The Spanish Data Protection Agency (AEPD) has fined the creator and spreader of artificial images of naked bodies 2,000 euros, reduced to 1,200 in case of timely payment. Although it does not explicitly mention it, the resolution refers to at least one of the fake teenage nudes that circulated in Almendralejo, Badajoz, in September 2023. The technique used to make the montage, known as deepfakeconsists of embedding the victim’s face with an artificial intelligence (AI) tool into the image of another naked person. It is the first time that a fine has been imposed in Spain for disseminating images of an individual altered by artificial intelligence.
Although the resolution has been public since October 27, the details of the case are confidential and, therefore, no details are provided on the nature of those affected. The text does not clarify the sex of the victim. Nor is it specified that he is a minor, even if this is clear from the fact that, in some points of the resolution, reference is made to regulations that have to do with minors. For all this, and taking into account the times that usually elapse between the moment in which the AEPD decides to open a case and the moment in which it resolves it, sources consulted by this newspaper say that the dates would coincide with the scandal of the diffusion of false nude images created with artificial intelligence of at least 20 girls from Almendralejo, Badajoz, which emerged in September 2023. Precisely because in that case there were at least two dozen victims, Data Protection is expected to publish other fines in the near future. similar.
After the publication of this information, the AEPD released a statement confirming that the fine refers to a case that occurred in September 2023 in Almendralejo.
On the first day of classes of the 2023-2024 academic year, in the municipality of Badajoz of 30,000 inhabitants, photos of several naked girls began to circulate on cell phones. They were montages: the ClothOff application had been used to superimpose their faces onto images of the bodies of other undressed girls. Those deepfake They spread rapidly through social networks and were uploaded “on portals such as Only Fans and various pornographic pages”, reads the resolution.
The Data Protection sanction punishes the unauthorized dissemination of personal data, such as photographs, of interested parties. Specifically, it is underlined that the processing of the personal data of a third party was unlawful, in this case the image of one of the girls. This is a parallel proceeding to the criminal one, a proceeding that has already been activated for the dissemination of pornographic content of minors and which has imposed one year of probation on 15 minors for having manipulated images of girls.
The AEPD is the first sanctioning measure issued by a data protection authority in the European Union for the dissemination of a deepfake. According to some experts, the amount of the fine (2,000 euros, reducible to 1,200) is very low, taking into account the extent of the damage. In some previous measures of the Agency, in which the publication of personal data by natural persons was sanctioned, fines of up to 60,000 euros had been imposed.
“Very few risks related to artificial intelligence cause as much social alarm as its creation deepfake non-consensual sexual relations with minors. I’m not saying that imposing a fine of one million euros in this case would solve the problem, but some might think that an exemplary and warning fine is the least that can be asked for at this time”, says Jorge García Herrero, lawyer and data protection delegate.
Borja Adsuara, a lawyer specializing in technology, believes it is inappropriate for the AEPD to deal with this case. “This is a crime against privacy, which goes through criminal proceedings and has already been convicted. What does an administrative sanction add? If the legal basis is the lack of consent, and not the fact that a gruesome image has been created and disseminated, the specter opens up to anyone who disseminates personal data of others without their consent. They would not be able to cope,” he underlines.
“I had already resolved the matter more than with a criminal case. There was an exemplary sentence according to which the children are on probation for a year and must follow a training course. The most important thing for us is that the name and surname of child pornography were attributed to the crime,” says Miriam Al Adib, gynecologist and mother of one of the teenagers involved in the murder case. deepfake sexual relations of Almendralejo. “It was a very dignified sentence. What we wanted was for justice to be done and for the victims and their families to receive dignity. This has already happened through criminal justice,” he adds.
Two years of legal career
According to the document, the then director of the AEPD, Mar España, decided to start preliminary investigation actions on September 20, 2023, two days after EL PAÍS revealed the case. On October 2, a private individual presented the complaint to the AEPD that led to the fine.
“It should be remembered (…) that people have the power to dispose of their personal data, including their image, as well as their dissemination, which, without a doubt, means that the person whose personal data is collected and disseminated in violation of the legal system, is deserving of protection,” reads the resolution.
The AEPD sanctioning proceedings were opened against the minor who distributed the photographs, as stated in the resolution, despite the fact that his parents, in their capacity as legal representatives, were notified. The letter also says that his father or mother paid the fine of 1,200 euros in April.
The application used to carry out the editing (ClothOff), as well as the platforms with which it was distributed, are exempted from liability in the AEPD resolution.
