[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-S4bU7bi7XIyLs7XQ72nt07e-xcCuJWQStuH2tSSnac":3},{"article":4,"iocs":44,"watch_terms":49,"solutions":50,"lesson":82},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"cea5574a-e563-4ce1-a17f-725d7d8eb1c1","AEPD (Spain) - PS-00304-2024","aepd-spain-ps-00304-2024-c3c3e3","Fixed link ← Older revision Revision as of 07:35, 16 September 2026 Line 13: Line 13: |Original_Source_Name_1=AEPD |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00304-2024.pdf |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00304-2024.pdf |Original_Source_Language_1=Spanish; Castilian |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Language__Code_1=ES","Spain's Data Protection Agency (AEPD) has fined the digital newspaper 'El Español' €20,000 for publishing an article that included an identifiable video of an assault victim and a minor assailant. The agency found this to be a violation of the data minimization principle under GDPR, as the identification of the individuals was unnecessary for reporting the incident. The newspaper argued freedom of information, but the AEPD stated that while freedom of expression and data protection must be reconciled, technical measures like blurring faces could have been used to prevent identification.","Spain's AEPD fines El Español €20,000 for publishing identifiable video of assault victim and minor assailant.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00304-2024&diff=53072&oldid=52507","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-09-16T07:35:31+00:00","2026-09-16T08:00:14.726099+00:00",7,[17,20],{"name":18,"type":19},"El León de El Español Publicaciones, S.A.","vendor",{"name":21,"type":22},"El Español","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[45],{"type":46,"value":47,"context":48},"url","https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00304-2024.pdf","Original source link for the AEPD decision",[18,21],{"controls":51,"vendors":81},[52],{"slug":53,"name":54,"problem":55,"products":56},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",[],{"slug":83,"title":84,"body":85,"framework_refs":86,"framework_notes":95},"spanish-newspaper-fined-20000-for-failing-to-anonymize-assault-video-under-gdpr-1789546927841","Spanish Newspaper Fined €20,000 for Failing to Anonymize Assault Video Under GDPR","El Español published a video identifying both an assault victim and a minor assailant without applying available anonymization techniques such as face blurring, violating GDPR's data minimization principle. The core failure was an editorial and procedural one: staff lacked clear policies or training on when and how to anonymize personal data before publication. This case demonstrates that freedom of expression does not override data protection obligations, and that technical safeguards must be integrated into content workflows. The €20,000 fine underscores that media organizations are not exempt from GDPR compliance and face real financial consequences for avoidable oversights.",[87,88,89,90,91,92,93,94],"GDPR Article 5(1)(c) – Data Minimisation Principle","GDPR Article 85 – Processing and Freedom of Expression","GDPR Article 37 – Designation of Data Protection Officer","NIST SP 800-53 PL-4 – Rules of Behavior","NIST SP 800-53 AT-2 – Literacy Training and Awareness","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 29101 – Privacy Architecture Framework",{}]