AEPD (Spain) - PS/00446/2021

AEPD - PS/00446/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 13 GDPR Article 22(4) Law on the Protection of Personal Data and Guarantee of Personal Rights
Type:	Complaint
Outcome:	Rejected
Started:	20.05.2021
Decided:
Published:	06.10.2022
Fine:	n/a
Parties:	A.A.A B.B.B.
National Case Number/Name:	PS/00446/2021
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Mapez

The Spanish DPA found that private surveillance cameras that do not solely capture the controller’s property can be proportionate and compliant with Article 5(1)(c) GDPR. The controller must however inform the data subject through an information sign.

English Summary

Facts

On 20 May 2021, a Spanish natural person (the data subject), filed a complaint to the AEPD because of the video surveillance system installed by its neighbour (the controller). The surveillance system of the controller entailed a set of four cameras that, according to the data subject, covered part of the public road and went beyond what could be considered adequate for the surveillance of the property. Accordingly, this would constitute a breach of Article 5(1)(c) GDPR.

Holding

First, the AEPD recalled that, in accordance with Article 5(1)(c) GDPR, private surveillance cameras should be oriented towards private space, and not intimidate adjacent neighbours nor control the local transit without justification. Unless permitted by specific legal provisions, private individuals are not allowed to capture images of public space. In the case at hand, the AEPD found that the cameras used by the controller aimed at recording the controller’s property, within the limits of the legal data protection provisions. In its analysis, the AEPD held that the first camera used by the controller also captured the surroundings, which was done in proportionate manner and thus was not illegal. The second and third cameras captured a very small portion of the community yard. Finally, the fourth camera located on the controller’s rooftop did not capture direct images of the data subject’s property. The AEPD concluded that the images captured by the surveillance system were not disproportionate or excessive, and did not constitute of a breach of Article 5(1)(c) GDPR.

Second, the AEPD recalled that, compliant with Article 13(1) and (2) GDPR, and Article 22(4) of the Law on the Protection of Personal Data and Guarantee of Digital Rights (Ley Orgánica 3/2018 de Protección de Datos Personales y Garantía de los Derechos Digitales - LOPDGDD), the data controller should display a sufficient visible sign informing data subjects about the video surveillance of the area. In the case at hand, the AEPD held that the controller did not install a sign informing about the video surveillance system. Instead of a fine, the AEPD issued a reprimand on the controller.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/8










     File No.: PS/00446/2021



                RESOLUTION OF SANCTIONING PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following


FIRST: On 05/20/2021, he entered this Spanish Agency for
Data Protection a document presented by A.A.A. (hereinafter, the part
claimant), through which he makes a claim against B.B.B. with NIF ***NIF.1 (in
below, the claimed party), for the installation of a video surveillance system

installed at ***ADDRESS.1, there being indications of a possible breach of the
provided in the personal data protection regulations.

The reasons for the claim are the following:

“They have installed a camera in the front yard (1), another two cameras in the yard

rear (2 and 3) and another on the roof (4).

[…]

Camera 1 is not pointing at your front yard as you told me, but at your front gate.

entrance, and mostly to the public road where two
cars owned by him and steeled where pedestrians pass. camera 2
It mostly does target your backyard, but it also takes part of the front yard.
community, camera 3 is pointing directly at my balcony and my backyard… The
Camera 4 points towards your roof, but my roof is also displayed.


[…]

At night we observe that the cameras sometimes turn on some
red lights with which we think that they carry out controlled viewings from their
TV.


[…]”

Attached photographic report of the location of the cameras.


SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
forward LOPDGDD), transfer was made on 06/03/2021, 07/03/2021 and 08/09/2021
of said claim to the defendant, so that he could proceed with its analysis and inform the
this Agency within a month, of the actions carried out to adapt to

the requirements set forth in the data protection regulations. Not in this agency
There is no response from the claimed party.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/8








THIRD: On 09/07/2021, the Director of the Spanish Protection Agency
de Datos agreed to admit the claim presented by the claimant for processing.

FOURTH: On 11/24/2021, the Director of the Spanish Protection Agency
of Data agreed to initiate disciplinary proceedings against the claimed party, in accordance with

the provisions of articles 63 and 64 of Law 39/2015, of October 1, of
Common Administrative Procedure of Public Administrations (hereinafter,
LPACAP), for the alleged violation of article 5.1.c) of the GDPR and article 13 of the
GDPR, typified in Article 83.5 of the GDPR.

FIFTH: Once the aforementioned initiation agreement was notified, the claimed party submitted a written

allegations in which, in summary, he stated that:

“This party acknowledges having four cameras at his home (…).

The four cameras point to the interior of the home, serving the exclusive purpose of

domestic protection. Obviously, it is inevitable that, occasionally, in the
open spaces of the property focus a minimum space that exceeds the own
housing, however, this must be considered within the term "minimum strip of
access”, which is widely accepted as respectful of the protection of
data."


(…)

As for Chamber 1 (for me "entrance" chamber), it is in an elevated position
focusing, effectively, at the entrance. The public thoroughfare is focused merely
tangential and absolutely secondary, irrelevant within the image and as
part of the "minimum access range" (...).


Regarding Chamber 2 (“backyard”), in the attached image it can be verified that the
The camera focuses exclusively on the backyard (...).

With respect to Chamber 3 (“balcony”), it is clear that the well-deserved chamber
It only focuses on the balcony owned by this part, without invading at any time

the claimant's home (...).

In relation to Chamber 4 (“rooftop”), the claimant states that it “points towards its
roof, but my roof is also visualized”. From the outset, the claimant is
acknowledging that the camera placement does not focus on your roof. Also, there are
take into account that the balcony wall is extraordinarily high, which prevents

projection in front of the camera. The building that extends to the horizon is the
distant enough so that it does not affect rights to privacy, especially
when it is not an interior space, but, at most, it would be the space
exterior or terrace of another dwelling (...).


We understand that the placement of the worthy cameras does not infringe rights
related to data protection, since its orientation focuses exclusively
to the property of this party and serve exclusively the object of protection
domestic, being that the focused spaces adjacent to the property are
merely accessories, without relevance, belonging to the public thoroughfare or

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/8








tremendously distant in space, which exclusively occupy the "minimum strip
of access" to the house and whose recording is essential to obtain the purpose of
protection pursued.


(…)

The cameras arranged obey exclusive personal or domestic purposes,
having been installed by a natural person. These two qualities mean that
the facts are not applicable to Regulation (EU) 2016/679 (...).


It is obvious that the cameras arranged, even if it is considered
the aforementioned data protection regulations apply, it must be considered that they do not
infringes any precept whenever the weighting rules determine that
there is a legitimate interest in its placement motivated by the preservation of the

security of the home that must be put before obtaining minimal and merely
testimony of images about the surrounding space, in the terms that have been
previously stated."

Provide a photograph of what the four cameras capture.


SIXTH: On 01/11/2021, the instructor of the procedure agreed to open
a period of practice of tests, taking as incorporated the actions
preliminary investigation, E/06518/2021, as well as the documents provided by the
Claimed on 12/20/2021.


SEVENTH: On 01/13/2022, a resolution proposal was formulated in which the
proposed to direct a warning to the defendant for the infringement of article 13 of the
GDPR, since the photographic report attached to the claim did not show the
presence of informative poster of video-surveilled area. However, having examined the
images from the monitor of the video surveillance cameras that the defendant provides in his

pleadings, it was considered that the video surveillance system located in the
exterior of his home does not make a disproportionate or excessive capture;
Your actions are not constituting an infringement of article 5.1.c) of the GDPR.

Likewise, in accordance with article 58.2.d) of the GDPR, the defendant was ordered to
Proceed to the placement of the corresponding area information signs

video surveillance

The resolution proposal was notified by postal mail and was returned by
wrong address. It was resent via courier service. I don't know
have received allegations to the proposal.


In view of all the proceedings, by the Spanish Agency for Data Protection
In this proceeding, the following are considered proven facts:


                                PROVEN FACTS


FIRST: Existence of four video surveillance cameras installed in
***ADDRESS 1,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/8








    - The first of the cameras is installed at the top of a window
       of the facade of the property of the claimed. It is accredited, through photography
       provided by him, that the camera captures the entire entrance patio of his home,

       but it is not observed that it points directly to the public road. However, at
       capture the access door to the patio, yes, a minimal portion of the
       public road, being this within the legal limits for not being
       disproportionate.

    - The second and third cameras, located on the railing and wall of the balcony

       back of the defendant's home, focus directly on the backyard of the defendant.
       building and the surface of the balcony, respectively. With respect to
       camera two, the area of the patio of the community that it captures is negligible, since
       the cloth that is placed on the exit door and on the adjacent fences prevents
       view much of the patio.


    - The fourth camera is installed on top of a roof wall
       of the defendant, without it being appreciated in the photograph provided by the latter that captures
       direct images of the claimant's rooftop.


SECOND: Absence of an informative poster of the installation of the
video surveillance.

THIRD: The person in charge of the video surveillance system is B.B.B. with NIF ***NIF.1.



                           FUNDAMENTALS OF LAW

                                            Yo


In accordance with the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter GDPR), grants each
control authority and as established in articles 47 and 48.1 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter, LOPDGDD), is competent to initiate and resolve
this procedure the Director of the Spanish Data Protection Agency.


Likewise, article 63.2 of the LOPDGDD determines that: "Procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in its development and, insofar as they do not contradict them, with character

subsidiary, by the general rules on administrative procedures.”

                                            II

In this case, it is appropriate to examine the claim dated 05/20/2021 filed

in this Agency in which the existence of a video surveillance system is indicated,
composed of 4 cameras, installed in ***ADDRESS.1, which due to its positioning
and characteristics seems to be covering a part of the public road and areas of
private transit of the claimant, beyond the strict access that by the surveillance of the
property could be considered suitable.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/8









In addition, in the claimant's photographic report it is not seen that the claimed party
have an informative poster informing about the presence of cameras and

on the identity of the data controller.

Article 5.1 c) of the GDPR provides that personal data shall be "adequate,
“adequate, relevant and limited to what is necessary in relation to the purposes for which
that are processed (“data minimization”).


It should be remembered that individuals are responsible for ensuring that the systems
installed comply with current legislation, certifying that it complies with
all the requirements demanded by the regulations in force.

The installation of this type of device must have the mandatory sign

informative, indicating the purposes and data controller, where appropriate
of a personal nature.

Article 22.4 of the LOPDGDD provides that:

"The duty of information provided for in article 12 of Regulation (EU) 2016/679 is

shall be deemed fulfilled by the placement of an informative device in place
sufficiently visible identifying, at least, the existence of the treatment, the
identity of the person responsible and the possibility of exercising the rights provided for in the
Articles 15 to 22 of Regulation (EU) 2016/679. It may also be included in the
information device a connection code or internet address to this

information."

In any case, the cameras must be oriented towards the particular space, avoiding
intimidate neighboring neighbors with this type of device, as well as control areas
transit thereof without just cause.


It is not possible to obtain images of public space with this type of device either,
as this is the exclusive competence of the State Security Forces and bodies.

It should be remembered that even in the case of being a "simulated" camera, the same
should preferably be oriented towards private space, since it is considered

that this type of device can affect the privacy of third parties, which are seen
intimidated by it into the belief of being permanently recorded.

On the part of individuals, it is not possible to install sections for obtaining images
of public space, outside the cases allowed in the regulations.


Article 13 of the GDPR, sections 1 and 2, establishes the information that must be provided
to the interested party at the time of data collection. In the case of treatments
of personal data for surveillance purposes through camera systems or
video cameras, the duty of information can be fulfilled by placing, in the

video-surveilled areas, of an informative badge located in a place sufficiently
visible, both in open and closed spaces, and using forms in the
that the information provided is detailed, which the person in charge must make available
of those interested.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/8









These infractions are typified in article 83.5 of the GDPR:


Violations of the following provisions will be sanctioned, in accordance with the
section 2, with administrative fines of a maximum of 20,000,000 EUR or,
in the case of a company, an amount equivalent to 4% of the turnover
global annual total of the previous financial year, opting for the highest amount:

a) The basic principles for the treatment, including the conditions for the

consent under articles 5, 6, 7 and 9;

b) The rights of the interested parties in accordance with articles 12 to 22;

For the purposes of the limitation period for infringements, they are considered very

serious and prescribed after three years, in accordance with article 72.1 of the LOPDGDD, which
states that:

a) The processing of personal data in violation of the principles and guarantees
established in article 5 of Regulation (EU) 2016/679;


(…)

h) The omission of the duty to inform the affected party about the processing of their data
personal in accordance with the provisions of articles 13 and 14 of Regulation (EU)
2016/679 and 12 of this Organic Law.”


                                           II

The corrective powers available to the Spanish Agency for the Protection of
Data, as a control authority, are established in article 58.2 of the GDPR. Between

they have the power to direct a warning (art. 58.2 b)), the power
to impose an administrative fine in accordance with article 83 of the GDPR (art. 58.2 i)),
or the power to order the person in charge or in charge of the treatment that the
processing operations comply with the provisions of the GDPR, where applicable,
in a certain way and within a specified period (art. 58.2 d)).


According to the provisions of article 83.2 of the GDPR, the measure provided for in article 58.2
d) of the aforementioned Regulation is compatible with the sanction consisting of a fine
administrative.

In this case, given the special circumstances that occur in the

claimed responsible for the infringement and making a broad interpretation of the
criterion inspired by Recital 148 of the GDPR, according to which when the fine that
was likely to be imposed would constitute a disproportionate burden may
be imposed instead of a fine, a warning, it is estimated that due to the
infringement of article 13 of the GDPR it is appropriate to issue a warning.


                                          IV.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/8








In this case, it has been verified that the claimed party has in his home
four video surveillance cameras oriented in accordance with protection regulations
of personal data. By not exclusively limiting the capture of

images inside the house because the cameras are located outside, it is
likely to capture images of people outside the property (access area or
perimeter), resulting from application of the aforementioned regulations.

After analyzing the images provided by the defendant in the writ of
allegations to the opening agreement, it is considered that the exterior chambers that are

capable of capturing images of public transit areas are within
the limits indicated in article 22 of the LOPDGDD, since they only focus on a
minimum portion of the public highway adjacent to the access to the defendant's home,
being provided. Regarding the private transit areas of the claimant,
considers that none of the outer cameras are positioned in such a way as to capture

direct images of the claimant's property, so there is no excess in the
catchment. For this reason, the conduct of the defendant does not imply an infringement of the
Article 5.1.c) of the GDPR.

However, the defendant has not provided any photograph or document that
Allows you to check if there is an informative sign of a video-surveilled area. Therefore, and

given that the claimant provided several photographs of the exterior of the house, without
observe any distinctive in any of them, it is understood that there is an infringement of the
article 13 of the GDPR.

Therefore, in accordance with the applicable legislation and assessed the criteria of

graduation of sanctions whose existence has been accredited,

The Director of the Spanish Data Protection Agency RESOLVES:

FIRST: ADDRESS B.B.B., with NIF ***NIF.1, for a violation of article 13 of the

GDPR, typified in article 83.5.b) of the GDPR, a warning.

SECOND: TO ORDER B.B.B., with NIF ***NIF.1 that by virtue of article 58.2 d) of the
GDPR, within ten business days, take the following steps:

    - Accredit having proceeded to the placement of the informative sign in the areas

       video surveillance (at least the existence of a treatment must be identified,
       the identity of the person responsible and the possibility of exercising the rights provided
       in said precepts), locating this device in a place sufficiently
       visible.


    - Evidence that the information to which it is
       refers to the aforementioned GDPR.


THIRD: NOTIFY this resolution to B.B.B..


In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once the interested parties have been notified.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/8








Against this resolution, which puts an end to the administrative process in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the

Interested parties may optionally file an appeal for reversal before the
Director of the Spanish Agency for Data Protection within a period of one month from
count from the day following the notification of this resolution or directly
contentious-administrative appeal before the Contentious-administrative Chamber of the

National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within a period of two months from the
day following the notification of this act, as provided for in article 46.1 of the
referred Law.


Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the firm resolution in administrative proceedings if the
The interested party expresses his intention to file a contentious-administrative appeal.

If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Data Protection Agency, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
web/], or through any of the other registries provided for in art. 16.4 of the
aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the

documentation proving the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative proceedings within a period of two months from the day following the
Notification of this resolution would terminate the precautionary suspension.



                                                                                938-120722
Mar Spain Marti
Director of the Spanish Data Protection Agency



























C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es