The Spanish authority archives a procedure for unlawful dissemination of sexual images, applying the principle of non-cumulative sanctions following a final criminal conviction for the same facts.

Facts and context

The Spanish Data Protection Agency (AEPD) has today published a decision to archive a procedure against an individual for alleged breaches related to the unauthorized dissemination of sexual images.

The case originated from an investigation initiated by the authority on its own initiative, after the publication of a press article reporting the live online broadcast of a sexual assault on a minor.

Reasons for the decision

• Obligation to have a legal basis for processing (Article 6 of the GDPR): The authority had initiated a sanction procedure on the grounds that the recording and live broadcasting on a platform of images showing a sexual relationship with an intoxicated minor constituted processing of personal data that was manifestly unlawful, lacking any legal basis. However, the AEPD found that these same facts had already been subject to a criminal procedure. The prosecuted individual was definitively convicted by a juvenile court for an offence of discovery and disclosure of secrets under the Spanish Criminal Code, which led the authority to reconsider its own procedure.

Decision of the authority

Consequently, the authority decided to archive the procedure against the individual concerned.

Lessons learned

This decision reminds that:

• The principle of non-cumulative sanctions opposes the imposition of an administrative sanction for GDPR violation when the same facts involving the same person have already resulted in a final criminal conviction.
• When unlawful data processing also constitutes a criminal offence, the criminal procedure takes precedence over the administrative sanction procedure in data protection matters.
• A supervisory authority must suspend its sanction procedure pending the outcome of a criminal procedure concerning the same facts to ensure respect for the principle of non-cumulative sanctions.
• The recording and dissemination of images of a person without their consent, especially in an intimate context, constitute processing of personal data subject to GDPR obligations, regardless of their criminal classification.