The GDPR requires that each Member State shall provide for one or more independent public authorities to be responsible for monitoring application of the Regulation. It therefore explicitly provides for the possibility of a Member State establishing several data protection authorities.
According to the GDPR, the competent supervisory authority regarding international transfers with respect to entities included within the scope of action of the Catalan Data Protection Authority is that Authority, since in Member States with more than one supervisory authority each of them should exercise all of the functions established in Article 57, including those provided in letter r) on international transfers.
The image is considered personal data and as a general rule the interested party’s consent is needed to publish (transfer) it, unless some other form of authorisation exists.
Consent of a parent or of the holder of parental responsibility must be obtained for the publication of photos of children under 14 (school or club websites and so on).
However, although each specific case must be assessed on its own merits, if images are collected in a public place for information purposes, consent of the people photographed is not necessary providing the image is shown in the informative context and does not affect or contribute to affecting the privacy of the person photographed.
If you do not agree to the publication on a social network of your photo or of a video in which you can be identified you may request that the manager of the network delete it, if certain circumstances exist. These include the images not being relevant or the existence of particular personal circumstances which result in your right to their deletion overriding that of their continued publication.
In the event of the image or video having been provided by a child below the age of 16 or by a third party while the child is a minor, the manager of the social network shall delete it without further requirement if the child concerned so requests on reaching the age of majority.
The fundamental right to the protection of personal data is not an absolute right and in certain circumstances clashes with other rights which are also fundamental and constitutionally recognised, such as the right to freedom of expression and the right to information. Freedom of expression includes the statement of an opinion. The right to information is understood to be the right any person has to give and receive information. Such information must be true, which implies that it must be corroborated, and must be handled with informative diligence, which allows error but not negligence. In cases where the information given is not true the owner of that information (data subject) can request rectification, which must be reflected in the communications media in which the information was published, and when the information is offensive or insulting the matter can be transferred to the courts of justice for consideration of the legal implications (such as defamation, violation of the right to honour and reputation, etc.).
It can be published providing a law exists that establishes the obligation to publish the document that contains such data. Nonetheless, only data that is adequate and strictly necessary for the purpose may be published, except where a legal obligation exists to publish the entire document.
Thus, only the name and surname of the data subject should be published, adding four random numbers of their passport or equivalent identity document.
In the case of publication being the consequence of an administrative notification via advertisements, the identification shall be made using solely the complete number of the passport or equivalent identity document.
In no circumstance may data comprising the name and surname together with the complete number of the passport or equivalent identity document be published.
This data may be published whenever the law decrees that the document containing this data must be published. However, only relevant personal data will be published, where it is strictly necessary for these purposes.
When the interested parties are identified, only the name and surnames of the interested party will be published, adding four random numerical numbers of their Spanish ID number, foreigner ID number (NIE), passport number or equivalent, in accordance with the guidelines established by this organisation.
If it is an administrative notification via advertising, identification must be only provided with the full Spanish ID number, foreigner ID number (NIE), passport number or equivalent.
In any case, your name and surnames cannot be published alongside your full Spanish ID number, foreigner ID number (NIE), passport number or equivalent.
For more information on this topic, please see Opinion CNS 4/2019 and Opinion CNS 5/2019.
As the owner of the published personal data you can exercise the right to object or to erasure against the controller that has made the information public, in other words, against the publisher that has disseminated your personal data.
You can also exercise the right to be forgotten in Internet searches against the search engine owners (Google, Bing, Yahoo, etc.). This right entitles you to request that links to your personal data do not appear in the results of Internet searches performed using your name as a search term.
This right may be exercised if the published information is inadequate, inaccurate, irrelevant, out of date or excessive, or has become so as a consequence of the time elapsed since publication. It may also be exercised if your personal circumstances mean that your right should override that of maintaining the link. However, the controller should in every case evaluate the relative significance of public interest in the information against your right to be forgotten in Internet searches and the time elapsed.
This right does not mean the information will be erased from the original source, but simply that it will not appear in the links resulting from searches performed employing the name of the person exercising the right.