[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flgqmbaxhTBgPBE9iMk2dsVBiyArXps5OXo_uW7JNLqA":3},{"article":4,"iocs":44},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":23,"category":24,"article_tags":28},"8a87a137-7a0d-498b-a027-4eceb20550f4","AEPD (Spain) - PS-00304-2024","aepd-spain-ps-00304-2024-a61a92","Created page with \"{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color= |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS-00304-2024 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00304-2024.pdf |Original_Source_Language_1=Spanish; Castilian |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type...\" Show changes","Spain's Data Protection Authority (AEPD) fined El Español newspaper €20,000 for violating Article 5(1)(c) GDPR (data minimisation principle) by publishing an identifiable video of an assault victim and minor assailant without applying anonymization techniques. The DPA found that while reporting on the incident was newsworthy, disclosing identifiable images and voices was unnecessary and disproportionate; the newspaper could have achieved its journalistic purpose using face-blurring or audio alteration. The authority rejected the newspaper's defenses of newsworthiness, prior virality, and freedom of information, clarifying that these rights must be balanced against data protection on a case-by-case basis.","Spain's AEPD fined newspaper €20,000 for publishing identifiable video of assault victim and minor without","Help AEPD (Spain) - PS-00304-2024: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 14:59, 27 July 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators223 edits Tag: Decisions [1.0] (No difference) Latest revision as of 14:59, 27 July 2026 AEPD - PS-00304-2024 Authority: AEPD (Spain) Jurisdiction: Spain Relevant Law: Article 5(1)(c) GDPR Article 5(2) GDPR Article 25 GDPR Article 58(2)(d) GDPR Article 7 LOPDGDD Type: Investigation Outcome: Violation Found Started: 01.04.2025 Decided: Published: 25.06.2026 Fine: 20000.0 EUR Parties: El León de El Español Publicaciones, S.A. National Case Number\u002FName: PS-00304-2024 European Case Law Identifier: n\u002Fa Appeal: Unknown Original Language(s): Spanish; Castilian Original Source: AEPD (in ES) Initial Contributor: bms The DPA fined a newspaper €20,000 for publishing an identifiable video of an assault victim and a minor assailant, since their identification was unnecessary for reporting the incident. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts El León de El Español Publicaciones, S.A., the controller, operates the Spanish digital newspaper „El Español“. It published an article concerning an assault and embedded a video showing both the victim and the assailant, who was a minor. Their image and voice were disclosed without applying techniques to prevent their direct or indirect identification. The controller also published the video through its accounts on two social media platforms. The DPA initiated preliminary investigations ex officio after becoming aware of the dissemination of the video. It ordered the controller, as a precautionary measure, to immediately remove the content from the relevant URLs. The controller subsequently informed the DPA that it had removed the article and prevented access through both external links and its internal search engine. The DPA verified that the video was no longer available through the identified web addresses. The DPA subsequently initiated disciplinary proceedings for a potential infringement of Article 5(1)(c) GDPR. The controller argued that the incident was newsworthy, the video had already gone viral and the publication was protected by freedom of information. It also claimed that the video was necessary to understand the news and that the assailant’s status as a minor should be assessed in light of his apparent maturity and awareness that he was being recorded. Holding The DPA found that the controller violated the data minimisation principle under Article 5(1)(c) GDPR. The DPA clarified that the proceedings did not concern whether the incident was newsworthy or whether the controller could report on it. Instead, the relevant question was whether publishing the identifiable image and voice of the individuals was necessary and proportionate for that purpose. According to the DPA, freedom of information and the right to data protection are not absolute. Under Article 85 GDPR, they must be reconciled on a case-by-case basis. In this case, the controller could have informed the public about the incident while using technical measures, such as blurring the individuals’ faces or altering the audio, to prevent their identification. Showing the individuals in an identifiable manner was therefore not necessary to achieve the journalistic purpose. The DPA also rejected the argument that the previous virality of the video justified its republication. Each additional publication contributed to the further dissemination of the personal data and amplified the risks and adverse effects for the data subjects. Similarly, the fact that the affected individuals had not submitted a complaint did not prevent the DPA from exercising its supervisory powers ex officio. The DPA gave particular weight to the vulnerability of the victim and to the fact that the assailant was a minor. It held that the best interests and enhanced protection of minors had to be taken into account irrespective of the minor’s alleged maturity or awareness of being recorded. The age at which a minor may consent under Article 7 LOPDGDD did not reduce the controller’s obligation to assess whether the disclosure was necessary. The DPA further noted that, pursuant to Articles 5(2) and 25 GDPR, the controller was required to assess and document the risks of the processing and implement data protection by design and by default. As a professional media organisation regularly processing personal data, the controller was expected to apply a particularly high standard of diligence and to consider less intrusive methods of publication. When determining the sanction, the DPA considered the unrestricted online dissemination of the data, the potentially unlimited audience, the controller’s negligence, the sensitive circumstances surrounding the victim and the minor, and the impact of the infringement on the rights of a minor. It therefore imposed a €20,000 fine. Under Article 58(2)(d) GDPR, the DPA also ordered the controller to demonstrate, within three months after the decision became enforceable, that it had adopted measures to prevent the excessive publication or dissemination of personal data, particularly data concerning minors. It made the earlier precautionary measure definitive and required the permanent removal of the content, while allowing its restricted preservation where necessary as evidence for administrative, police or judicial proceedings. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Spanish; Castilian original. Please refer to the Spanish; Castilian original for more details. Case No.: EXP202313543 DECISION ON DISCIPLINARY PROCEEDINGS Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On ***DATE.1 “11:41,” a news article was published in the newspaper www.elespanol.com ***URL.1, with the title: “***TITLE.1,” which was recorded as evidence by the AEPD. The news article contains “(…)”. In the video shown, the following details appear: embedded on the page, in the post on the ***PLATFORM.1, the name “***PROFILE.1” “@PROFILE.1” “11:38 ***DATE.2.” If you click the play button, you can watch the video in which, inside (…), a young man appears talking to an older person, and you can hear the young man ask, (…) and the older person respond: (…). The same video also appears on the pages of ***PLATFORM.1, ***URL.2, in the post by “El Español,” “@elespanolcom,” “1:22 p.m. ***DATE.5 14.7K views,” and on ***PLATFORM.2 of the same newspaper, ***URL.3, dated ***DATE.1, with 59 likes and 122 comments. In the latter, the name “***PROFILE.1” “@PROFILE.1” is not visible, and it is reported (…) that the news item was not flagged, as evidenced by the AEPD. On ***DATE.1, the AEPD obtained a post on ***PLATFORM.1 from the “***PROFILE.1” profile at 11:38 on ***DATE.2 with the text “(…)…” and images from a video in which, inside (…), a young man is seen talking to an elderly person, (…) and responding to the older person: (…). Through the ***PLATFORM.1 profile “@PROFILE.1,” with a post published on ***DATE.2 at 11:38 a.m., the aforementioned video can be seen, with 2.3 million views, serving as evidence of the aforementioned posts on file with the AEPD. On ***DATE.3, the Director of the Spanish Data Protection Agency ordered the ex officio initiation of preliminary investigative proceedings in connection with information obtained through the media regarding a possible violation in the processing of personal data related to the dissemination of a video. According to the information published, the video in question was (…) recorded by a third party and subsequently disseminated through various media outlets and social","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00304-2024&diff=52507&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-07-27T14:59:48+00:00","2026-07-27T16:00:20.259758+00:00",7,[18,21],{"name":19,"type":20},"El Español","vendor",{"name":22,"type":20},"AEPD","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":25,"name":26,"slug":27},null,"GDPR","gdpr",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[]]