[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUS6rkJM3wfrvOTFAgaAgZdXWkaIYbfJKajmbTHNic_A":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":15,"status":19,"created_at":20,"published_at":21,"article":22,"tags":26,"podcasts":39,"controls":40},"2978d04a-f46c-4bcf-aacf-9b49630f4e8a","unlawful-publication-of-intimate-images-leads-to-6000-gdpr-fine-in-spain","28a73d1e-f447-4ef8-a52f-3002b40e3614","Unlawful Publication of Intimate Images Leads to €6,000 GDPR Fine in Spain","A controller deliberately created fake profiles and published intimate images of a data subject across 89 websites without any valid legal basis, constituting a serious violation of GDPR Article 6. This case illustrates that intentional misuse of personal data — not just negligence — falls squarely within GDPR enforcement scope, and regulators will act even on individual bad actors. The widespread distribution across dozens of platforms amplified the harm and the difficulty of remediation for the victim. Organizations and individuals alike must understand that publishing personal or sensitive data without lawful basis carries significant legal and reputational consequences.","**Immediate actions:**\n- Remove unlawfully published content from all identified platforms as swiftly as possible and document takedown requests.\n- Report the incident to the relevant supervisory authority (e.g., AEPD) and cooperate fully to demonstrate accountability.\n\n**Long-term improvements:**\n- Establish and enforce a clear data-sharing and publication policy that requires explicit verification of lawful basis before any personal data is made public.\n- Train all staff and individuals with data access on the legal requirements for processing personal data, including consent and legitimate interest rules under GDPR.\n\n**Detection & Response measures:**\n- Implement periodic monitoring or automated alerts for unauthorized publication of personal data associated with your organization.\n- Create a formal complaints-handling procedure so data subjects can quickly flag misuse and receive a timely, documented response.",[12,13,14],"GDPR Article 6","GDPR Article 5","NIST SP 800-53 PT-2: Authority to Process Personally Identifiable Information",{"GDPR Article 5":16,"GDPR Article 6":17,"NIST SP 800-53 PT-2: Authority to Process Personally Identifiable Information":18},"Article 5's principles of lawfulness, fairness, and data minimisation were violated when personal intimate data was processed deliberately for harmful purposes with no legitimate aim.","The controller published intimate images with no valid lawful basis, which is precisely what Article 6 prohibits by requiring a legal ground for every processing activity.","PT-2 requires organizations to establish and document legal authority before processing PII, which would have prohibited this publication without a valid legal basis.","published","2026-11-11T12:22:20.282849+00:00","2026-11-11T12:22:20.258+00:00",{"id":7,"url":23,"slug":24,"title":25},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00377\u002F2025&diff=53683&oldid=53670","aepd-spain-ps-00377-2025-e42b2e","AEPD (Spain) - PS\u002F00377\u002F2025",[27,33],{"id":28,"name":29,"slug":30,"description":31,"color":32},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":34,"name":35,"slug":36,"description":37,"color":38},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]