A content creator was reprimanded by the Spanish authority for publishing a humorous video on social networks without the consent of the person filmed. The absence of a financial penalty is explained by the cooperation of the data controller, who quickly removed the content and committed to implementing corrective measures.

Facts and context

The Spanish Data Protection Authority (AEPD) has today published a warning decision against A.A.A. for breaches related to the non-consensual publication of a video on social networks.

The case originated from a complaint by an individual concerning the dissemination without their consent of a humorous video on TikTok and Instagram in which they were identifiable.

Grounds for the decision

• Obligation to have a legal basis for processing (Article 6 of the GDPR): The authority found that the content creator, A.A.A., had captured, stored, and disseminated the image and voice of the complainant through a video published on their TikTok and Instagram accounts, which total more than 325,000 followers. These operations constitute processing of personal data carried out without a valid legal basis, notably in the absence of consent from the data subject, which the data controller acknowledged. The authority therefore concluded a violation of Article 6(1) of the GDPR.

Decision of the authority

Consequently, the authority issued a warning against A.A.A.

Lessons learned

This decision confirms / specifies / recalls that:

• The capture and dissemination of the image of an identifiable person on social networks, even in a humorous context, constitute processing of personal data subject to the GDPR.
• The publication of a third party's image on online platforms requires a valid legal basis, most often the explicit consent of the data subject.
• Active cooperation with the supervisory authority, notably the rapid removal of the disputed content and the commitment to adopt corrective measures, can constitute a significant mitigating factor allowing to avoid a financial penalty in favor of a simple warning.
• Content creators and influencers are considered data controllers and must, as such, comply with all obligations provided by the GDPR for the data they collect and disseminate.