An individual is sanctioned for publishing on a social network images and personal data of a neighbor and their minor daughter without a legal basis, a violation aggravated by non-compliance with a provisional removal order.

Facts and context

The Spanish Data Protection Authority (AEPD) has today published a sanction decision against an individual (including the imposition of a 10,000 € fine) for breaches related to the unlawful publication of personal data on a social network.

The procedure was initiated following a complaint filed on August 22, 2024, denouncing the unauthorized dissemination of images of the complainant and their minor daughter, along with their identity and address, on social network profiles.

Grounds for the decision

• Obligation to have a legal basis for processing (Article 6(1) of the GDPR): The authority found that the individual concerned had recorded and shared on the social network ***RED.1 videos and images of the complainant and their minor daughter. These posts also included their full names and home address. The authority qualified these actions as processing of personal data, for which the individual is the controller. However, this processing was carried out without any legal basis, notably in the absence of any prior, free, specific, informed, and unambiguous consent from the data subjects. A police report confirmed that the individual was indeed the author of the posts, which reached up to ***CANTIDAD.3 views, and that these contained death threats. The dissemination of data concerning a minor was considered an aggravating circumstance.

Authority's decision

Consequently, the authority imposed a fine of 10,000 € on the individual concerned.

Furthermore, the authority ordered the sanctioned person to prove, upon notification of the decision, that they have suspended the dissemination of images, recordings, and personal data of the complainant and their minor daughter. Failure to comply with this injunction could constitute a separate offense under Articles 83(5) and 83(6) of the GDPR.

Lessons learned

This decision reminds that:

• Publishing personal data on a social network profile, even by an individual in a neighborhood conflict context, does not fall under the exception for purely personal or domestic activities and constitutes data processing subject to the GDPR.
• Dissemination of the image or any other personal data of a minor without the consent of the holders of parental authority constitutes a particularly serious violation of data protection rights.
• Non-compliance with a provisional measure ordered by a supervisory authority, such as the removal of unlawful content, is an aggravating factor taken into account in determining the amount of the sanction.
• The intentionality of the offender and the volume of people who accessed the disseminated personal data are relevant criteria to assess the severity of the breach and to proportion the sanction.