Case Summary and Outcome

In January 2021, the Constitutional Court of Ecuador held that the storage and sharing of sexual photos without the consent of the victim were a violation of her constitutional rights to personal data protection, reputation, and intimacy. The victim pursued a habeas data action against the defendant, who had found the pictures in a family-shared computer, saved them in flash memory, and sent them to the parents of the victim. The Court reasoned those intimate images were personal data sent exclusively to the defendant’s partner and required previous consent to be processed by anyone else. When the defendant saved the photos and shared them with other people, she inflicted damage and violated human rights grounded on dignity and informational self-determination.

---

Facts

According to the plaintiff, on the 14^th and 15^th of August 2014, she received several phone calls and messages threatening her to resign from her job or sexual photos would be shared among family and colleagues. She did receive some intimate photos which, according to her, were taken a while ago but immediately deleted. The photos were also sent to her parents, who used to work in the same institution as she did. She claimed that she did not know how the defendant had access to the pictures because they were only stored on her phone and were deleted immediately after being taken. The dissemination of the photos affected her professional and personal relationships and resulted in her taking medicine to treat mental health difficulties.

The defendant admits that she had found the photos on the night of the 14^th of August in the “Images” folder of a computer that was shared with her husband. She admitted that had shared the photos with the plaintiff’s parents, but made assurances that she did not share them with anyone else and that she only made one copy on a flash drive for presenting to the court.

In August of 2014, the plaintiff filed a Habeas Data action asking for information on how the defendant took possession of the photos, to whom they were sent, and for them to be deleted immediately. The First Instance Civil Court granted the protection, ruling the deletion of the photos and mandating that the defendant deliver a signed affidavit stating that she did not have any more copies of the photos and would not use them again. However, the Court denied the comprehensive reparation, so the plaintiff appealed the ruling. The Family Appellate Court reversed the whole decision and considered that the plaintiff was the one who willingly sent the pictures to a third party, so no personal right was violated. Therefore, the habeas data could not proceed.

The plaintiff filed an extraordinary protection action against the appellate court’s ruling which was brought to the Constitutional Court of Ecuador.

---

Decision Overview

Judge Carmen Corral Ponce delivered the judgment for the Constitutional Court. The main issue before the Court was whether the defendant violated the victim’s constitutional rights of data protection, honor, and reputation by saving and sharing sexual photos without her consent.

The plaintiff argued that she did not know how the defendant had access to the intimate photos and that her intimacy was violated when they left her phone. She pointed out that the pictures were highly sexual and thus should be strictly protected. Without her previous consent, the photos were shared with people – including her parents – all of which damaged her reputation and personal image. For all this, she sought the deletion of the pictures and comprehensive reparation for the damages.

Conversely, while the defendant admitted that she did have access to the pictures, she countered that no previous consent was necessary. The defendant claimed that the plaintiff voluntarily sent the photos to her husband using WhatsApp and that these were automatically downloaded to a home-shared computer. Furthermore, she states that the pictures were copied in only one flash memory and shared only with the plaintiff’s parents which represented “personal and domestic use”. Therefore, the copy and share actions are excluded from the previous consent rule according to personal data regulations. In conclusion, the defendant contended that no privacy right was violated and the extraordinary protection action should be dismissed.

The Ecuadorian Constitution enshrined personal data protection as a fundamental human right and the habeas data as the procedural mechanism to guarantee it. Furthermore, the Constitution recognizes the right to intimacy and honor alongside State obligations to prevent abusive or arbitrary violations to private life.

The Court framed the legal problem asking whether the defendant carried out unauthorized processing of the intimate photos and, in case she did, if that processing violated constitutional rights to data protection, image, reputation, and intimacy. As this is a Constitutional Court, the analysis was limited to the constitutional rights and the habeas data protection, leaving other legal issues, such as the threats issued to compel resignation, to the criminal and/or civil courts.

For the first issue, the Court considered whether the pictures constituted personal data. According to the evidence, the photos were all located in the same folder of ‘WhatsApp Images’ and under the same name with different numbering. Even though her face was not seen in all the pictures, the plaintiff was recognizable in them. The Court held that “Without much effort, it [was] easy to see that they belong to the same person and that this person [was] clearly the plaintiff, since her face [was] seen in some photographs” [para. 149]. For this reason, the Court concluded that the images constituted personal data with constitutional protection by virtue of the habeas data process.

The Court then considered whether the defendant did process the pictures. The defendant admitted that she had opened the pictures on the computer, then saved them on flash memory and shared them with the plaintiff’s parents. The Court found that these three different actions constituted “data processing” under the terms of the Ecuadorian Constitution and the General Data Protection Regulation of the European Union. The Court noted that, although Ecuador did not have a personal data protection law, the government had approved a Guide for Personal Data Processing in the Public Administration which followed the European privacy model [para. 83].

Considering the defendant’s argument that she obtained the pictures through WhatsApp on her husband’s computer, and therefore no consent was needed, the Court analyzed the reasonable expectation of privacy when using instant messaging applications. In this sense, the Court distinguished three different types of virtual spaces: public, private, and hybrids (semi-private or semi-public), each of them allowing a different degree of interference from private third parties or the government [para. 115].

According to the Court, user’s expectations varied depending on the type of app they were using (open or closed), the number of recipients (one-to-one or group messages), the type of information shared (public or confidential), and the legal or contractual obligations between participants of the conversation. The Court concluded that the plaintiff had a reasonable expectation to keep her photos away from third parties because of the medium employed (one-to-one messages) and the content (sexual pictures that were of no public interest).

For this reason, the Court considered that previous consent was one of the main safeguards for guaranteeing data protection rights. The fact that she voluntarily sent the pictures to someone, did not automatically grant authorization to any kind of use by the recipient, let alone by a third party. According to the Court, the previous consent rule was required for any kind of processing beyond personal use and did not consider family relationships or linkages with the recipients of the information. “When the owner of the information [was] the one who freely and voluntarily share[d] their data, in principle, the only thing that [was] clear [was] that the mere access to the data (observation) ha[d] been authorized, by the person to whom it was sent or with whom it was shared, (…), exclusively in the electronic medium to which it was sent” [para. 169]. The defendant had the burden to demonstrate that she had the previous authorization from the plaintiff to process the photos, which she did not. Therefore, the Court concluded that the processing was unauthorized.

Following the second question on whether the processing violated constitutional rights, the Court distinguished the four different claims: data protection, honor, personal image, and intimacy.

Regarding personal data protection, the Court recognized the autonomy of this right which was separate from the rest. Even though the Constitutional Court had tied this right to other values, such as honor and reputation, in previous rulings, now it was considered an independent and enforceable right by itself grounded on the informational self-determination of the person. According to the analysis of the Court, in this case, there had been a violation of the right to personal data protection as the defendant processed personal data without the victim’s consent and beyond personal or domestic use.

The right to honor and good name is closely tied to individual dignity and self-esteem. The Court held that the victim’s honor was damaged when the photos were shared with her parents. There was a strong causality between that exhibition and the reputation and esteem damages. “Being an adult woman, mother of a family and head of a household, it [was] evident that the act of disclosing to her parents, probably one of the most intimate spheres of her person, involve[d] a degree of offense serious enough to undermine the essential core of the right to honor” [para. 200].

The right to personal image seeks to protect one’s power to decide whether to make public or not the physical characteristics of oneself. This right includes not only images that clearly depicted the person but also those in which the individual is recognizable. Following its reasoning about previous consent and the content’s sensibility, the Court concluded that there had been damage to the plaintiff’s personal image.

Regarding the intimacy right, the Court outlined the high sensitivity of the photos. Sexual activities and decisions were among the most intimate decisions and they, therefore, carried stronger protection. There was a clear violation of the plaintiff’s intimacy, and the defendant had no legitimate purpose to share the photos with the plaintiff’s parents.

In conclusion, the Constitutional Court found that there had been an unauthorized processing of the plaintiff’s personal data. The defendant stored and shared the pictures without the consent of the data owner. This processing inflicted damage to the plaintiff’s constitutional rights to data protection, honor, image, and intimacy. Accordingly, the Court ordered the defendant to provide an affidavit stating that she would delete the copies of the images and not use them again for any purpose. Considering the highly sensitive nature of the content disclosed in the legal process, the Court deleted from the files and rulings any personal references to the parties.

---