[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flgqmbaxhTBgPBE9iMk2dsVBiyArXps5OXo_uW7JNLqA":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"8a87a137-7a0d-498b-a027-4eceb20550f4","AEPD (Spain) - PS-00304-2024","aepd-spain-ps-00304-2024-a61a92","Created page with \"{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color= |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS-00304-2024 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00304-2024.pdf |Original_Source_Language_1=Spanish; Castilian |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type...\" Show changes","Spain's Data Protection Authority (AEPD) fined El Español newspaper €20,000 for violating Article 5(1)(c) GDPR (data minimisation principle) by publishing an identifiable video of an assault victim and minor assailant without applying anonymization techniques. The DPA found that while reporting on the incident was newsworthy, disclosing identifiable images and voices was unnecessary and disproportionate; the newspaper could have achieved its journalistic purpose using face-blurring or audio alteration. The authority rejected the newspaper's defenses of newsworthiness, prior virality, and freedom of information, clarifying that these rights must be balanced against data protection on a case-by-case basis.","Spain's AEPD fined newspaper €20,000 for publishing identifiable video of assault victim and minor without","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00304-2024&diff=52507&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-07-27T14:59:48+00:00","2026-07-27T16:00:20.259758+00:00",7,[17,20],{"name":18,"type":19},"El Español","vendor",{"name":21,"type":19},"AEPD","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":22,"icon":24,"name":25,"slug":26},null,"GDPR","gdpr",[28,33,38],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":39},{"id":40,"icon":24,"name":41,"slug":42},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18,21],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":62},"spanish-newspaper-fined-20000-for-failing-to-anonymize-assault-video-under-gdpr","Spanish Newspaper Fined €20,000 for Failing to Anonymize Assault Video Under GDPR","El Español newspaper published an identifiable video of an assault victim and a minor without applying basic anonymization techniques such as face-blurring or audio alteration, violating GDPR's data minimisation principle (Article 5(1)(c)). The core failure was not the act of reporting itself, but the disproportionate disclosure of personal data when less privacy-invasive alternatives were readily available. Spain's AEPD rejected arguments around newsworthiness and prior virality, affirming that freedom of information does not override data protection obligations without a case-by-case proportionality assessment. This case highlights that media organizations are data controllers subject to GDPR and must embed privacy-by-design thinking into editorial and publishing workflows.",[53,54,55,56,57,58,59,60,61],"GDPR Article 5(1)(c) — Data Minimisation Principle","GDPR Article 9 — Processing of Special Categories of Personal Data","GDPR Article 25 — Data Protection by Design and by Default","GDPR Article 85 — Processing and Freedom of Expression (journalistic exemption balancing)","NIST Privacy Framework PR.DP-P4 — Data processing is limited to identified purposes","NIST SP 800-53 SI-12 — Information Management and Retention","CIS Control 3 — Data Protection (data classification and handling)","ISO\u002FIEC 27001 Annex A.8.2 — Information Classification","ITIL Service Design — Privacy and Data Handling Policies",{}]