AEPD has imposed a €6,000 fine on Real Club Nautico de Ribadeo, for breach of Article 6(1)(f) of the GDPR. The case was initiated by a complaint filed by an individual. It concerned the publication on the club’s website and Facebook funpage of links to two court judgments containing the personal data of the complainant and other data subjects in relation to a civil litigation concerning club management issues.
The AEPD requested information from the controller on the case, after which the club removed the said links and informed the supervisory authority. The administrator argued that the publication of the said links was based on the legitimate interest of public information about acts committed against the club. The news of the court proceedings was also reported by some local newspapers, in which the identity of the complainant was explicitly mentioned.
The complaint concerned two opposing rights, namely the right to protection of personal data and the right to freedom of information. The AEPD carried out a test of the balance of interests and took into account, inter alia, that the complainant did not hold a public office, that the proceedings in question were a civil case and not a criminal case, and that the details of the civil court proceedings were only relevant to the members of the club, without any public significance.
In view of the above, the AEPD considered that the processing of personal data in the situation under consideration could not be based on the legitimate interests of the club and thus violated Article 6(1)(f) of the GDPR.