The Spanish authority sanctions a media outlet for broadcasting a video of an assault between youths with their voices unaltered, considering that the publication of this personal data was not necessary for the purpose of informing the public and thus violated the data minimization principle.

Facts and context

The Spanish Data Protection Authority (AEPD) has today published a sanction decision against Sociedad Española de Radiodifusión (including the imposition of a fine of €10,000) for breaches related to the data minimization principle.

The case originated from an ex officio investigation by the authority following the media's publication of a violent video in which the voices of the aggressors and the victim, minors, were audible.

Reasons for the decision

• Data minimization obligation (Article 5(1)(c) of the GDPR): The authority considered that publishing the unmodified voices of the minors involved in the assault constituted excessive processing of personal data. Although the right to information may justify broadcasting the news, the journalistic purpose did not require disclosing the voices, which are personal data. The AEPD ruled that the media should have applied less intrusive measures, such as voice distortion, to reconcile freedom of expression with the data protection rights of the data subjects, whose best interests as minors require enhanced protection. The company's negligence was noted, as it failed to ensure adequate data protection in sensitive circumstances despite pixelating faces.

Authority's decision

Consequently, the authority imposed a fine of €10,000 on Sociedad Española de Radiodifusión.

Furthermore, the authority ordered the company to make permanent the removal or modification of the audiovisual content to prevent any identification of the data subjects.

Lessons learned

This decision confirms that:

• A person's voice constitutes personal data whose processing must comply with the GDPR, even if other identifying elements such as the face are masked.
• In a journalistic context, the data minimization principle requires ensuring that each personal data disclosed is strictly necessary for the purpose of informing the public, and that no less intrusive means exist to achieve this objective.
• Media outlets, as data controllers, must assess risks to individuals' rights and freedoms before publishing content and cannot rely on partial measures if other identifying data remain.
• The processing of minors' personal data, including in an informational context, requires enhanced protection and balancing of interests where their best interests must be a primary consideration.
• Simple negligence or lack of diligence in applying data protection principles is sufficient to characterize a breach, without needing to prove intent to harm.