Spain: AEPD fines Joly Digital €20,000 for data processing without consent
On August 18, 2023, the Spanish data protection authority (AEPD) published its decision in Proceeding No. PS/00489/2022, in which it imposed a fine of €20,000, on Joly Digital S.L.U. for violation of the General Data Protection Regulation (GDPR), following an individual's complaint.
Background to the decision
The AEPD noted that it received a complaint that a journalist had published a personal photo belonging to the complainant on a web page belonging to Joy Digital, without the complainant's consent. According to the complainant, the photo was originally posted on their private Instagram account, and the journalist was not among the complainant's approved followers.
Findings of the AEPD
The AEPD noted that the complainant's act of posting their photo on Instagram does not equate to granting consent to third parties to use the photo freely. As such the AEPD held that Joy Digital had violated Article 6(1) of the GDPR by publishing the image of the complainant without their prior and express consent.
In conclusion, the AEPD imposed a fine of €20,000 on Joly Digital for violation of Article 6(1) of the GDPR.
You can read the decision, only available in Spanish, here.