The Spanish data protection authority sanctions a press organization for publishing a non-anonymized video of an assault involving a minor, ruling that the data minimization principle was violated, despite the prior virality of the video.

Facts and context

The Spanish data protection authority (AEPD) has today published a sanction decision against the company EL LEÓN DE EL ESPAÑOL PUBLICACIONES, S.A. (including the imposition of a €20,000 fine) for breaches related to the publication of a video allowing identification of participants in an assault, including a minor.

The case originated from an ex officio investigation initiated by the AEPD concerning the dissemination, by the company's news site and its social media accounts, of a video showing a physical assault, without any technical measures applied to prevent identification of the victim and the assailant, who was a minor.

Grounds for the decision

The authority found a breach of the GDPR:

• Data minimization obligation (Article 5(1)(c) of the GDPR): The authority does not dispute the legitimacy of the processing for journalistic purposes but assesses the proportionality of the data processed. It considers that the dissemination of the video without anonymizing the faces of the victim and the minor was excessive and unnecessary to achieve the information objective. The company's argument that the video was already viral before its publication was rejected, the authority considering that this circumstance does not exempt the data controller from its own obligations. By publishing, the company contributed to a wider dissemination of the data, acting negligently by not using available techniques to protect the identity of the data subjects, especially considering the best interests of the minor. The authority balanced freedom of information and the right to data protection, concluding that disclosing the identities was not essential to understanding the case, citing the European Court of Human Rights case law (notably the *Hachette Filipacchi Associés v. France* judgment, no. 71111/01).

Authority's decision

Consequently, the authority imposed a €20,000 fine on EL LEÓN DE EL ESPAÑOL PUBLICACIONES, S.A.

Furthermore, the authority ordered the company to adopt, within three months, the necessary technical and organizational measures to ensure compliance with the data minimization principle, particularly regarding the publication of information relating to minors, and to permanently cease processing by removing the contentious content.

Lessons learned

This decision reminds that:

• Prior virality of content on the internet does not exempt a data controller who republishes it from its own obligations under the GDPR, notably the obligation to respect the minimization principle.
• The exercise of freedom of information must be balanced with the right to data protection, and the dissemination of personally identifiable data must be strictly necessary and proportionate to the pursued informational purpose.
• The personal data of minors benefit from enhanced protection, requiring particular vigilance from the data controller when balancing the rights and freedoms at stake.
• Data controllers, especially media, must implement available technical measures (anonymization, blurring) to reconcile the informational purpose with the protection of individuals' rights, in accordance with the data protection by design principle.