violation of Article 6 of the GDPR. However, during the investigation, it was established that the same facts had been subject to parallel proceedings before a juvenile court. This judicial procedure ended with a final dismissal decision following a conciliation agreement between the parties. The supervisory authority considered that this judicial response was adequate and proportionate to the responsibility of the perpetrator, thus justifying the closure of its own administrative procedure.

Authority's decision

The authority decided to close the sanction procedure initiated against A.A.A as a conciliation was reached between the parties involved.

Lessons learned

This decision reminds that:

• A supervisory authority may decide to close a sanction procedure if the facts have already been addressed by a judicial authority and an adequate response, such as a conciliation, has been provided.
• The application of the principle of proportionality may lead an authority not to impose an administrative sanction when the dispute has already been resolved by another means, notably judicial.
• The existence of parallel judicial proceedings concerning the same facts is a determining factor that must be brought to the attention of the supervisory authority, as it may influence its decision to pursue or close the case.
• The lack of sufficient evidence regarding the extent of the dissemination of personal data may limit the authority's ability to establish full responsibility of the accused.