Spain

Cultural association

3,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2021-03-15.

Rank · Sector

#97

of 351 in Individuals and Private Associations

Rank · Spain

#607

of 1,075

Rank · All fines

#2,027

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2021-03-15
Controller / Processor: Cultural association
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 (1) a) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA (AEPD) imposed a fine of EUR 3,000 on a cultural association. The controller had published pictures of a four-year-old child on various groups of the Chinese messenger service WeChat without the consent of the child's parents. The photos show the child taking part in the controller's Chinese lessons. Although the controller tried to obscure the child's face using a digital sticker, it was still partially visible. Also the controller did not respond to the parents' request to delete the photos and apologize to them.

Open original source Links to the regulator's original publication or another source.