In recent months, Spain has imposed substantial new restrictions on video surveillance and other types of videotaping of individuals without their consent. These developments underscore important differences between U.S. and Spanish privacy law.

Spain’s approach to video surveillance is illustrated by a recent enforcement action, in which Spain’s Data Protection Authority (the “AEPD”) fined a 20-year-old for posting a video on YouTube without the consent of the individual shown in the video.[1] This case received significant media attention, as the video showed a group of teenagers harassing a disabled person, and led to public outrage over the mistreatment of the victim. The AEPD investigated the incident and determined that the videotaping violated Spain’s Data Protection Law (the “LOPD”) because the victim had not consented to being recorded. In a subsequent statement, the AEPD explained that the LOPD generally requires a person or entity making a video recording to obtain the consent of each person who can be identified in the video recording: “The collection of images of a person, as long as [the images] allow the identification of that person, is regulated by [the LOPD] and requires the consent of the person involved.”[2] This consent obligation applies even if the individual is videotaped in a public location, as discussed below.

Please see full update for more information.