The Spanish data protection authority sanctioned an individual for publishing a video of his minor daughter on an online platform, without any legal basis, the mother having been deprived of her parental authority.

Facts and context

The Spanish data protection authority (AEPD) today published a sanction decision against an individual (including the imposition of a fine of €1,500) for breaches related to the unauthorized publication of a video exposing his minor daughter.

The case originated from a complaint filed by the Directorate General for Childhood, Family and Natality Promotion, acting as the legal representative of a minor, concerning the dissemination of a video on an online platform.

Grounds for the decision

The authority found the following breach:

• Lack of legal basis for processing (Article 6 of the GDPR): The authority found that the mother of the minor, whose parental authority was suspended, had published a video of more than 8 minutes on an online platform. This video clearly identified the child and recounted personal circumstances related to her guardianship and suffering. The AEPD qualified this dissemination as processing of personal data and concluded that it was not based on any of the lawful bases provided by the GDPR. In particular, the consent of the minor's legal representative was missing, and no other justification, such as vital interest, legal obligation or public interest, could be invoked. The fact that the video was viewed 130 times before its removal was taken into account.

Authority's decision

Consequently, the authority imposed a fine of €1,500 on the mother of the minor.

Furthermore, the authority ordered that the provisional measures, which had led to the removal of the video by the platform, become definitive in order to sustainably protect the rights and freedoms of the minor.

Lessons learned

This decision confirms / specifies / recalls that:

• The dissemination of a video showing an identifiable person on an online platform constitutes processing of personal data subject to the GDPR, even when carried out by a private individual, if it goes beyond the strictly personal or domestic scope.
• Consent for the processing of a minor's data must be given by the holder of parental authority; a parent deprived of parental rights cannot validly consent on behalf of their child.
• Supervisory authorities can order effective provisional measures, such as the removal of online content, to quickly stop a violation and protect the rights of the data subjects, especially the most vulnerable.
• A sanction can be imposed even for dissemination with limited reach, as the seriousness of the infringement on the rights of a vulnerable person can outweigh the size of the audience.