[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhb0OLzG87fgk7CKqOctx-T6YiZR39kjNhRR2vgmHoVA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":47,"controls":48},"276cf447-eb30-401d-a677-eefac808a44d","spanish-newspaper-fined-20000-for-failing-to-anonymize-assault-video-under-gdpr-1789546927841","cea5574a-e563-4ce1-a17f-725d7d8eb1c1","Spanish Newspaper Fined €20,000 for Failing to Anonymize Assault Video Under GDPR","El Español published a video identifying both an assault victim and a minor assailant without applying available anonymization techniques such as face blurring, violating GDPR's data minimization principle. The core failure was an editorial and procedural one: staff lacked clear policies or training on when and how to anonymize personal data before publication. This case demonstrates that freedom of expression does not override data protection obligations, and that technical safeguards must be integrated into content workflows. The €20,000 fine underscores that media organizations are not exempt from GDPR compliance and face real financial consequences for avoidable oversights.","**Immediate actions:**\n- Establish a mandatory pre-publication review checklist requiring editors to assess whether individuals in visual media can be identified and whether identification is strictly necessary.\n- Apply anonymization techniques (e.g., face blurring, voice distortion) to all media content involving victims, minors, or bystanders before publication.\n\n**Long-term improvements:**\n- Develop and enforce an organizational Data Protection Policy tailored to media workflows, including explicit guidance on data minimization for multimedia content.\n- Appoint or consult a Data Protection Officer (DPO) to review editorial standards and ensure ongoing GDPR compliance across all published content.\n- Integrate GDPR training specific to media and journalism contexts into annual staff onboarding and continuing education programs.\n\n**Detection & Accountability measures:**\n- Implement a post-publication audit process to periodically review content for compliance with data minimization and anonymization standards.\n- Create a clear internal escalation path for editorial staff to flag legally sensitive content before it goes live.",[12,13,14,15,16,17,18,19],"GDPR Article 5(1)(c) – Data Minimisation Principle","GDPR Article 85 – Processing and Freedom of Expression","GDPR Article 37 – Designation of Data Protection Officer","NIST SP 800-53 PL-4 – Rules of Behavior","NIST SP 800-53 AT-2 – Literacy Training and Awareness","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 29101 – Privacy Architecture Framework",{},"published","2026-09-16T08:22:08.129013+00:00","2026-09-16T08:22:07.651+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00304-2024&diff=53072&oldid=52507","aepd-spain-ps-00304-2024-c3c3e3","AEPD (Spain) - PS-00304-2024",[29,35,41],{"id":30,"name":31,"slug":32,"description":33,"color":34},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[49],{"slug":50,"name":51,"problem":52},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]