The Spanish Data Protection Agency (AEPD) sanctioned an individual for disseminating intimate photographs of another person without a legal basis on several websites. The procedure was closed after the responsible party acknowledged their liability and voluntarily paid a reduced fine.

Facts and context

The Spanish Data Protection Agency (AEPD) issued a sanction decision against an individual, including the imposition of a €10,000 fine, for breaches related to the unauthorized dissemination of intimate images on the internet.

The case originated from a complaint by a person reporting the creation of fake profiles in their name and the online publication of nude images of them.

Grounds for the decision

The supervisory authority found a principal infringement against the individual involved:

• Obligation to have a legal basis for processing (Article 6 of the GDPR): The authority found that photographs showing the complainant's face and naked body had been disseminated on 89 links, mainly on erotic or pornographic websites, making her identifiable. The authority classified these images as personal data and their dissemination as processing. It considered the individual responsible for the processing, as they determined its purposes and means. The investigation did not establish any lawful basis, notably the consent of the data subject, leading the authority to conclude a violation of the obligation to have a legal basis.

Authority's decision

Consequently, the authority imposed a €10,000 fine on A.A.A. The amount was reduced to €6,000 after applying a 40% reduction for acknowledgment of responsibility and voluntary payment.

Moreover, the authority had provisionally ordered the immediate cessation of data processing, a measure respected by the sanctioned individual and lifted in the final decision.

Lessons learned

This decision reminds that:

• The online dissemination of a photograph of an identifiable person, even without their name, constitutes processing of personal data subject to the GDPR requirements, notably the need to rely on a valid legal basis.
• An individual who decides to publish data concerning a third party and determines the modalities (for example, by uploading them to websites) is considered a data controller and must comply with all related obligations.
• The Spanish authority's sanction procedures provide mechanisms for significant fine reductions (here, 40%) in case of acknowledgment of responsibility and voluntary payment, which can be a resolution strategy for those involved.