The Spanish Data Protection Authority (AEPD) has sanctioned an individual for publishing on a social network personal data (image, first name, last name, age) of a third party without a legal basis. The decision analyzes in detail the balancing between the right to data protection and freedom of expression, concluding that the dissemination of information relating to the private life of a non-public person does not constitute a public interest justifying such an infringement.

Facts and context

The Spanish Data Protection Authority (AEPD) today published a sanction decision against an individual, including the imposition of a fine of €1,000, for breaches related to the publication of personal data on a social network without a legal basis.

The case began with an ex officio investigation by the authority, which became aware of the dissemination on the platform ***PLATAFORMA.1 of the identity of a person.

Grounds for the decision

• Obligation to have a legal basis for processing (Article 6 of the GDPR): The authority found that the sanctioned individual published on their social network profile the image, first name, last name, and age of a victim, associating them with a serious private and sexual episode. The authority considered that this processing of personal data was not based on any of the legal bases listed in Article 6(1) of the GDPR, notably due to the absence of consent from the data subject. To exclude freedom of expression as justification, the authority relied on Opinion 06/2014 of the Article 29 Working Party, as well as on the case law of the Spanish Supreme Court (STS 50/2017) and the European Court of Human Rights (judgment of 19 June 2012), concluding that the dissemination of private life details of non-public persons does not contribute to a debate of public interest and that the right to data protection must prevail.

Authority's decision

Consequently, the authority imposed a fine of €1,000 on A.A.A.

Furthermore, the authority ordered the permanent deletion of the published content, thus confirming the interim measure initially addressed to the platform ***PLATAFORMA.1.

Lessons learned

This decision reminds that:

• Freedom of expression does not constitute a legal basis justifying the publication of personal data of a third party, especially when such information concerns the private life of a non-public person and does not contribute to a debate of public interest.
• The person who publishes personal data on a social network profile is considered the data controller and must, as such, ensure they have a valid legal basis before any dissemination.
• A supervisory authority may initiate sanction proceedings on its own initiative, without a prior complaint from the data subject, as soon as it becomes aware of a potential infringement.