In procedure PS/00313/2021, the Spanish Data Protection Agency (AEPD) has imposed a fine of €3,000 on a company specialized in recording soccer matches for capturing images of minors without prior consent from their parents.
On April 9, 2021, the claimant filed a complaint to the Spanish Data Protection Agency against a company that records soccer matches with a drone, after having recorded his minor daughter playing a soccer match. The claimant states that the images were taken without consent and without informing the tutors of the affected parties.
However, the defendant company pointed out that there was an e-mail where they tried to explain to the claimant that their activity was in accordance with the regulations. As indicated in all its points, they had been hired for the development of a recording service approved by the majority of the parents of the team.
Therefore, they processed the data on the basis of legitimacy in the performance of a contract, not on the basis of obtaining parental consent.
Initiation of the sanctioning procedure
In response, the Spanish Data Protection Agency agreed to initiate a sanctioning procedure against the defendant company for the alleged infringement of Article 6.1 of the RGPD, typified in Article 83.5.a) of the RGPD and classified by the LOPDGDD in its Article 72.1.a), for statute of limitations purposes, as a very serious infringement.
The alleged infringing conduct attributed to the defendant is based on the processing of data of minors without legitimacy. These are federated players belonging to the children’s 7-a-side soccer category. The company was in charge of the recording through drone technology and the subsequent visualization of the images. In this case, without having the consent for its treatment or any other authorization that legitimizes it.
It should be noted that the consent given for the capture of images must be a specific consent. That is to say, a consent given in general terms without determining the specific purpose is not valid.
Thus, the documentation in the file showed that the respondent violated Article 6.1 of the GDPR. The complainant had not assigned his rights since he had not granted any authorization for his daughter to be recorded.
Furthermore, the processing of data in the recording of competitive matches in which the claimant’s daughter participates lacked legitimacy. Given the circumstances and context in which the recording took place, his right to privacy was considered to prevail.
As a result of the above, the recording company was sanctioned for recording a soccer match involving minors. The AEPD recognized the violation of article 6.1 of the RGPD, typified in article 83.5.a) of the RGPD.
The penalty was €3,000.
Leave a ReplyWant to join the discussion?
Feel free to contribute!