[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUvF7MdpCFNlaO0Yg8TUAcqObGADESUI-hPWAA5f9Hq0":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"28a73d1e-f447-4ef8-a52f-3002b40e3614","AEPD (Spain) - PS\u002F00377\u002F2025","aepd-spain-ps-00377-2025-e42b2e","← Older revision Revision as of 11:15, 11 November 2026 (One intermediate revision by the same user not shown) Line 80: Line 80: }} }} The DPA imposed a fine of €6,000 on the controller for publishing on numerous websites naked images of the data subject without a valid legal basis in accordance with [[Article 6 GDPR]]. The DPA imposed a fine of €6,000 on a controller for unlawfully publishing naked images of a data subject on numerous websites without a valid legal basis in accordance with [[Article 6 GDPR]]. == English Summary == == English Summary ==","Spain's AEPD has fined a controller €6,000 for unlawfully publishing naked images of a data subject on numerous websites without a valid legal basis under Article 6 GDPR. The data subject filed a complaint after the controller created fake profiles and published the images, which were found on 89 websites. The fine was reduced by 40% due to the controller opting for voluntary payment and acknowledging liability.","Spain's AEPD fines controller €6,000 for unlawfully publishing naked images online.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00377\u002F2025&diff=53683&oldid=53670","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-11-11T11:15:49+00:00","2026-11-11T12:00:42.785267+00:00",7,[17],{"name":18,"type":19},"AEPD","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":22,"name":23,"slug":24},null,"Privacy Fines","privacy-fines",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18],{"controls":44,"vendors":45},[],[],{"slug":47,"title":48,"body":49,"framework_refs":50,"framework_notes":54},"unlawful-publication-of-intimate-images-leads-to-6000-gdpr-fine-in-spain","Unlawful Publication of Intimate Images Leads to €6,000 GDPR Fine in Spain","A controller deliberately created fake profiles and published intimate images of a data subject across 89 websites without any valid legal basis, constituting a serious violation of GDPR Article 6. This case illustrates that intentional misuse of personal data — not just negligence — falls squarely within GDPR enforcement scope, and regulators will act even on individual bad actors. The widespread distribution across dozens of platforms amplified the harm and the difficulty of remediation for the victim. Organizations and individuals alike must understand that publishing personal or sensitive data without lawful basis carries significant legal and reputational consequences.",[51,52,53],"GDPR Article 6","GDPR Article 5","NIST SP 800-53 PT-2: Authority to Process Personally Identifiable Information",{"GDPR Article 5":55,"GDPR Article 6":56,"NIST SP 800-53 PT-2: Authority to Process Personally Identifiable Information":57},"Article 5's principles of lawfulness, fairness, and data minimisation were violated when personal intimate data was processed deliberately for harmful purposes with no legitimate aim.","The controller published intimate images with no valid lawful basis, which is precisely what Article 6 prohibits by requiring a legal ground for every processing activity.","PT-2 requires organizations to establish and document legal authority before processing PII, which would have prohibited this publication without a valid legal basis."]