AEPD (Spain) - EXP202206776

AEPD - PS-00420-2022
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:
Type:	Complaint
Outcome:	Rejected
Started:	13.06.2022
Decided:
Published:	01.09.2023
Fine:	n/a
Parties:	n/a
National Case Number/Name:	PS-00420-2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	isabela_maria_rosal

The Spanish DPA dismissed a complaint about the use of surveillance camera in public spaces. The equipment was never put into use, so there was no processing of personal data.

English Summary

Facts

A data subject made a complaint against the installation and use of cameras in a private property facing public spaces and other private spaces. There was no sign informing about the existence of the surveillance camera. The controller informed that even though the camera was real, it was not functioning. Even though the Spanish DPA did not request it, the controller also sent evidence proving the online return of the camera.

Holding

The Spanish DPA held that there was no breach of the data protection rules since there was no processing of personal data. Even though the camera was real, it was never functional.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/6










File No.: EXP202206776



                RESOLUTION OF SANCTIONING PROCEDURE

From the procedure instructed by the Spanish Data Protection Agency and based
to the following


                                   BACKGROUND

FIRST: On 06/13/2022, a document submitted to this Agency was entered
by A.A.A. (hereinafter, the complaining party), through which the claim is made

vs. B.B.B. with NIF ***NIF.1 (hereinafter, the claimed part), for the installation of
a video surveillance system located in ***ADDRESS.1, there being indications of a
possible non-compliance with the provisions of the data protection regulations of
personal character.

The reasons underlying the claim are the following:


“1º This Chamber is located on the façade of a property that is not property of the
person who installed it.

2º It lacks all types of plates informing that said camera exists.


3º The location of said camera covers all recording of public roads and entrances to
the homes included in that section, as well as the owners' vehicles.

(…)”


Attach a photograph of the location of the video surveillance camera and the area
affected by this.

SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in

hereinafter LOPDGDD), on 06/14/2022 said claim was transferred to the party
claimed, so that it could proceed with its analysis and inform this Agency within the period
of one month, of the actions carried out to adapt to the planned requirements
in data protection regulations.


The transfer, which was carried out in accordance with the rules established in Law 39/2015, of
October 1, of the Common Administrative Procedure of Administrations
Public (hereinafter, LPACAP), was collected on 06/20/2022 as stated in the
acknowledgment of receipt that appears in the file. To date, it has not been received
response to this transfer letter.


THIRD: On 08/09/2022, in accordance with article 65 of the LOPDGDD,
The claim presented by the complaining party was admitted for processing.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/6








FOURTH: On 10/24/2022, the Director of the Spanish Protection Agency
of Data agreed to initiate sanctioning proceedings against the claimed party, in accordance with
the provisions of articles 63 and 64 of LPACAP, for the alleged violations of the

articles 5.1.c) and 13 of the RGPD, typified in article 83.5 of the RGPD.

This agreement was notified in accordance with the rules established in the LPACAP
by postal notification, it was delivered to the claimed party on 11/07/2022.

FIFTH: On 11/16/2022, the claimed party presented a written document, on time and

form, before this Agency in which he stated the following:

“[…]

FOURTH.- That the security camera is not my property, nor is it located

Located on my facade, it belongs to my father who asked me to install it in his
façade for their own safety and interests (written supporting contribution).

FIFTH.- That the camera is known to me that it is not in operation, and will not be placed
in operation while it does not meet the requirements set by the protection regulations
of data.


[…]”

Along with the written allegations, it provides, among others, the following documentation:


    - Copy of the document, dated 01/01/2019, by virtue of which C.C.C. authorizes
       the claimed party to “carry out any management, work or procedure that is necessary
       for maintenance, repair or anything else he deems appropriate
       for the interests of my assets.”


SIXTH: On 01/19/2023, the investigating body of the procedure agreed to
opening of a trial period, considering the claim incorporated
filed by the complaining party and its documentation, as well as the allegations to the
initiation agreement PS/00430/2022 presented by the claimed party and the
documentation that accompanies them.


Likewise, the investigating body required the claimed party to provide a photograph,
invoice, purchase receipt or any other document that proves non-operation
of the chamber in question, or, failing that, provide a responsible declaration signed in
which states, under its responsibility, that the camera is not in
functioning/has been removed.


SEVENTH: On 03/03/2023, this Agency receives a letter from the party
claimed in which it indicates the withdrawal of the device in question. Attach proof
return to the selling company.


EIGHTH: On 06/15/2023, the investigative body of the sanctioning procedure
formulated a proposed resolution, in which it proposes that the Director of the Agency
Spanish Data Protection Agency orders the file due to lack of operation


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/6








of the camera object of the claim and, consequently, the sign is not necessary
informative of video-surveillance area as there is no pure data processing.


This proposed resolution that was notified to the claimed party in accordance with the
standards established in the LPACAP, was delivered on 06/22/2023, as
It appears in the acknowledgment of receipt that is in the file. To date, there has been no
received any allegation from the claimed party.

In view of everything that has been done, by the Spanish Data Protection Agency

In this procedure, the following are considered proven facts:


                                PROVEN FACTS

FIRST: In the claim of 06/13/2022 the installation of

a white video surveillance camera on the façade of the property, located in
***ADDRESS.1, oriented towards public roads and the entrance to third party homes
people. In addition, it does not have the mandatory video surveillance area information sign.

These two extremes are proven with the photograph provided by the party.
claimant.


SECOND: On 11/16/2022, the claimed party uses security reasons for its
father for installing the camera, which is real, but which is not in
functioning.


THIRD: On 03/03/2023 the claimed party communicates the withdrawal of the device and
provides a screenshot of his profile in the Amazon app, which warns that,
Within the “My orders” section, the return of a camera is included.
white video surveillance. Specifically, the following is observed: “2022. Return
completed. Your return has been completed. Your refund has been processed.”



                           FOUNDATIONS OF LAW

                                           Yo
                          Competition and applicable regulations


In accordance with the powers that article 58.2 of the RGPD grants to each authority of
control and in accordance with the provisions of articles 47, 48.1, 64.2 and 68.1 of the LOPDGDD,
The Director of the Agency is competent to initiate and resolve this procedure.
Spanish Data Protection.


Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in its development and, insofar as they do not contradict them, with a

subsidiary, by the general rules on administrative procedures."

                                           II
                            The image is personal data
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/6









The physical image of a person, in accordance with article 4.1 of the GDPR, is data
personnel and their protection, therefore, is the subject of said Regulation. In article 4.2

The GDPR defines the concept of “processing” of personal data.

Images generated by a camera or video camera system are data from
personal nature, so its treatment is subject to protection regulations
of data.


                                            III
                                 Data minimization

Article 5.1.c) of the RGPD states the following:


"1. The personal data will be:

       (…)

    c) adequate, relevant and limited to what is necessary in relation to the purposes for
        those that are processed (“data minimization”)”


Regarding processing for video surveillance purposes, article 22 of the LOPDGDD
establishes that natural or legal persons, public or private, may carry out
carry out image processing through camera or video camera systems
with the purpose of preserving the safety of people and property, as well as their

facilities. However, only the capture of images of public roads is allowed.
to the extent that it is essential for the aforementioned purpose.

In no case will the use of surveillance practices beyond the environment be permitted.
object of the installation and, in particular, not being able to affect public spaces

surrounding areas, adjacent buildings and vehicles other than those that access the space
guarded

The installed cameras cannot obtain images of third party private space
and/or public space without duly accredited justified cause, nor can they affect
the privacy of passersby who move freely through the area.


                                            IV
                   Transparency of personal data processing

Article 5 of the GDPR “Principles regarding processing” indicates that:


"1. The personal data will be:

    a) treated in a lawful, fair and transparent manner in relation to the interested party
        (“legality, loyalty and transparency”)”.


This principle is developed in article 12 of the GDPR and, depending on whether the data
personal data are obtained from the interested party or not, the information that must be provided
It is listed in articles 13 or 14 of the GDPR.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/6









Regarding processing for video surveillance purposes, article 22.4 of the LOPDGDD
provides that:


“The duty of information provided for in article 12 of Regulation (EU) 2016/679 is
will be deemed fulfilled by placing an information device in place
sufficiently visible identifying, at least, the existence of the treatment, the
identity of the person responsible and the possibility of exercising the rights provided for in the
articles 15 to 22 of Regulation (EU) 2016/679. It may also be included in the

information device a connection code or internet address to this
information."

                                           V
                                 Allegations alleged


This Agency has no evidence that the claimed party has submitted a written
of allegations against the proposed resolution.

However, as already indicated in the proposed resolution, on 11/16/2022
receives a written statement of allegations regarding the agreement to initiate this procedure

sanctioning by the claimed party, in which it acknowledges having installed the camera in
the facade of his father's home, at his request, for security reasons.
However, although the device is real, it is not working.

As a result of the test requirement carried out by the instructing body, on 03/03/2023 the

claimed party communicated the withdrawal of the camera in question and, in addition, contributed
copy of the return receipt.

The camera that is the subject of the claim, being inoperative, has not captured any image
of an identified or identifiable natural person, so there is no data processing

of a personal nature. In this sense, the lack of said treatment causes the
obligation to report under article 13 of the GDPR; It is not necessary to place a sign
video surveillance area information.

Consequently, in light of the above, it is concluded that it has not been proven
at this moment of resolution that the facts object of transfer constitute a

administrative offense in the matter at hand.

This Agency wishes to remember that article 28.7 of LPACAP provides that: “The
Interested parties will be responsible for the veracity of the documents they present.”


Therefore, in accordance with the applicable legislation and evaluated the criteria of
graduation of sanctions whose existence has been proven,

the Director of the Spanish Data Protection Agency RESOLVES:


FIRST: ORDER the FILE of this sanctioning procedure against B.B.B.,
with NIF ***NIF.1, since the commission of the infractions of the
articles 5.1.c) and 13 of the RGPD due to the camera not having been in operation
object of claim.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/6









SECOND: NOTIFY this resolution to B.B.B..


In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which puts an end to the administrative procedure in accordance with article 48.6
of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Data Protection Agency within a period of one month to
count from the day following the notification of this resolution or directly

contentious-administrative appeal before the Contentious-administrative Chamber of the
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative Jurisdiction, within a period of two months from the

day following the notification of this act, as provided for in article 46.1 of the
referred Law.

Finally, it is noted that in accordance with the provisions of article 90.3 a) of the LPACAP,
The final resolution may be provisionally suspended administratively if the

interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Data Protection Agency, presenting it through
of the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronica-
web/], or through any of the other registries provided for in art. 16.4 of the

cited Law 39/2015, of October 1. You must also transfer to the Agency the
documentation that proves the effective filing of the contentious appeal
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the

notification of this resolution would terminate the precautionary suspension.


                                                                                938-010623
Sea Spain Martí
Director of the Spanish Data Protection Agency




















C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es