AEPD (Spain) - PS-00304-2024
Spain's AEPD fined newspaper €20,000 for publishing identifiable video of assault victim and minor without
Spain's Data Protection Authority (AEPD) fined El Español newspaper €20,000 for violating Article 5(1)(c) GDPR (data minimisation principle) by publishing an identifiable video of an assault victim and minor assailant without applying anonymization techniques. The DPA found that while reporting on the incident was newsworthy, disclosing identifiable images and voices was unnecessary and disproportionate; the newspaper could have achieved its journalistic purpose using face-blurring or audio alteration. The authority rejected the newspaper's defenses of newsworthiness, prior virality, and freedom of information, clarifying that these rights must be balanced against data protection on a case-by-case basis.
AI summary of the linked source. Not reviewed by an editor. How this works
Run El Español?
Get an email when a new story names El Español, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonEl Español newspaper published an identifiable video of an assault victim and a minor without applying basic anonymization techniques such as face-blurring or audio alteration, violating GDPR's data minimisation principle (Article 5(1)(c)). The core failure was not the act of reporting itself, but the disproportionate disclosure of personal data when less privacy-invasive alternatives were readily available. Spain's AEPD rejected arguments around newsworthiness and prior virality, affirming that freedom of information does not override data protection obligations without a case-by-case proportionality assessment. This case highlights that media organizations are data controllers subject to GDPR and must embed privacy-by-design thinking into editorial and publishing workflows.