AEPD (Spain) - EXP202204806

AEPD - AI-00173-2022
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(b) GDPR Article 5(1)(c) GDPR
Type:	Complaint
Outcome:	Rejected
Started:	06.12.2021
Decided:
Published:	21.06.2022
Fine:	n/a
Parties:	n/a
National Case Number/Name:	AI-00173-2022
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	MW

The Spanish DPA held that the use of a doorbell camera did not constitute processing of neighbors' personal data, but it cautioned that the device must be used like a traditional peephole and not as video surveillance.

English Summary

Facts

The data subject complained to the Spanish DPA that a neighbor in their building had installed a doorbell camera that captured part of a common area. They did not know what their neighbor did with the recorded images but worried their 16-year-old daughter and another neighbor's 10-year-old grandson being recorded on the way to lay out or hang laundry on the landing.

The owner of the camera claimed to have installed it in response to their door being vandalized, and the complaint itself acknowledged that the door had suffered various scratches.

Holding

The DPA held that there was no data processing in the facts presented and that intervention would only be necessary if improper use of the recordings infringed on data privacy rights. The DPA analogized the doorbell camera to a traditional front door peephole, noting that such peepholes are not generally seen as invasive. Because there was no expectation of privacy in the common area immediately outside a neighbor’s front door, a doorbell camera was a reasonable and proportional step to deter further vandalism.

The DPA recommended that the neighbors resolve their disagreements according to “the minimum rules of good neighborliness” or else settle them in an appropriate judicial framework.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                             1/5

     File No.: EXP202204806



                   RESOLUTION OF FILE OF ACTIONS

Of the actions carried out by the Spanish Agency for Data Protection and te-
based on the following


                                       FACTS

FIRST: A.A.A. (*hereinafter, the complaining party) dated December 6,
2021 filed a claim with the Spanish Data Protection Agency. the re-

outcry is directed against B.B.B. with NIF ***NIF.1 (hereinafter, the claimed party).
The grounds on which the claim is based are as follows:

       “…you have installed a peephole of the make and model: EZVIZ DP1C. We have
evidence that he uses it to record and know which neighbors go up to the landing or to
hang clothes on the roof”


       “The neighbor across the street has a 10-year-old grandson and I have a 16-year-old daughter.
who goes up to lay out or pick up the clothes. We don't know what exactly he does with the
recorded images” (folio nº 1).


SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, of Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), said claim was transferred to the claimed party in fe-
date 12/16/21, to proceed with its analysis and inform this Agency on the
period of one month, of the actions carried out to adapt to the foreseen requirements

cough in the data protection regulations.

No response has been received to this transfer letter, nor has any explanation been provided.
duced for this purpose, recording in the system the Notification as "finished" in the di-
direction indicated by the claimant.


THIRD: On February 18, 2022, in accordance with article 65 of the
LOPDGDD, the claim filed by the claimant was admitted for processing.

                           FOUNDATIONS OF LAW


                                            Yo

In accordance with the functions that article 57.1 a), f) and h) of the Regulation (EU)
2016/679 (General Data Protection Regulation, hereinafter RGPD) confers
each control authority and according to the provisions of articles 47 and 48.1 of the Or-

Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD), is competent to resolve these
investigative actions the Director of the Spanish Agency for the Protection of Data
cough.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 2/5









Likewise, article 63.2 of the LOPDGDD determines that: "The formal procedures
ted by the Spanish Agency for Data Protection will be governed by the provisions of

Regulation (EU) 2016/679, in this organic law, by the regulatory provisions
dictated in its development and, as long as they do not contradict them, with a sub-
sidiario, by the general rules on administrative procedures."

                                            II


In the present case, the claim dated 12/06/21 is examined by me-
gave from which the following is transferred as the main fact:

       “…a peephole of the make and model has been installed: EZVIZ DP1C. We have
evidence that he uses it to record and know which neighbors go up to the landing or to

hanging clothes on the roof” (folio nº 1).

       The facts are therefore concretized in the presence of a digital peephole that
According to the claimant's statement, it is used "to record and know who is close to
his door according to comments from the defendant himself.


The above facts may constitute a presumed infringement of art. 5.1
c) RGPD, which provides: “Personal data will be:

       c) adequate, pertinent and limited to what is necessary in relation to the purposes
for which they are processed (“data minimization”) (…)”.


       It should be noted that the device (digital peephole) is installed on the door pro-
property of the defendant and not in a common area, which is why it differs from other cases analysed.
two by this Agency in which a camera is installed on a communal wall capturing
extensive landing area.


       Currently there are various types of digital peepholes on the market, which
are easily purchased by consumers and users on various platforms
online sale, and can be considered "devices with lenses equipped with a camera
exterior that allows to see towards the outside of the house with an angle of vision”.


       Their operation is varied, with multiple possibilities depending on the
model and brand, sometimes allowing an image to be transmitted to a mobile device.
vile (eg in case of someone knocking at the door), without any image recording (only
visualization in real time, like any other traditional peephole) or it allows
have a frame in case of programming when approaching the door of the apartment

of the owner of the same, serving as a security device against
attacks on property (vgr. Crime of robbery with force—articles 238 and ss CP).

       The use of the installed devices must be carried out in accordance with the purpose of
the same, which is to replace the traditional peepholes, for reasons of

safety/comfort of the property, not being able to act as camera
video-surveillance, affecting the rest of the residents of the property.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 3/5








       In various pronouncements, this body has stated its opposition to
acts of vandalism carried out furtively, in such a way that an interpretation
restrictive regulation of the norm may suppose a double damage to the victim of the same

mos, not being able to protect themselves from these.

       As the Constitutional Court has pointed out (vgr. STC 39/2016, March 3, 2016)
it suffices to remember that in order to verify whether a restrictive measure of a fundamental right
mental exceeds the judgment of proportionality, it is necessary to verify if it meets the three
following requirements or conditions: if such a measure is likely to achieve the objective

proposed vo (judgment of suitability); if, in addition, it is necessary, in the sense that it does not
There is another more moderate measure to achieve such purpose with equal effectiveness.
cia (judgment of necessity); and, finally, if it is weighted or balanced, by de-
derive from it more benefits or advantages for the general interest than harm on
other assets or values in conflict (judgment of proportionality in the strict sense).


       In the written claim itself it is made clear that the door of the
claimed (a) has "suffered various scratches" and this type of device can meet
a dissuasive function against the aforementioned vandalism attacks that sometimes
they occur in communities of owners, where it is not uncommon for various
llas between neighbors (as) for the most varied reasons.


       This type of images can be made available to the competent authority.
either judicial or State Security Forces and Bodies, in order to con-
establish the authorship of the facts, for an alleged crime of damage to property
(vgr. art. 263 CP).


       Respect for the alleged affectation of the privacy of third parties (eg their granddaughters)
It should be noted that the landing area near the door of the requested party is not a
intended for privacy, being able to develop the recreational activities of the same
in private or public areas (eg nearby parks), without otherwise stating

that a "data treatment" of the same has been carried out.

In this regard, the ruling (...), dated April 22, is especially illuminating.
of 2015 of the Criminal Court No. 1 of Vigo includes in its Foundation of Law
First: (…)


       “There is an abundant and peaceful jurisprudence that, when dealing with the recordings
videos, considers that these only affect the right to privacy if they have
been carried out in what constitutes the dwelling or spaces where the citizen develops
develops their private activity but that said attack does not occur if the recording is made
takes place in open spaces or common areas of a building, as is the case that we

occupies having recorded images in a garage that is a common area (...)

       It cannot be understood that a garage of a community of owners exists
a privacy such that it prevents making recordings, taking into account that it is a
common space, as well as the access stairs to community homes,

foreign to all privacy, understood from the point of view of personal intimacy
constitutionally protectable, as it is an area of access to interested persons.
community, and, therefore, public, in the sense of allowing access to di-
this zone of all the members of the community, circumstance is relevant to the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 4/5








time to apply the existing jurisprudence on this issue, in which the 2nd Chamber of the
T.S. has been affirming that the recording of the image of people in open spaces
to the public does not require judicial authorization, being regulated the use of

the same in the Organic Law 4/1997, of August 4, regulating the use of
video cameras by the Security Forces and Bodies in public places (In this
sense STS of 18-3-2005, 27-9-2002 and 15-2/1999 among others). The STS of 10-14-2002
affirms the legitimacy of recording the image of people, without implying
a violation of the right to privacy or to one's own image when it says that the
rights established by the L.O. 5-5-82 regulating the Civil Protection of Law

to Honor, to Personal and Family Intimacy and to One's Own Image, cannot be considered
be absolutely limitless."

       In general, with this type of peepholes a "treatment of
data" because its function is exactly identical to traditional peepholes, being able to

owner of the same to know the entrances/exits of the neighbors close to the
same way that I knew him with a traditional peephole, being on the other hand personal.
companies that coexist in a wide space of time for reasons of co-ownership in
based on rules of behavior determined in the Horizontal Property Law
(Law 49/1960, July 21).



                                           III

According to the above, the question raised is not considered to be at the time

current supposes an affectation to the rights protected by this organism, whose in-
Intervention will only occur in the event of a deviation in the alleged use of
the same (vgr. data obtained with the device in question), this aspect that does not

has been accredited, the above reasons that justify the filing of this
process.

       The rest of the issues would, where appropriate, be accommodated in the civil framework,

recommended by this Agency that the parties adapt their behavior to the minimum re-
rules of good neighborliness or by resolving them in the appropriate judicial instances.
prickly pears


Thus, in accordance with what was indicated, by the Director of the Spanish Agency for Pro-
data protection,

HE REMEMBERS:


FIRST: PROCEED TO FILE these proceedings.

SECOND: NOTIFY this resolution to A.A.A. and B.B.B.

In accordance with the provisions of article 50 of the LOPDGDD, this Re-

The solution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 5/5









Common to Public Administrations, and in accordance with the provisions of the
art. 112 and 123 of the aforementioned Law 39/2015, of October 1, interested parties may inter-

optionally file an appeal for reconsideration before the Director of the Spanish Agency
Data Protection Regulation within a month from the day following the
notification of this resolution or directly contentious-administrative appeal before

the Contentious-administrative Chamber of the National High Court, in accordance with the provisions
placed in article 25 and in section 5 of the fourth additional provision of the Law
29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, in the
period of two months from the day following the notification of this act,

in accordance with the provisions of article 46.1 of the aforementioned Law.


                                                                                     940-110422
Sea Spain Marti

Director of the Spanish Data Protection Agency














































C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es