Spain fines minor for creating and distributing AI-generated sexual images
Spain's data protection agency fined a minor 2,000 euros (reduced to 1,200 euros) for creating and sharing AI-generated sexual images of twenty minor classmates using their real faces. The September 2023 incident in Almendralejo resulted in the first European regulatory penalty of its kind under GDPR for this type of synthetic media abuse.
What happened
In September 2023, a group of minors in Almendralejo, Extremadura created and distributed AI-generated sexual images of twenty minor classmates using real faces.
Spain's data protection agency opened an investigation in September 2023 after the case was reported in Spanish media and received a formal complaint on October 2, 2023 from one of the victims regarding the distribution of false nude images created with artificial intelligence.
The agency concluded that the offender breached EU data protection law by using the faces of real minors in the AI-generated images and distributing them.
Reported impact
Twenty minor girls were depicted in non-consensual sexually explicit synthetic images created using AI tools.
The incident prompted criminal convictions of the minors involved for twenty counts of child sexual abuse material offences and offences against moral integrity.
Index analysis
The data protection agency determined that an image of a person that identifies or makes them identifiable constitutes personal data under GDPR, and distribution of such manipulated images violated data protection regulations.
Governance controls
The minors responsible were criminally convicted and sentenced to one year of supervised release and mandatory educational measures including training on responsible technology use, affective-sexual education, and awareness of equality and gender issues.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.