9 August 2022
Spanish Government buries head in sand over beach body advert error
An advertising campaign has used images of five women representing a diverse range of women, with the aim to encourage women to go to the beach. However, three British women have come forward to say they haven’t consented to their images being used. [1]
The Spanish Government authority said that the contract with a third-party illustrator should not have included personal data; however, on receiving the artwork for approval, it is surprising that the images used were not queried. The Spanish Government authority is processing these women’s images even if it wasn’t aware of it, so is required to comply with the EU General Data Protection Regulations.
‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly,[2]
The women who have identified themselves from the image have said they should have been contacted for consent, but consent is just one lawful basis that may be applicable here. It is important to get the legal basis correct at the start of any processing.[3]
The women who have complained, have the right to have their objection lodged with the Spanish supervisory authority (equivalent to the UK Information Commissioners Office). As data subjects the women also have a right to claim compensation if they have suffered damage because of any potential breach of data protection law. This includes both material damage, or non-material damage, for example distress. [4]
The Spanish Government’s Equality Ministry is currently passing the responsibility for any potential issues to their third-party illustrator but whomever is at fault, this situation is important not only from a data protection perspective but in relation to wider rights and respect for women and people with disabilities. The lesson here is to always ensure your contracts include reference to the need to comply with data protection and copyright law, and ideally conduct due diligence to ensure any selected supplier has the skills and knowledge to do so.
The images appear to have been obtained from social media, which highlights that once you publish an image there is no guarantee that your image might not be reused lawfully or otherwise.
If you need any support with data protection including reviewing of data processor agreements, due diligence checks or help obtaining consent or using another legal basis – we can help. Please contact us to find out more about our support services.
[1] Spanish beach body ad: Women ‘not buying’ government’s explanation – BBC News
[2] Art. 4 GDPR
[3] Art. 6 GDPR