On June 26, 2008, the Spanish Data Protection Authority (DPA) undertook an enforcement action against private citizens for violation of the Spanish Data Protection Act. The individuals against whom the action was taken had posted webcams on the streets in their neighborhood in order to film alleged prostitutes negotiating and arguing with clients.

The individuals apparently had complained of the conduct for some time, to no avail, and had hoped that posting the videos taken by the webcams on YouTube would bring about a stop to prostitution in the neighborhood. Specifically, they aimed to embarrass male clients and their wives into respectively ceasing or demand cessation of prostitute visits.

Instead, however, the Spanish DPA examined whether the videos violated the privacy rights of those individuals appearing in them. Ultimately, the Spanish DPA determined that they did, holding that the videos violated Article 6 of the Spanish Data Protection law because the images within were personal data which was not obtained consensually.

While the violation was punishable by a fine of up to 300,506 Euros (US$470,982), the Spanish DPA imposed a fine of only 601 Euros (US$942) because there was an effort to obscure the faces of many in the videos, no one was harmed, and the video was posted with the intent to improve public safety.

Although the fine levied against the individuals involved in making and posting the videos at issue is relatively small, the precedent established by this action is significant.

This action makes it quite clear that the Spanish DPA intends to enforce the Spanish data protection law against individuals. Perhaps more importantly, it also indicates that the disclosure of personal data regarding another individual without that individual’s consent is indeed actionable in Spain, a fact that has wide-reaching implications for Internet communications.