AEPD (Spain) - PS-00304-2024

Summary

Spain's Data Protection Agency (AEPD) has fined the digital newspaper 'El Español' €20,000 for publishing an article that included an identifiable video of an assault victim and a minor assailant. The agency found this to be a violation of the data minimization principle under GDPR, as the identification of the individuals was unnecessary for reporting the incident. The newspaper argued freedom of information, but the AEPD stated that while freedom of expression and data protection must be reconciled, technical measures like blurring faces could have been used to prevent identification.

Full text

Help AEPD (Spain) - PS-00304-2024: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 14:59, 27 July 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators309 edits Tag: Decisions [1.0] Latest revision as of 07:35, 16 September 2026 view source Sfl (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators567 editsm Line 13: Line 13: |Original_Source_Name_1=AEPD|Original_Source_Name_1=AEPD |Original_Source_Link_1=https://www.aepd.es/documento/ps-00304-2024.pdf|Original_Source_Link_1=https://www.aepd.es/documento/ps-00304-2024.pdf |Original_Source_Language_1=Spanish; Castilian|Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES|Original_Source_Language__Code_1=ES Latest revision as of 07:35, 16 September 2026 AEPD - PS-00304-2024 Authority: AEPD (Spain) Jurisdiction: Spain Relevant Law: Article 5(1)(c) GDPR Article 5(2) GDPR Article 25 GDPR Article 58(2)(d) GDPR Article 7 LOPDGDD Type: Investigation Outcome: Violation Found Started: 01.04.2025 Decided: Published: 25.06.2026 Fine: 20000.0 EUR Parties: El León de El Español Publicaciones, S.A. National Case Number/Name: PS-00304-2024 European Case Law Identifier: n/a Appeal: Unknown Original Language(s): Spanish Original Source: AEPD (in ES) Initial Contributor: bms The DPA fined a newspaper €20,000 for publishing an identifiable video of an assault victim and a minor assailant, since their identification was unnecessary for reporting the incident. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts El León de El Español Publicaciones, S.A., the controller, operates the Spanish digital newspaper „El Español“. It published an article concerning an assault and embedded a video showing both the victim and the assailant, who was a minor. Their image and voice were disclosed without applying techniques to prevent their direct or indirect identification. The controller also published the video through its accounts on two social media platforms. The DPA initiated preliminary investigations ex officio after becoming aware of the dissemination of the video. It ordered the controller, as a precautionary measure, to immediately remove the content from the relevant URLs. The controller subsequently informed the DPA that it had removed the article and prevented access through both external links and its internal search engine. The DPA verified that the video was no longer available through the identified web addresses. The DPA subsequently initiated disciplinary proceedings for a potential infringement of Article 5(1)(c) GDPR. The controller argued that the incident was newsworthy, the video had already gone viral and the publication was protected by freedom of information. It also claimed that the video was necessary to understand the news and that the assailant’s status as a minor should be assessed in light of his apparent maturity and awareness that he was being recorded. Holding The DPA found that the controller violated the data minimisation principle under Article 5(1)(c) GDPR. The DPA clarified that the proceedings did not concern whether the incident was newsworthy or whether the controller could report on it. Instead, the relevant question was whether publishing the identifiable image and voice of the individuals was necessary and proportionate for that purpose. According to the DPA, freedom of information and the right to data protection are not absolute. Under Article 85 GDPR, they must be reconciled on a case-by-case basis. In this case, the controller could have informed the public about the incident while using technical measures, such as blurring the individuals’ faces or altering the audio, to prevent their identification. Showing the individuals in an identifiable manner was therefore not necessary to achieve the journalistic purpose. The DPA also rejected the argument that the previous virality of the video justified its republication. Each additional publication contributed to the further dissemination of the personal data and amplified the risks and adverse effects for the data subjects. Similarly, the fact that the affected individuals had not submitted a complaint did not prevent the DPA from exercising its supervisory powers ex officio. The DPA gave particular weight to the vulnerability of the victim and to the fact that the assailant was a minor. It held that the best interests and enhanced protection of minors had to be taken into account irrespective of the minor’s alleged maturity or awareness of being recorded. The age at which a minor may consent under Article 7 LOPDGDD did not reduce the controller’s obligation to assess whether the disclosure was necessary. The DPA further noted that, pursuant to Articles 5(2) and 25 GDPR, the controller was required to assess and document the risks of the processing and implement data protection by design and by default. As a professional media organisation regularly processing personal data, the controller was expected to apply a particularly high standard of diligence and to consider less intrusive methods of publication. When determining the sanction, the DPA considered the unrestricted online dissemination of the data, the potentially unlimited audience, the controller’s negligence, the sensitive circumstances surrounding the victim and the minor, and the impact of the infringement on the rights of a minor. It therefore imposed a €20,000 fine. Under Article 58(2)(d) GDPR, the DPA also ordered the controller to demonstrate, within three months after the decision became enforceable, that it had adopted measures to prevent the excessive publication or dissemination of personal data, particularly data concerning minors. It made the earlier precautionary measure definitive and required the permanent removal of the content, while allowing its restricted preservation where necessary as evidence for administrative, police or judicial proceedings. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Spanish; Castilian original. Please refer to the Spanish; Castilian original for more details. Case No.: EXP202313543 DECISION ON DISCIPLINARY PROCEEDINGS Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On ***DATE.1 “11:41,” a news article was published in the newspaper www.elespanol.com ***URL.1, with the title: “***TITLE.1,” which was recorded as evidence by the AEPD. The news article contains “(…)”. In the video shown, the following details appear: embedded on the page, in the post on the ***PLATFORM.1, the name “***PROFILE.1” “@PROFILE.1” “11:38 ***DATE.2.” If you click the play button, you can watch the video in which, inside (…), a young man appears talking to an older person, and you can hear the young man ask, (…) and the older person respond: (…). The same video also appears on the pages of ***PLATFORM.1, ***URL.2, in the post by “El Español,” “@elespanolcom,” “1:22 p.m. ***DATE.5 14.7K views,” and on ***PLATFORM.2 of the same newspaper, ***URL.3, dated ***DATE.1, with 59 likes and 122 comments. In the latter, the name “***PROFILE.1” “@PROFILE.1” is not visible, and it is reported (…) that the news item was not flagged, as evidenced by the AEPD. On ***DATE.1, the AEPD obtained a post on ***PLATFORM.1 from the “***PROFILE.1” profile at 11:38 on ***DATE.2 with the text “(…)…” and images from a video in which, inside (…), a young man is seen talking to an elderly person, (…) and responding to the older person: (…). Through the ***PLATFORM.1 profile “@PROFILE.1,” with a post published on ***DATE.2 at 11:38 a.m., the aforementioned video can be seen, with 2.3 million views, serving as evidence of the aforem

Indicators of Compromise

• url — https://www.aepd.es/documento/ps-00304-2024.pdf

Entities