AEPD (Spain) - PS/00377/2025
Spain's AEPD fines controller €6,000 for unlawfully publishing naked images online.
Spain's AEPD has fined a controller €6,000 for unlawfully publishing naked images of a data subject on numerous websites without a valid legal basis under Article 6 GDPR. The data subject filed a complaint after the controller created fake profiles and published the images, which were found on 89 websites. The fine was reduced by 40% due to the controller opting for voluntary payment and acknowledging liability.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA controller deliberately created fake profiles and published intimate images of a data subject across 89 websites without any valid legal basis, constituting a serious violation of GDPR Article 6. This case illustrates that intentional misuse of personal data — not just negligence — falls squarely within GDPR enforcement scope, and regulators will act even on individual bad actors. The widespread distribution across dozens of platforms amplified the harm and the difficulty of remediation for the victim. Organizations and individuals alike must understand that publishing personal or sensitive data without lawful basis carries significant legal and reputational consequences.