AEPD (Spain) - PS/00028/2021

AEPD - PS/00028/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 6(1)(e) GDPR Article 22 LOPDGDD
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	20.04.2021
Fine:	None
Parties:	MINISTERIO DE DEFENSA
National Case Number/Name:	PS/00028/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD decision (in ES)
Initial Contributor:	n/a

The Spanish DPA warned the Ministry of Defence for having cameras outside of its building that partly recorded private parking spots belonging to nearby houses, where this was not strictly necessary for security purposes.

English Summary

Facts

The Spanish DPA (AEPD) received a complaint from a data subject living close to a building owned by the Spanish Ministry of Defence. Such building had cameras recording its outside perimeter, that included private parking spots from homes more than five meters apart.

The data subject alleged that, as they owned one of those homes, they were recorded by the cameras every time they moved around their home, so any security workers of the building could know what time they left and entered the house, recording their vehicle, including its licence plate, and themselves while doing it.

The Ministry of Defence acknowledged that, even if there were informing banners about the cameras, some made reference to the former data protection act, and that the angles of some cameras should be adjusted. Those cameras showed part of an avenue, including private homes, and part of the facade of some buildings, showing the inside of the homes through them. They also alleged that the images could only be watched in certain cases authorized by law. Also, that the legal basis for the recording was Article 6(1)(e), given the fact that the surroundings of the building were classified as military-home-zone, and they had authorization to proceed in such a way.

Holding

The Spanish DPA acknowledged the right of the Ministry of Defence to obtain such recordings through the camera, with grounds on Article 6(1)(e) GDPR and Article 22 of the Spanish Data Protection Act (LOPDGDD), that allows the recording of public spaces when it is necessary to ensure the security of strategic facilities, as long as they do not record the inside of private homes.

However, the AEPD held that there had been a violation of Article 5(1)(c) GDPR. Even if the Ministry had a legal basis for the treatment, the minimization principle shall always be complied with. The AEPD concluded that some of the cameras gathered images that were not strictly necessary for security purposes (such as the ones that recorded a whole avenue, obtaining images of private parking spots, or the ones pointing to the facade of buildings), therefore infringing Article 5(1)(c).

For this, the AEPD warned the Ministry of Defence, given that the Spanish Data Protection Act does not allow for fines to public institutions.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                1/8










     Procedure No.: PS / 00028/2021


                RESOLUTION OF SANCTIONING PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following


                                       FACTS

FIRST: Mr. A.A.A. (* hereinafter, the claimant) dated October 4, 2019
filed a claim with the Spanish Data Protection Agency. The
The claim is directed against MINISTRY OF DEFENSE with NIF S2801407D (in

ahead, the claimed one). The reasons on which the claim is based are so
succinctly the following:

       “The cameras capture the parking lot of the surrounding houses, taking
license plates with more than five meters of separation from its fence that limits the terrain of

said residence, in such a way that the workers of the residence with access to
camera screens or recordings know what time I arrive, when I leave and
they record my license plate and the movements of my vehicle and myself ”(folio nº 1).

       Along with the claim, it provides documentary evidence (Annex I) that proves the

presence of a device that could obtain image (s) of the area of
Claimant's vehicle parking.

SECOND: In view of the facts denounced in the claim and the documents
provided by the claimant, the General Sub-Directorate for Inspection of Proprietary Data
agreed to carry out preliminary investigation actions to clarify

of the facts in question, by virtue of the powers of investigation granted to the
control authorities in article 57.1 of Regulation (EU) 2016/679 (Regulation
General Data Protection, hereinafter RGPD), and in accordance with the provisions
cido in Title VII, Chapter I, Second Section, of Organic Law 3/2018, of 5 of
December, Protection of Personal Data and guarantee of digital rights (in

hereinafter LOPDGDD).

As a result of the investigative actions carried out, it is verified that the
responsible for the treatment is the one claimed.


       The result of the previous investigation is reflected in the file
you with reference number E / 12131/2019.

THIRD: On October 29, 2019, the claim is transferred to the
Ministry of Defense requesting clarification on the causes that have motivated the
claim.

FOURTH: On December 30, 2019, without receiving a letter from German
tions of the aforementioned Ministry, the Spanish Agency for Data Protection agreed to

to carry out the present investigation actions in relation to the facts related to
cried out.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/8








FIFTH: On January 13, 2020, it is received at this Agency, with number
registration 001176/2020, answer sent by the Ministry of Defense manifes-
considering that after the analysis of the system, two aspects that could be improved

could be cause of claim: one, relative to the degree of fulfillment of the duty
of informing and of transparency, concretized in some deficiency of the signage; Y
another, relative to the orientation of some of the outer cameras.

Regarding the obligation to inform the interested party of the video-monitored area, there are
posters both outside the Residence and inside, detecting that al-
some of them made reference to the previous data protection regulations, therefore
that instructions have been given to the facility for their correction. They provide photographic report
tographic of a total of 9 informative posters and their situation.

It is verified that the video-surveillance area is reported through posters in all the
entrances to the enclosure and other places of the perimeter and in the common areas of the interior of
the residence, indicating the person responsible for the treatment and where the inter-

sado to exercise the rights contained in the RGPD.
They also inform this Agency that regarding the capture of images by the

video surveillance cameras, have proceeded to modify their orientation in order to
in order to minimize the capture of areas beyond the perimeter of the Residence and to
Above all, the visualization of the windows of the adjoining houses (facades
East and West Side). In this sense, they provide screen printing of the images
captured by the sixteen video surveillance cameras as seen on the monitor

display. The reorientation of cameras 2 and 7 installed in the
East Lateral façade and chambers 4 and 5 on the West Lateral façade.
In relation to the capture of the video surveillance camera claimed (camera No. 2

located on the East Side façade) it is observed that it no longer captures the windows of the
adjoining house but still partially visualizing Avenida *** AVENIDA.1
that is located between the Residence and the adjoining houses and where the
parking indicated in the claim.

SIXTH: On February 9, 2021, the Director of the Spanish Agency for Pro-
Data protection agreed to initiate a sanctioning procedure for the complained party, in accordance with
the provisions of articles 63 and 64 of Law 39/2015, of October 1, on the Procedure

Common Administrative Procedure of Public Administrations (hereinafter, LPA-
CAP), for the alleged violation of Article 5.1.c) of the RGPD, typified in Article
83.5 of the GDPR.

SEVENTH: Once the aforementioned commencement agreement was notified, the defendant submitted a written
allegations in which, in summary, it stated the following:

        -Responsible for the installation 4th General Subinspection Army Land (ET),
*** ADDRESS.1 (*** LOCATION.1).

        -It is only intended to allow the viewing of images, as intended
In the law (…).
        -As already indicated, the change of the

posters, adapting the text with reference to the new regulations.
        -There are 9 informative posters in the installation of the existence of an area

video-surveillance.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/8








EIGHTH: A list of documents in the document is attached as an annex.
procedure, remembering full accessibility to the file if required.

NINTH: On 03/08/21 a "Proposal for a Resolution" is issued by which the
declares the commission of the infringement of article 5.1 c) RGPD, by disposing of it denounced
of several cameras oriented excessively towards the public area, making a
"Data processing" of third parties without just cause.

TENTH: On 03/22/21 this Agency receives a written reply to the
"Resolution proposal" arguing the following:

       Nullity of the procedure due to defenselessness.

       It is not until February 15, 2021, in the document signed on that date, that
The AEPD notified the Agreement to initiate the sanctioning procedure, which has been
proof of the author's Complaint and the facts allegedly sanctioned, without any other
mention of the transcript of the quotation of part that is included in the brief of the

allegedly irregular facts.
       The art. 53.2 Law 39/2015, (October 1) establishes the rights of the alleged

responsible for the sanctioning procedure in accordance with the provisions of the
Article 24 EC.
       In conclusion of what has been stated so far and with express invocation of the

provided in art. 47 point 1 a) and e) of the aforementioned Law 39/15 we request the Archive of
the performances.

       On the substance of the matter. It turns out that from what has been done so far, it has
It has been proven that the area in which the events took place is about houses that
are characterized to military groups, since these areas are classified
currently in the 2019 PGOU as “military-housing-zones”.

       Therefore, the person responsible for the treatment has the legitimacy to carry it out
under art. 6.1 E) RGPD, as it is necessary for the fulfillment of a mission
carried out in the public interest in the exercise of public powers conferred on the
responsible for the treatment finding its legality in the regulations above

cited.
       REQUEST: On behalf of the MDEF that I hold, that you previously

Timely verifications that proceed in Law and taking into account the allegations
(…) The File of the present proceedings is decreed "


Of the actions carried out in this procedure and of the documentation
Obrante in the file, the following have been accredited:

                                PROVEN FACTS

First. On 10/04/20 a claim is received against the entity-Ministry of Defense.
sa-transmitting as main fact:

       “The cameras capture the parking lot of the surrounding houses, taking
license plates with more than five meters of separation from its fence that limits the terrain of
said residence, in such a way that the workers of the residence with access to
camera screens or recordings know what time I arrive, when I leave and

they record my license plate and the movements of my vehicle and myself ”(folio nº 1).

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/8








Second. It is proven that the video surveillance system is associated with the Ministry of
Defense Territory (AGE).

Third. It is proven that the Ministry of Defense (denounced) did not have
the signage in legal form, showing certain “deficiencies” that are being remedied
swimming.

Bedroom. The denounced system is aimed at the security of the Department of
nisterial, building and staff of the same, being responsible for the effective control

of the system the Second Chief of Staff Army Land (ET).
Fifth. Of the set of cameras installed (16 in total) it was found that four performed

caused excessive uptake, proceeding to correct their angle or pro-
yielding to the "masking" of the images.

        Annex II (Evidentiary Documentary) shows the before and after of the
gulo corrected.

                                                                                      48-16112
                            FOUNDATIONS OF LAW


                                              I

By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in articles 47 and 48 of the LOPDGDD, the Director
of the Spanish Data Protection Agency is competent to initiate and to re-

solve this procedure.
                                             II

Before going into the merits of the matter, it is convenient to examine the request for Annulment of the
present proceedings claiming helplessness.


        Article 62 of Law 39/2015 81 October) provides: “A complaint is understood to be
cia, the act by which any person, in compliance or not with a legal obligation,
gal, informs an administrative body of the existence of a certain
fact that could justify the ex officio initiation of an administrative procedure.

vo ".

Having consulted the base of this body, there is no record that the defendant exercised her
right (art. 53.1 "in fine" Law 39/2015) "to access and obtain a copy of the documents
contained in the aforementioned procedures ”.


Therefore, it is not possible to use "defenselessness" when it has not exercised in
time and form your legally recognized rights.

        As stated in the brief of allegations dated 03/22/21 in the Agreement

Initiation of this Agency is already expressly mentioned that the procedure begins
by Complaint of the claimant, being clear the "facts" that were imputed to him and
Those who have had the opportunity to claim what has been considered appropriate.

        Furthermore, it does not specify what the defenselessness produced consists of,

making a generic argument, when the reality is that it has been allowed

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/8








argue all that is necessary to prove the legality of the camera system object-
to denounce.


        Therefore, it is not considered that there is any cause for nullity, reason
by which the application in this regard should be rejected.

                                             III

In the present case, we proceed to examine the claim for the date of entry into

this Agency 10/04/19 by means of which the following is transferred as the main event
next:

        “The cameras capture the parking lot of the surrounding houses, taking
license plates with more than five meters of separation from its fence that limits the terrain of

said residence, in such a way that the workers of the residence with access to
camera screens or recordings know what time I arrive, when I leave and
they record my license plate and the movements of my vehicle and myself ”(folio nº 1).

The facts are therefore specified in the proportionality of the obtaining of images
through video surveillance cameras, considering "excessive" the target perimeter

uptake.

        Article 22 section 2 of the LOPDGDD provides the following:

        “Images of the public road may only be captured to the extent that it is

Essential for the purpose mentioned in the previous section. However, it will be
it is possible to capture the public road in a greater extension when necessary
ary to ensure the security of strategic assets or facilities or infrastructure
structures related to transport, without in any case involving the capture
of images of the interior of a private home "


        The allegations made initially were considered insufficient to determine
create the File of the claim presented, by continuing to affect the system to the
claimant's parking area, without any reasoned explanation being made
in this regard, the "facts" that are the object of the complaint subsist.


        Video surveillance, as a solution to a security problem, should be a
adequate, pertinent and not excessive measure in relation to the purpose pursued and
that justifies the installation of surveillance cameras. Furthermore, the proportionality
requires that the end of security cannot be achieved through other alternative means.
native, less intrusive to the fundamental rights of users.


        Through the use of sound and image recording systems and their post-
subsequent treatment, the level of protection of the assets and
liberties of the people.
                                             IV


In accordance with the evidence available in this proceeding
sanctioner, it is considered that the defendant has a video camera system


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/8








deo-surveillance whose capture of images had been "excessive", affecting
this way to third party rights.


       Specifically, some of the exterior cameras were oriented towards the area
of public transit and adjacent buildings, exercising excessive control of di-
chas areas without just cause.

       The known facts are constitutive of an infraction, attributable to the claim.
mado, for violation of the content of art. 5.1 c) GDPR.


       Article 58 section 2 of the RGPD provides the following: Each authority of
control will have all of the following corrective powers listed below:

       d) order the person in charge of the treatment that the operations of

treatment comply with the provisions of this Regulation, where appropriate,
in a certain way and within a specified time;

       The behavior described is subsumed in the offending type of art. 83.5 a) GDPR,
which prescribes the following:


       "Violations of the following provisions will be sanctioned, in accordance with
with paragraph 2, with administrative fines of a maximum of EUR 20,000,000 or,
for a company, an amount equivalent to a maximum of 4% of the volume
total annual global business menu for the previous financial year, opting for the
higher amount:


       a) the basic principles for the treatment, including the conditions for the treatment
           consent in accordance with articles 5, 6, 7 and 9;

                                            V


Article 77 section 1 of the LOPDGDD provides:

       "The regime established in this article will be applicable to the treatments
of those who are responsible or in charge:


       c) The General State Administration, the Administrations of the communities
Autonomous entities and entities that make up the Local Administration.
       2. When the managers or managers listed in section 1 commit-
have any of the infractions referred to in articles 72 to 74 of this law
organic, the competent data protection authority will issue a resolution

sanctioning them with warning. The resolution will thus establish
The measures to be adopted to stop the behavior or correct the
effects of the offense that had been committed.

       The resolution will be notified to the person in charge of the treatment, to the

earning that depends hierarchically, where appropriate, and those affected who had the
condition of interested party, if applicable (…) ”.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/8








       4. The data protection authority must be informed of the resolutions
tions that fall in relation to the measures and actions referred to in the
previous sections.


       5. They will be communicated to the Ombudsman or, where appropriate, to the institutions
of the autonomous communities, the actions carried out and the resolutions
rules issued under this article.

                                                SAW


By the denounced party, as a result of this procedure, it has been proceeded to correct
the "deficiencies" of the system, showing an attitude of full collaboration with this
organism.


       We have proceeded to correct the "irregularities" consisting of a collection
excessive perimeter areas, which could affect the rights of neighbors
adjoining, preserving their privacy.

       Orders have been given to update the posters to the regulations in force, es-
taking the measures pending compliance to date.


       On this aspect, it should be emphasized that no documentary evidence has been provided.
that certifies the effective change of the signage adapting it to the RGPD.

       Remember in any case that current regulations (RGPD) allow a

greater uptake of adjacent areas of public buildings, to avoid vandalized acts
and incardinated in the security of state institutions.

       “However, it will be possible to capture the public highway in a sub-
superior when necessary to guarantee the safety of goods or facilities

strategic (…) ”-art. 22 LOPDGDD--.

       The data processing (license plate) of the cars that park in an adjacent area
Centence is an issue incardinated in the security of the complex, and may be of interest
For this reason, the control of the same, without being considered excessive a priori, that
they remain recorded within the deadlines set in the regulations.


It should be remembered that cameras improve public safety because they affect different
reducing subjective insecurity, allow early reaction to emergencies
of diverse nature, as well as help to the pursuit of nature activities
criminal.


       Notwithstanding the foregoing, it is necessary to verify the commission of the offense
described, since the corrections have occurred after the notification of the Agreement of
Initiation of this sanctioning procedure, although it is not necessary to impose
any corrective measure (s) as they have been diligently adopted by the

Ministry outlined, except in relation to the corrections of the posters of the
complex.
       Remember that if you proceed to modify the angle of the cameras,

as long as it is necessary to preserve the safety of the installation for the sake of
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/8








of greater protection of the building and personnel at your service, you must notify
this body with reference to the procedure number in question.


       For the aforementioned reasons, the request for the Archive of the
present procedure, since some of the outer cameras “dealt with
data ”in excess of public area (eg catchment of the entire avenue); it has not been
accredited despite the time elapsed the change of the signage in the terms

widely recommended and finally, the "reminders" made by the
Instructor of the procedure cannot be used in this phase of the procedure
to claim the Archive of the same.

Therefore, in accordance with the applicable legislation and the graduation criteria assessed

tion of the sanctions whose existence has been proven,

the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: IMPOSE the MINISTRY OF DEFENSE, with NIF S2801407D, for an

fraction of Article 5.1.c) of the RGPD, typified in Article 83.5 of the RGPD, a san-
tion of APPRECIATION.

SECOND: NOTIFY this resolution to the MINISTRY OF DEFENSE.


THIRD: COMMUNICATE this resolution to the Ombudsman, of
in accordance with the provisions of article 77.5 of the LOPDGDD.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the inte-
Residents may file, optionally, an appeal for reconsideration before the Director
of the Spanish Agency for Data Protection within a month from

the day after notification of this resolution or directly contentious appeal
administrative before the Contentious-Administrative Chamber of the National Court,
in accordance with the provisions of article 25 and section 5 of the additional provision
Fourth nal of Law 29/1998, of July 13, regulating the Contentious Jurisdiction-
administrative, within a period of two months from the day following the notification

tion of this act, as provided in article 46.1 of the aforementioned Law.



                                                                                  938-131120
Mar Spain Martí
Director of the Spanish Agency for Data Protection









C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es