The Spanish data protection authority (AEPD) has closed a sanction procedure initiated for unlawful data processing, applying the principle prohibiting double punishment for the same facts (*non bis in idem*), after the data subject was criminally convicted.

Facts and context

The Spanish data protection authority (AEPD) today published a decision to close a sanction procedure against a minor for alleged breaches related to the recording and broadcasting of a video of a sexual assault.

The case originated from a press article reporting the live broadcast on a platform of a sexual assault on a minor, which led the authority to launch investigations in collaboration with the judicial police.

Reasons for the decision

The authority had initially initiated a procedure for the following breach:

• Lack of legal basis for processing (Article 6 of the GDPR): The authority had initiated a sanction procedure against a minor, identified as A.A.A., on the grounds that he recorded a live broadcast of a sexual assault and then shared it in a group on another platform. This processing of personal data, particularly sensitive and carried out without any consent or other legal basis, constituted an alleged violation of paragraph 1 of Article 6 of the GDPR.

Decision of the authority

However, noting that the facts had already been the subject of a final criminal conviction against A.A.A. for an offense of revealing secrets, the authority closed the procedure. Applying the principle prohibiting double punishment for the same facts (*non bis in idem*), it considered that it could not impose an administrative sanction for conduct already punished by criminal justice, which had imposed socio-educational measures and compensation of €3,000 to the victim.

Lessons learned

This decision recalls that:

• The *non bis in idem* principle applies to sanction procedures of data protection authorities, preventing an administrative sanction when the same facts have already led to a final criminal conviction.
• The coordination between criminal and administrative procedures can lead to the suspension and then closure of a GDPR sanction procedure if the criminal route results in a conviction for the same acts.
• The recording and broadcasting of images of a person, even by a private individual, constitute processing of personal data subject to the GDPR as long as the exception relating to purely personal or domestic activity does not apply.
• A criminal conviction for acts involving unlawful data processing (such as revealing secrets) can serve as a sanction and exempt the supervisory authority from imposing a second one under the GDPR.