AEPD (Spain) - PS/00356/2021

AEPD (Spain) - PS/00356/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	14.01.2022
Fine:	1,500 EUR
Parties:	n/a
National Case Number/Name:	PS/00356/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Cesar Manso-Sayao

The Spanish DPA issued a €1,500 fine to an individual property owner for a violation of Article 5(1)(c) GDPR by placing security cameras in a position which also captured the private area of a neighbour's house.

English Summary

Facts

A data subject filed a claim with the Spanish DPA (AEPD) in which they state that their neighbour has installed security cameras which are facing their home and are an unjustified infringement on their privacy. The AEPD received no response or clarification regarding the cameras from the defendant.

The AEPD requested Security Forces and Corps to carry out an inspection on the neighbour's property, which confirmed that there cameras facing outwards with a notice sign stating the name of the company which installed the cameras, but did not specify who was responsible for the processing of the data collected.

Holding

The AEPD stated that security cameras must not be positioned in a way that they record adjacent public spaces or the private areas of others. The AEPD held that since the entrance to the claimant's house (as well as part of the public street adjacent to it) appeared to be within the scope of the security cameras, it could be presumed that it was collecting the claimant's personal data. According to the AEPD, this constitutes a violation of Article 5(1)(c) GDPR because it negatively affected the rights of the claimant without a justified cause.

Additionally, the AEPD held that if a security camera is directed at any space outside of private property, the camera must have a notice sign which complies with GDPR, stating the exact area being recorded, and who is responsible for the processing.

Consequently, the AEPD issued a €1,500 fine to the owner of the security camera for violating Article 5(1)(c) GDPR, and also ordered the owner of the cameras to provide proof within one month of the lawfulness of the contents of the captured recordings (including screenshots with time stamps), as well as proof that they have placed a GDPR compliant notice sign (including a specification of the area recorded and who is responsible for the processing).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                 1/6











     File No.: PS/00356/2021

                RESOLUTION OF PUNISHMENT PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on

to the following

                                       FACTS

FIRST: Mrs. A.A.A. (*hereinafter, the complaining party) dated April 20,

2021 filed a claim with the Spanish Data Protection Agency. The
claim is directed against B.B.B. with NIF ***NIF.1 (hereinafter, the part
claimed). The reasons on which the claim is based are succinctly:
following:


       “presence of cameras installed by the neighbor close to his home” considered
considering that it could affect their personal and/or family privacy without just cause (for
mess no. 1).

       Together with the claim, it provides documentary evidence (Annex I) that confirms the

presence of several cameras installed on the facade of the neighbor's property denounced
ciated, and they may be misdirected without just cause.

SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, of Protection of Personal Data and guarantee of digital rights (in

hereinafter LOPDGDD), said claim was transferred to the claimed party in fe-
cha 05/05/21 and 05/28/21, to proceed to its analysis and inform this Agency
within a month, of the actions carried out to adapt to the requirements
provided for in the data protection regulations.


No response has been received to this letter, nor has any clarification been made on
installed cameras.

THIRD: On July 6, 2021, the Director of the Spanish Agency for Pro-
Data protection agreed to admit for processing the claim presented by the claimant party.

keep.

FOURTH: On September 1, 2021, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure against the claimed party,
for the alleged infringement of Article 5.1.c) of the RGPD, typified in Article 83.5 of the

GDPR.

FIFTH: On 10/18/21, the careful collaboration of the Forces and Bodies is required.
of Security so that those displaced to the place of the facts verify the facts
object of claim, providing documentary evidence to that effect.





C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 2/6








SIXTH: On 11/07/21, a visual inspection of the home was carried out, verifying the
presence of four security cameras installed for security reasons of the
same.


        “the dwelling in question is contiguous to the claimant's plot (plot 66)
and are divided by a concrete block wall with a difference in level between
these, being above the required plot (plot 65)

        "You can see a sign on the front fence of the house in which it gives

notice of the existence of alarm and video-surveillance cameras belonging to the
Securitas Direct Company

        Complaints filed, consulted the SIGO System of the Civil Guard,
There are eight facts in which criminal complaints appear, from A.A.A. against

claimed.

        Photographs are attached (Annex I) for the analysis of the facts object of
claim.

In view of everything that has been done, by the Spanish Data Protection Agency

In this proceeding, the following are considered proven facts:

        First. The facts bring cause of the claim dated 04/20/21 by me-
from which “the presence of a system of video-surveillance cameras
that could affect their personal/family privacy and public space without just cause.

fied”.

        Second. The Security Forces and Bodies displaced to the place of the
Many confirm that the main person responsible is Doña B.B.B..


        Third. In the Civil Guard Report of 11/18/21, it is confirmed by the force acting
that the installation company is Securitas Direct, having a valid contract with the
same, confirming the owner the viewing with the cameras (front and rear).

        Bedroom. No contract has been provided to the acting force, having made it
sent an email, to clarify the legality of the system.


        Fifth. The installed sign only specifies the installation company, not being a
poster homologated to the regulations in force, the person responsible for the treatment is not confirmed.
ment, being located for informative purposes to the outside, of what is
deduces the area to capture.


                            FOUNDATIONS OF LAW

                                             I


By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and according to the provisions of articles 47 and 48 of the LOPDGDD, the Director
of the Spanish Agency for Data Protection is competent to initiate and to re-
solve this procedure.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 3/6








                                              II

Before going into the substance of the matter, it should be noted that in the Agreement to Start the Fe-

cha 09/01/21 was informed that in case of not making any allegation to the Agreement
of Initiation, the same “may be considered as a Resolution proposal” in the terms
Article 64 letter f) Law 39/2015 (October 1).

        “f) Indication of the right to make allegations and to be heard in the proceeding.
procedure and the deadlines for its exercise, as well as an indication that, in the event of

make allegations within the stipulated period on the content of the initiation agreement,
this may be considered a resolution proposal when it contains a pronouncement
precise statement about the imputed responsibility.

In the present case, the claim dated 04/20/21 is examined by me-

from which the main fact is transferred as the "presence of cameras installed
by the neighbor next to her home” considering that it could affect her privacy
personal and/or family without just cause.

The facts denounced suppose an affectation to the content of art. 5.1 c) GDPR
(regulations currently in force) that provides: “personal data will be:


        c) adequate, pertinent and limited to what is necessary in relation to the purposes
for which they are processed (“data minimization”) (…)”.

Individuals are responsible for the installed video-surveillance systems to be

comply with current legislation, and must be able to prove such extremes.
We report to the competent authority.

Cameras installed by individuals must be oriented towards their private space.
vative avoiding the capture of private area of third parties without just cause.


In no case will the use of surveillance practices be admitted beyond the objective environment.
of the installation and in particular, not being able to affect the surrounding public spaces.
contiguous buildings and vehicles other than those accessing the guarded space.

        Likewise, in the case of false cameras, they must be oriented

to a private area, avoiding intimidation of neighboring neighbors who are unaware
know whether or not they process personal data.

                                             III


In accordance with the evidence available in this proceeding
sanctioning party, it is considered that the claimed party has a video system
Surveillance that affects the rights of third parties without just cause.

        The respondent has not clarified the area that is captured with the cameras in

question, remembering that an impact on a transit area (not exclusively
private) entails the duty to inform by means of an informative poster adapted to the current
regulations, not being the same obligatory in case of affectation to zone
exclusively exclusive to it.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 4/6









        The documentary evidence (Annex I) confirms that the cameras
close to the adjoining dwelling can capture its private space, as well as

that the front camera captures space close to the adjacent road, being surrounded
the house with a mesh that allows capturing the outside area of the access door to
the House.

        The known facts constitute an infraction, attributable to the party
claimed based on the proven facts of the content of article 5.1 c) RGPD,

above-mentioned.

                                             IV

Article 83.5 RGPD provides the following:


“The infractions of the following dispositions will be sanctioned, in accordance with the
section 2, with administrative fines of a maximum of EUR 20,000,000 or, treating-
of a company, of an amount equivalent to a maximum of 4% of the volume of
Total annual global business of the previous financial year, opting for the one with the highest
amount:


        a) the basic principles for the treatment, including the conditions for the
            consent under articles 5, 6, 7 and 9;

When motivating the sanction, the following is taken into account:


        -the nature of the infraction by having a video-surveillance system that
is oriented towards a third-party private area without just cause, trying to presumably
mind data of identifiable natural persons (art. 83.2 a) RGPD).


        -the intentionality or negligence of the infringement, (art. 83.2 b) RGPD), since
with the video-surveillance system, it performs an excessive control of the area outside the property.
mercy without any justified cause, highlighting the bad orientation of the installation
of the device(s), which is affecting an excessive area around your property.

        -any other aggravating factor (art. 83.2 k) RGPD), by not collaborating with the

Civil Guard, which after contacting the affected party requests a copy of the installation contract.
lation, without having contributed or taken any measure to prove the law.
quality of the denounced system.

For all this, a sanction is agreed in the amount of €1,500 (one thousand five hundred

euros), by having a camera system that records excessively private areas of
third parties, sanction located in the lower scale of this type of infractions and according to the
nature of the events described.

It must be provided in accordance with art. 58.2 d) RGPD screen printing (fe-

date and time) of what in your case is captured with the camera (s) installed in order of their
analysis by this Agency, as well as characteristics of the device(s) installed, without prejudice
pact of the allegations that it deems necessary to make or, where appropriate, provide evidence
withdrawal of the same from the areas described.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 5/6









Therefore, in accordance with the applicable legislation and after assessing the graduation criteria
tion of the sanctions whose existence has been proven,


the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: IMPOSE B.B.B., with NIF ***NIF.1, for an infraction of Article 5.1.c)
of the RGPD, typified in Article 83.5 of the RGPD, a fine of €1,500 (one thousand five hundred
euros).


SECOND: ORDER the respondent to proceed within ONE MONTH from
of the notification of this resolution to adopt the following measures,
in accordance with article 58.2 d) RGPD:


        -Prove the legality of the system, providing a screen print/s (date and
time) that proves what is captured in your case with them.

        -Certify that you have a poster homologated to the current regulations, indicating
where appropriate, the person responsible for the treatment or delimit the area that is the object of capture.
tion with the cameras.


THIRD: NOTIFY this resolution to B.B.B. and REPORT the result
of the proceedings to the complaining party.

FOURTH: Warn the sanctioned party that he must make the imposed sanction effective once

Once this resolution is enforceable, in accordance with the provisions of the
art. 98.1.b) of Law 39/2015, of October 1, of the Administrative Procedure Co-
of the Public Administrations (hereinafter LPACAP), within the term of payment
voluntary established in art. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,

of December 17, through its entry, indicating the NIF of the sanctioned and the number
of procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Agency
Department of Data Protection at the banking entity CAIXABANK, S.A.. In case of
Otherwise, it will be collected during the executive period.


Received the notification and once executed, if the date of execution is
between the 1st and 15th of each month, both inclusive, the term to make the payment
will be until the 20th day of the following month or immediately after, and if
is between the 16th and last day of each month, both inclusive, the term of the payment
It will be valid until the 5th of the second following month or immediately after.


In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the

LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
resents may optionally file an appeal for reconsideration before the Director
of the Spanish Agency for Data Protection within a month from the date of
the day following the notification of this resolution or directly contentious appeal

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 6/6









before the Contentious-Administrative Chamber of the National High Court,
in accordance with the provisions of article 25 and section 5 of the additional provision
Final fourth of Law 29/1998, of July 13, regulating the Contentious Jurisdiction-
administrative, within a period of two months from the day following the notification

tion of this act, as provided for in article 46.1 of the aforementioned Law.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the firm resolution in administrative proceedings if the interested party

do states its intention to file a contentious-administrative appeal. If it is-
In this case, the interested party must formally communicate this fact in writing
addressed to the Spanish Agency for Data Protection, presenting it through the Re-
Electronic registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or to

through any of the other registers provided for in art. 16.4 of the aforementioned Law
39/2015, of October 1. You must also transfer to the Agency the documentation
that proves the effective filing of the contentious-administrative appeal. If the
Agency was not aware of the filing of the contentious-administrative appeal

tive within two months from the day following the notification of this
resolution, would end the precautionary suspension.


                                                                                      938-26102021
Sea Spain Marti

Director of the Spanish Data Protection Agency



































C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es