The Spanish data protection authority ('AEPD') issued, on 11 January 2022, its resolution in Proceeding No. PS/00119/2021, in which it imposed a fine of €6,000 to Educando Juntos SL, for violations of Articles 6 and 17 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') regarding its failure to respond to a deletion request submitted by the claimant and unlawfully processing personal data without consent, following an individual's complaint.

Background to the case

In particular, the AEPD highlighted that an employee had filed a complaint against Educando Juntos due to the unlawful use of a photograph of them for the use of its website, as well as for its social media presence, without obtaining prior consent from the data subject. Moreover, the AEPD outlined that the complainant had requested Educando Juntos on several occasions to remove their photos, but the request had been ignored by the company.

Findings of the AEPD

Following its investigations, the AEPD found that Educando Juntos has used employee photoes without consent and failed to comply with a subsequent deletion request.

Outcomes

In light of the above, the AEPD noted that it imposed a penalty of €6,000 on Educando Juntos for publishing on its websites and social networks the photographs of its workers without having a legitimate basis for it pursuant to Article 6 of the GDPR. In addition, the AEPD further imposed a fine of  €3,000 on Educando Juntos for not attending to the right of deletion requested by the complainant pursuant to Article 17 of the GDPR. Therefore, the AEPD deemed appropriate to impose on Educando Juntos a cumulative penalty of €9,000, for the aforementioned violations of the GDPR.

You can read the decision, only available in Spanish, here.