The Spanish Data Protection Agency (AEPD) has imposed the first sanction in Spain for the creation and dissemination of false images generated through artificial intelligence (AI). The parents of a minor were fined 2,000 euros, which can be reduced to 1,200 euros if paid promptly. This case marks a significant precedent in the protection of minors’ data within Europe.
What Has Happened?
A minor utilized the ClothOff app to create a fake image featuring a naked classmate. This particular AI tool merges the victim’s face with an unclothed body, skillfully considering physical characteristics like complexion and skin tone. The resulting image was subsequently shared across various social media platforms and messaging groups.
The Origin of the Case
While the public resolution does not explicitly identify the involved parties, the AEPD has revealed that this incident occurred in Almendralejo, Badajoz, in September 2023. Reports indicate that at least 20 minors had been victims of similar manipulations that circulated among the town’s youth. Some images even found their way onto adult sites like OnlyFans, as documented in the resolution.
Why Is This Important?
This incident represents the first occasion a data protection authority in the European Union has sanctioned the dissemination of a deepfake. The AEPD quickly acted, opening an investigation just two days after the case gained public attention on September 20, 2023. Through collaboration with the Prosecutor’s Office, they identified the responsible parties, reinforcing the notion that an individual’s image constitutes personal data deserving special protection, especially for minors.
The Debate on the Sanction
The financial penalty has sparked considerable debate. Jorge García Herrero, a lawyer and data protection officer, stated to El País that “very few risks related to AI cause as much social alarm as the creation of non-consensual sexual deepfakes of minors,” while questioning if the sanction is significant enough. Contrastingly, jurist Borja Adsuara opined that this situation is “a crime against privacy, which merits criminal proceedings,” thus questioning the rationale behind an administrative fine when the matter is already judicially addressed.
A Parallel Path
This administrative action by the AEPD runs parallel to ongoing criminal proceedings against the minors responsible for these actions, who were between 12 and 14 years old at the time. Judicial results have already mandated a year of supervised release for 15 minors involved in the manipulation of classmates’ images. Miriam Al Adib, mother of one of the victims, asserted that the judicial sentence served as an important precedent, as it requires the minors to complete a training program.
What Lies Ahead?
The AEPD is anticipated to reveal additional fines stemming from the Almendralejo events in the upcoming months, as there were at least two dozen victims impacted. The current resolution absolves the creators of ClothOff from liability, a controversial app designed to generate images of naked women without consent, which is presently inactive. The app’s creators are facing legal proceedings in the United States. Al Adib warns that such cases reveal “a pandemic of tremendous violence,” necessitating coordinated political strategies and effective protection protocols for victims.
Cover image | Swello