Spain

Private individual

500 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-05-26.

Rank · Sector

#262

of 361 in Individuals and Private Associations

Rank · Spain

#996

of 1,104

Rank · All fines

#3,034

of 3,197

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-05-26
Controller / Processor: Private individual
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 500 on a private individual. A complaint was launched against a YouTuber who in a video criticising a court's decision not to approve a gender identity change for another person used a photo of the data subject with a caption and an arrow pointing at them. The AEPD obtained the relevant IP address from Google Ireland and used it to identify the person in question. The data subject had also filed a police report on 29 January 2023. By March 2026 the video was still online.

Open original source Links to the regulator's original publication or another source.