AEPD (Spain) - PS/00005/2020

AEPD - PS/00005/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	n/a
Published:	28. 2. 2020
Fine:	n/a
Parties:	Anonymous Sound Soul, S.L.
National Case Number/Name:	PS/00005/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish Data Protection Agency (AEPD) decided not to take further actions on Sound Soul, S.L. as data controller for the possible non-compliance with the data minimisation principle, as per Article 5(1)(c) GDPR.

English Summary

Facts

The decision is the consequence of a complaint submitted by a Spanish citizen stating that the data controller, who is the owner of a pub, had installed a video surveillance system recording part of the public road; such complaint included a picture proving that the video surveillance system was installed in the main façade of the pub.

Dispute

The AEPD started the corresponding investigation, and the data controller provided a copy of the images recorded by the video surveillance system. According to the AEPD, the images proved that the video surveillance system did not record more public road than the minimum necessary in order to keep the pub safe.

Holding

Based on point 4.3 of the AEPD's decision 1/2006 ("…those cameras installed in private spaces will only be able to record public spaces as long as it is essential for the required surveillance…") and the principle of presumption of innocence (as the complainant has not been able to prove the non-compliance), the AEPD understood that the data controller has not infringed the data minimisation principle and decided not to take further actions.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the **Spanish** original. Please refer to the **Spanish** original for more details.

RESOLUTION OF PENALTY PROCEDURE
the procedure instructed by the Spanish Data Protection Agency and based on the following
FIRST FACTS: A.A.A. (hereinafter, the claimant) on 24 October 2019 filed a complaint with the Spanish Data Protection Agency.   The claim is directed against SOUND SOUL, S.L. with CIF B02262327 (hereinafter, the claimant). The complaint is based on the following grounds: "installation of a video surveillance camera on the façade of the PUB, capturing part of the public space" and documentary evidence (Doc. No. 1) of the installation of the device in question on the façade of the establishment facing the street.SECOND: In view of the facts denounced in the complaint and the documents provided by the complainant, the Subdirectorate General of Data Inspection agreed to carry out preliminary investigations to clarify the facts in question, by virtue of the investigative powers granted to the control authorities in Article 57.1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter referred to as the GDRP), and in accordance with the provisions of Title VII, Chapter I, Section Two, of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter referred to as the LOPDGDD).As a result of the investigative actions carried out, it was confirmed that the person responsible for the processing is the complainant PORT OF PRINCE (in the following, the Pub) for the following facts according to the complainant: installation in the PUB's façade of a video surveillance camera capturing part of the public space, which according to the complainant took place at the time of the complaint, and attached the following documentation: photographic report of the installation of the camera: On November 29, 2018, within the file E/09423/2018, the complaint was transferred to the claimed through the postal services after two attempts of delivery, the notification was returned with the result "Returned to Ori-gen by Surplus (Not withdrawn in office) on 18/12/2018 at 08:55". On December 28, 2018, within file E/09423/2018, the claim was transferred to the claimed one through the postal services. After two attempts of delivery, the notification is returned with result "Returned to Ori-gen by Surplus (Not picked up at office) on 01/24/2019 at 08:18". On 30 January 2019, it was agreed to admit the claim presented by the claimant against PUB PUERTO PRINCIPE. During these proceedings, investigations have been carried out with the following entities: PUB PUERTO PRINCIPE, with NIF, domiciled at ***DIRECCIÓN.1SOUND SOUL S.L., with CIF B-02262327, domiciled at ***DIRECCIÓN.2Requested to the City Council of Albacete on the property of pub claimed, dated November 24, 2018 is received in this agency, with registration number 050773/2019, writing sent by this council reporting the following data: Owner: SOUND SOUL S.L.oCIF: B02262327 Activity: Discotheque Search in the Central Mercantile Register (hereinafter RMC) is found that its registered office is ***ADDRESS.2THIRD: On January 22, 2020, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the defendant, for the alleged infringement of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD.
FOURTH: On 06/02/20, this Agency received written allegations from the complainant stating the following: "That said camera is focused only on the door of the PUB, as shown in the Report and photo attached": Report from Alexma S.A. and image of the camera focus". In view of all that has been done, the following are considered proven facts by the Spanish Data Protection Agency in these proceedings,

FACTS
First. On 24/10/19, this agency received a complaint from the epigrapher stating the following: "installation of a video surveillance camera on the façade of the PUB, capturing part of the public space". The commercial entity Sound Soul S.L. is accredited as the main responsible for the installation of the system.   It is accredited that the capture of public space is the minimum necessary for the protection of the facade of the establishment. (Probative Doc. nº 1), not being appreciated in the evidence provided disproportionate or unnecessary capture of public and/or private space of third parties. By virtue of the powers that article 58.2 of the RGPD recognizes to each control author, and according to what is established in articles 47 and 48 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and resolve this procedure.IIIn the present case, we proceed to examine the claim dated 12/11/2019 by means of which the following is transferred as the main fact: "installation on the façade of the PUB of a video surveillance camera capturing part of the public space" (sheet nº 1): Personal data shall be: "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("minimisation of data"). The facts, therefore, are the existence of a camera that could be incorrectly oriented, according to the complainant's criteria, and could affect the right of third parties without justified cause. It should be remembered that individuals are responsible for ensuring that the systems installed comply with current legislation.

The installation of this type of device must have the obligatory informative poster, indicating the purposes and the person responsible for the treatment of the personal data. In any case, the cameras must be preferably oriented towards the private area, avoiding intimidating neighbors who are adjacent to this type of device, as well as controlling transit areas without justified cause.On 06/02/20, this Agency received a letter of allegations from the accused, in which he stated the following: "that it is not true that disproportionate amounts of public space were captured", providing documentary proof of what, if any, was captured with the camera in question. Article 4, paragraph 3 of Instruction 1/2006 (AEPD) provides the following: "Cameras and video cameras installed in private spaces may not obtain images of public spaces unless it is essential for the purpose of surveillance or it is impossible to avoid it due to the location of the same. Therefore, the mere observation of the camera on the façade of the establishment does not presuppose an infringement of the right to the image of third parties, and it may capture a minimum of public space, necessary to avoid acts of vandalism in the establishment (e.g., the use of a camera in the building). The presumption of innocence must rule without exception in the system of sanctions and must be respected in the imposition of any sanctions, since the exercise of jus puniendi in its various manifestations is conditioned by the game of evidence and a contradictory procedure in which the parties can defend their own positions. In this regard, the Constitutional Court in its Judgment 76/1990 of 26 April 1990, considers that the right to the presumption of innocence implies: "that the penalty be based on acts or means of proof of the charge or incriminating conduct; that the burden of proof be on the accuser, without anyone being obliged to prove his own innocence; and that any shortcoming in the results of the evidence, freely assessed by the prosecuting authority, must result in a finding of acquittal.

The presumption of innocence applies without exception in the system of penalties and must be respected in the imposition of any penalty, whether criminal or administrative (TCo 13/1981), since the exercise of the right to impose penalties in any of its manifestations is subject to the presentation of evidence and a procedure in which one's own position can be defended.In accordance with this principle, no penalty may be imposed on account of the guilt of the accused if there is no probative activity on the part of the authorities or bodies called upon to rule on the matter that destroys this presumption (Case T-26/01).IVIn accordance with the arguments set out above and once the evidence provided has been analysed, it can be concluded that the camera installed complies with current legislation in that it captures a space that is proportionate to the intended purpose.SECOND: NOTIFY this resolution to SOUND SOUL, S.L. and INFORM the complainant Mr. A.A.A. In accordance with the provisions of article 50 of the LOPDGDD, this resolution will be made public once it has been notified to the interested parties..6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, the interested parties may, optionally, lodge an appeal for reversal with the Director of the Spanish Data Protection Agency within a period of one month starting from the day following notification of this resolution or the address of the contentious-administrative proceedings before the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998 of 13 July, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned Law. Mar Spain MartíDirector of the Spanish Data Protection Agency